new version 2.4.66

mod_ssl: Add SSLVHostSNIPolicy directive to set the compatibility level
required for VirtualHost matching.

.fmf/version

@@ -0,0 +1 @@
+1

.gitignore

@@ -37,3 +37,22 @@ x86_64
 /apachectl.8
 /httpd-2.4.43.tar.bz2.asc
 /KEYS
+/httpd-2.4.46.tar.bz2.asc
+/httpd-2.4.48.tar.bz2.asc
+/httpd-2.4.49.tar.bz2.asc
+/httpd-2.4.50.tar.bz2.asc
+/httpd-2.4.51.tar.bz2.asc
+/httpd-2.4.52.tar.bz2.asc
+/httpd-2.4.53.tar.bz2.asc
+/httpd-2.4.54.tar.bz2.asc
+/httpd-2.4.55.tar.bz2.asc
+/httpd-2.4.56.tar.bz2.asc
+/httpd-2.4.57.tar.bz2.asc
+/httpd-2.4.58.tar.bz2.asc
+/httpd-2.4.59.tar.bz2.asc
+/httpd-2.4.61.tar.bz2.asc
+/httpd-2.4.62.tar.bz2.asc
+/httpd-2.4.63.tar.bz2.asc
+/httpd-2.4.64.tar.bz2.asc
+/httpd-2.4.65.tar.bz2.asc
+/httpd-2.4.66.tar.bz2.asc

00-base.conf

@@ -15,6 +15,7 @@ LoadModule authn_dbd_module modules/mod_authn_dbd.so
 LoadModule authn_dbm_module modules/mod_authn_dbm.so
 LoadModule authn_file_module modules/mod_authn_file.so
 LoadModule authn_socache_module modules/mod_authn_socache.so
+LoadModule authnz_fcgi_module modules/mod_authnz_fcgi.so
 LoadModule authz_core_module modules/mod_authz_core.so
 LoadModule authz_dbd_module modules/mod_authz_dbd.so
 LoadModule authz_dbm_module modules/mod_authz_dbm.so
@@ -23,7 +24,6 @@ LoadModule authz_host_module modules/mod_authz_host.so
 LoadModule authz_owner_module modules/mod_authz_owner.so
 LoadModule authz_user_module modules/mod_authz_user.so
 LoadModule autoindex_module modules/mod_autoindex.so
-LoadModule brotli_module modules/mod_brotli.so
 LoadModule cache_module modules/mod_cache.so
 LoadModule cache_disk_module modules/mod_cache_disk.so
 LoadModule cache_socache_module modules/mod_cache_socache.so

00-brotli.conf

@@ -0,0 +1 @@
+LoadModule brotli_module modules/mod_brotli.so

apachectl.sh

@@ -15,6 +15,13 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+###
+### NOTE: This is a replacement version of the "apachectl" script with
+### some differences in behaviour to the version distributed with
+### Apache httpd.  Please read the apachectl(8) man page for more
+### information.
+###
+
 if [ "x$1" = "x-k" ]; then
     shift
 fi

apachectl.xml

@@ -5,6 +5,7 @@
 ]>
 <!--
  Copyright 2020 Red Hat, Inc.
+ Copyright 2018 Frank Dana
 
  Licensed to the Apache Software Foundation (ASF) under one or more
  contributor license agreements. See the NOTICE file distributed with
@@ -70,7 +71,7 @@
 
       <para>The version of <command>apachectl</command> used on this
       system is a replacement script intended to be mostly (but not
-      completely) compatible with version provided with
+      completely) compatible with the version provided with
       <emphasis>Apache httpd</emphasis>.  This
       <command>apachectl</command> mostly acts as a wrapper around
       <command>systemctl</command> and manipulates the
@@ -160,7 +161,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>configtest</option></term>
+        <term><option>configtest</option> | <option>-t</option></term>
         <listitem>
           <para>Run a configuration file syntax test. It parses the configuration
           files and either reports <literal>Syntax OK</literal>
@@ -172,8 +173,8 @@
   </refsect1>
 
   <refsect1 id='bugs'>
-    <title>Bugs</title>
-    <para>Please report bugs by filing an issue in Bugzilla via <ulink url='https://bugzilla.redhat.com/'/>.</para>
+    <title>Reporting Bugs</title>
+    <para>Please report bugs by filing an issue in @BUG_REPORT_URL@.</para>
   </refsect1>
 
     <refsect1>

ci.fmf

@@ -0,0 +1 @@
+resultsdb-testcase: separate

gating.yaml

@@ -0,0 +1,27 @@
+--- !Policy
+product_versions:
+  - fedora-*
+decision_contexts: [bodhi_update_push_testing]
+subject_type: koji_build
+rules:
+  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/tier1-public.functional}
+
+#gating rawhide
+--- !Policy
+product_versions:
+  - fedora-*
+decision_contexts: [bodhi_update_push_stable]
+subject_type: koji_build
+rules:
+  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/tier1-public.functional}
+
+#gating rhel
+--- !Policy
+product_versions:
+  - rhel-*
+decision_context: osci_compose_gate
+rules:
+  - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier1.functional}
+  - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier2.functional}
+  - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier3.functional}
+  - !PassingTestCaseRule {test_case_name: osci.brew-build./plans/tier1-internal.functional}

htcacheclean.service

@@ -7,5 +7,10 @@ Documentation=man:htcacheclean.service(8)
 Type=forking
 User=apache
 PIDFile=/run/httpd/htcacheclean/pid
+Environment=LANG=C
 EnvironmentFile=/etc/sysconfig/htcacheclean
 ExecStart=/usr/sbin/htcacheclean -P /run/httpd/htcacheclean/pid -d $INTERVAL -p $CACHE_ROOT -l $LIMIT $OPTIONS
+PrivateTmp=true
+
+[Install]
+WantedBy=multi-user.target

htcacheclean.service.xml

@@ -106,6 +106,11 @@
     <filename>/etc/sysconfig/htcacheclean</filename></para>
   </refsect1>
 
+  <refsect1>
+    <title>Reporting Bugs</title>
+    <para>Please report bugs by filing an issue in @BUG_REPORT_URL@.</para>
+  </refsect1>
+
   <refsect1>
     <title>See also</title>
 

httpd-2.4.18-sslmultiproxy.patch

@@ -1,98 +0,0 @@
-diff --git a/modules/ssl/mod_ssl.c b/modules/ssl/mod_ssl.c
-index 717a694..a3ce718 100644
---- a/modules/ssl/mod_ssl.c
-+++ b/modules/ssl/mod_ssl.c
-@@ -395,6 +395,9 @@ static SSLConnRec *ssl_init_connection_ctx(conn_rec *c)
-     return sslconn;
- }
- 
-+static typeof(ssl_proxy_enable) *othermod_proxy_enable;
-+static typeof(ssl_engine_disable) *othermod_engine_disable;
-+
- int ssl_proxy_enable(conn_rec *c)
- {
-     SSLSrvConfigRec *sc;
-@@ -403,6 +406,12 @@ int ssl_proxy_enable(conn_rec *c)
-     sc = mySrvConfig(sslconn->server);
- 
-     if (!sc->proxy_enabled) {
-+        if (othermod_proxy_enable) {
-+            ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, c,
-+                          "mod_ssl proxy not configured, passing through to other module.");
-+            return othermod_proxy_enable(c);
-+        }
-+
-         ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, c, APLOGNO(01961)
-                       "SSL Proxy requested for %s but not enabled "
-                       "[Hint: SSLProxyEngine]", sc->vhost_id);
-@@ -422,6 +431,10 @@ int ssl_engine_disable(conn_rec *c)
- 
-     SSLConnRec *sslconn = myConnConfig(c);
- 
-+    if (othermod_engine_disable) {
-+        othermod_engine_disable(c);
-+    }
-+
-     if (sslconn) {
-         sc = mySrvConfig(sslconn->server);
-     }
-@@ -621,6 +634,9 @@ static void ssl_register_hooks(apr_pool_t *p)
-     ap_hook_post_read_request(ssl_hook_ReadReq, pre_prr,NULL, APR_HOOK_MIDDLE);
- 
-     ssl_var_register(p);
-+    
-+    othermod_proxy_enable = APR_RETRIEVE_OPTIONAL_FN(ssl_proxy_enable);
-+    othermod_engine_disable = APR_RETRIEVE_OPTIONAL_FN(ssl_engine_disable);
- 
-     APR_REGISTER_OPTIONAL_FN(ssl_proxy_enable);
-     APR_REGISTER_OPTIONAL_FN(ssl_engine_disable);
-diff --git a/modules/ssl/ssl_engine_vars.c b/modules/ssl/ssl_engine_vars.c
-index a6b0d0d..24fd8c7 100644
---- a/modules/ssl/ssl_engine_vars.c
-+++ b/modules/ssl/ssl_engine_vars.c
-@@ -54,6 +54,8 @@ static char *ssl_var_lookup_ssl_cipher(apr_pool_t *p, SSLConnRec *sslconn, char
- static void  ssl_var_lookup_ssl_cipher_bits(SSL *ssl, int *usekeysize, int *algkeysize);
- static char *ssl_var_lookup_ssl_version(apr_pool_t *p, char *var);
- static char *ssl_var_lookup_ssl_compress_meth(SSL *ssl);
-+static APR_OPTIONAL_FN_TYPE(ssl_is_https) *othermod_is_https;
-+static APR_OPTIONAL_FN_TYPE(ssl_var_lookup) *othermod_var_lookup;
- 
- static SSLConnRec *ssl_get_effective_config(conn_rec *c)
- {
-@@ -68,7 +70,9 @@ static SSLConnRec *ssl_get_effective_config(conn_rec *c)
- static int ssl_is_https(conn_rec *c)
- {
-     SSLConnRec *sslconn = ssl_get_effective_config(c);
--    return sslconn && sslconn->ssl;
-+
-+    return (sslconn && sslconn->ssl)
-+        || (othermod_is_https && othermod_is_https(c));
- }
- 
- static const char var_interface[] = "mod_ssl/" AP_SERVER_BASEREVISION;
-@@ -137,6 +141,9 @@ void ssl_var_register(apr_pool_t *p)
- {
-     char *cp, *cp2;
- 
-+    othermod_is_https = APR_RETRIEVE_OPTIONAL_FN(ssl_is_https);
-+    othermod_var_lookup = APR_RETRIEVE_OPTIONAL_FN(ssl_var_lookup);
-+
-     APR_REGISTER_OPTIONAL_FN(ssl_is_https);
-     APR_REGISTER_OPTIONAL_FN(ssl_var_lookup);
-     APR_REGISTER_OPTIONAL_FN(ssl_ext_list);
-@@ -272,6 +279,15 @@ char *ssl_var_lookup(apr_pool_t *p, server_rec *s, conn_rec *c, request_rec *r,
-      */
-     if (result == NULL && c != NULL) {
-         SSLConnRec *sslconn = ssl_get_effective_config(c);
-+
-+        if (strlen(var) > 4 && strcEQn(var, "SSL_", 4)
-+            && (!sslconn || !sslconn->ssl) && othermod_var_lookup) {
-+            /* For an SSL_* variable, if mod_ssl is not enabled for
-+             * this connection and another SSL module is present, pass
-+             * through to that module. */
-+            return othermod_var_lookup(p, s, c, r, var);
-+        }
-+
-         if (strlen(var) > 4 && strcEQn(var, "SSL_", 4)
-             && sslconn && sslconn->ssl)
-             result = ssl_var_lookup_ssl(p, sslconn, r, var+4);

httpd-2.4.43-apxs.patch

@@ -1,3 +1,6 @@
+
+Upstream-Status: local customisation
+
 diff --git a/support/apxs.in b/support/apxs.in
 index b2705fa..c331631 100644
 --- a/support/apxs.in

httpd-2.4.43-corelimit.patch

@@ -1,3 +1,6 @@
+
+Upstream-Status: local customisation
+
 diff --git a/server/core.c b/server/core.c
 index 79b2a82..dc0f17a 100644
 --- a/server/core.c

httpd-2.4.43-deplibs.patch

@@ -1,3 +1,6 @@
+
+Upstream-Status: local customisation, not needed upstream
+
 diff --git a/configure.in b/configure.in
 index f8f9442..f276550 100644
 --- a/configure.in

httpd-2.4.43-gettid.patch

@@ -1,84 +0,0 @@
-From d4e5b6e1e5585d341d1e51f1ddc637c099111076 Mon Sep 17 00:00:00 2001
-From: Joe Orton <jorton@redhat.com>
-Date: Tue, 7 Jul 2020 09:48:01 +0100
-Subject: [PATCH] Check and use gettid() directly with glibc 2.30+.
-
-* configure.in: Check for gettid() and define HAVE_SYS_GETTID if
-  gettid() is only usable via syscall().
-
-* server/log.c (log_tid): Use gettid() directly if available.
----
- configure.in | 14 +++++++++-----
- server/log.c |  8 ++++++--
- 2 files changed, 15 insertions(+), 7 deletions(-)
-
-diff --git a/configure.in b/configure.in
-index 423d58d4b9a..60cbf7b7f81 100644
---- httpd-2.4.43/configure.in.gettid
-+++ httpd-2.4.43/configure.in
-@@ -500,7 +500,8 @@
- timegm \
- getpgid \
- fopen64 \
--getloadavg
-+getloadavg \
-+gettid
- )
- 
- dnl confirm that a void pointer is large enough to store a long integer
-@@ -511,16 +512,19 @@
-    APR_ADDTO(HTTPD_LIBS, [-lselinux])
- ])
- 
--AC_CACHE_CHECK([for gettid()], ac_cv_gettid,
-+if test $ac_cv_func_gettid = no; then
-+  # On Linux before glibc 2.30, gettid() is only usable via syscall()
-+  AC_CACHE_CHECK([for gettid() via syscall], ap_cv_gettid,
- [AC_TRY_RUN(#define _GNU_SOURCE
- #include <unistd.h>
- #include <sys/syscall.h>
- #include <sys/types.h>
- int main(int argc, char **argv) {
- pid_t t = syscall(SYS_gettid); return t == -1 ? 1 : 0; },
--[ac_cv_gettid=yes], [ac_cv_gettid=no], [ac_cv_gettid=no])])
--if test "$ac_cv_gettid" = "yes"; then
--    AC_DEFINE(HAVE_GETTID, 1, [Define if you have gettid()])
-+  [ap_cv_gettid=yes], [ap_cv_gettid=no], [ap_cv_gettid=no])])
-+  if test "$ap_cv_gettid" = "yes"; then
-+      AC_DEFINE(HAVE_SYS_GETTID, 1, [Define if you have gettid() via syscall()])
-+  fi
- fi
- 
- dnl ## Check for the tm_gmtoff field in struct tm to get the timezone diffs
---- httpd-2.4.43/server/log.c.gettid
-+++ httpd-2.4.43/server/log.c
-@@ -625,14 +625,18 @@
- #if APR_HAS_THREADS
-     int result;
- #endif
--#if HAVE_GETTID
-+#if defined(HAVE_GETTID) || defined(HAVE_SYS_GETTID)
-     if (arg && *arg == 'g') {
-+#ifdef HAVE_GETTID
-+        pid_t tid = gettid();
-+#else
-         pid_t tid = syscall(SYS_gettid);
-+#endif
-         if (tid == -1)
-             return 0;
-         return apr_snprintf(buf, buflen, "%"APR_PID_T_FMT, tid);
-     }
--#endif
-+#endif /* HAVE_GETTID || HAVE_SYS_GETTID */
- #if APR_HAS_THREADS
-     if (ap_mpm_query(AP_MPMQ_IS_THREADED, &result) == APR_SUCCESS
-         && result != AP_MPMQ_NOT_SUPPORTED)
-@@ -966,7 +970,7 @@
- #if APR_HAS_THREADS
-         field_start = len;
-         len += cpystrn(buf + len, ":tid ", buflen - len);
--        item_len = log_tid(info, NULL, buf + len, buflen - len);
-+        item_len = log_tid(info, "g", buf + len, buflen - len);
-         if (!item_len)
-             len = field_start;
-         else

httpd-2.4.43-icons.patch

@@ -1,22 +0,0 @@
-diff --git a/docs/conf/extra/httpd-autoindex.conf.in b/docs/conf/extra/httpd-autoindex.conf.in
-index 51b02ed..0e8b626 100644
---- a/docs/conf/extra/httpd-autoindex.conf.in
-+++ b/docs/conf/extra/httpd-autoindex.conf.in
-@@ -21,7 +21,7 @@ IndexOptions FancyIndexing HTMLTable VersionSort
- Alias /icons/ "@exp_iconsdir@/"
- 
- <Directory "@exp_iconsdir@">
--    Options Indexes MultiViews
-+    Options Indexes MultiViews FollowSymlinks
-     AllowOverride None
-     Require all granted
- </Directory>
-@@ -53,7 +53,7 @@ AddIcon /icons/dvi.gif .dvi
- AddIcon /icons/uuencoded.gif .uu
- AddIcon /icons/script.gif .conf .sh .shar .csh .ksh .tcl
- AddIcon /icons/tex.gif .tex
--AddIcon /icons/bomb.gif core
-+AddIcon /icons/bomb.gif core.
- 
- AddIcon /icons/back.gif ..
- AddIcon /icons/hand.right.gif README

httpd-2.4.43-logjournal.patch

@@ -0,0 +1,87 @@
+diff --git a/modules/loggers/config.m4 b/modules/loggers/config.m4
+index 762e773..0848d2e 100644
+--- a/modules/loggers/config.m4
++++ b/modules/loggers/config.m4
+@@ -5,6 +5,8 @@ dnl APACHE_MODULE(name, helptext[, objects[, structname[, default[, config]]]])
+ APACHE_MODPATH_INIT(loggers)
+ 	
+ APACHE_MODULE(log_config, logging configuration.  You won't be able to log requests to the server without this module., , , yes)
++APR_ADDTO(MOD_LOG_CONFIG_LDADD, [$SYSTEMD_LIBS])
++
+ APACHE_MODULE(log_debug, configurable debug logging, , , most)
+ APACHE_MODULE(log_forensic, forensic logging)
+ 
+diff --git a/modules/loggers/mod_log_config.c b/modules/loggers/mod_log_config.c
+index 996c09c..50a056a 100644
+--- a/modules/loggers/mod_log_config.c
++++ b/modules/loggers/mod_log_config.c
+@@ -172,6 +172,10 @@
+ #include <limits.h>
+ #endif
+ 
++#ifdef HAVE_SYSTEMD
++#include <systemd/sd-journal.h>
++#endif
++
+ #define DEFAULT_LOG_FORMAT "%h %l %u %t \"%r\" %>s %b"
+ 
+ module AP_MODULE_DECLARE_DATA log_config_module;
+@@ -1638,6 +1642,25 @@ static apr_status_t ap_default_log_writer( request_rec *r,
+ 
+     return rv;
+ }
++
++static apr_status_t wrap_journal_stream(apr_pool_t *p, apr_file_t **outfd,
++                                        int priority)
++{
++#ifdef HAVE_SYSTEMD
++    int fd;
++
++    fd = sd_journal_stream_fd("httpd", priority, 0);
++    if (fd < 0) return fd;
++
++    /* This is an AF_UNIX socket fd so is more pipe-like than
++     * file-like (the fd is neither seekable or readable), and use of
++     * apr_os_pipe_put_ex() allows cleanup registration. */
++    return apr_os_pipe_put_ex(outfd, &fd, 1, p);
++#else
++    return APR_ENOTIMPL;
++#endif
++}
++
+ static void *ap_default_log_writer_init(apr_pool_t *p, server_rec *s,
+                                         const char* name)
+ {
+@@ -1650,6 +1673,32 @@ static void *ap_default_log_writer_init(apr_pool_t *p, server_rec *s,
+         }
+         return ap_piped_log_write_fd(pl);
+     }
++    else if (strncasecmp(name, "journald:", 9) == 0) {
++        int priority;
++        const char *err = ap_parse_log_level(name + 9, &priority);
++        apr_status_t rv;
++        apr_file_t *fd;
++
++        if (err == NULL && priority > LOG_DEBUG) {
++            err = "TRACE level debugging not supported with journald";
++        }
++
++        if (err) {
++            ap_log_error(APLOG_MARK, APLOG_ERR, APR_EBADPATH, s, 
++                         "invalid journald log priority name %s: %s",
++                         name, err);
++            return NULL;
++        }
++
++        rv = wrap_journal_stream(p, &fd, priority);
++        if (rv) {
++            ap_log_error(APLOG_MARK, APLOG_ERR, rv, s, 
++                         "could not open journald log stream");
++            return NULL;
++        }
++
++        return fd;
++    }
+     else {
+         const char *fname = ap_server_root_relative(p, name);
+         apr_file_t *fd;

httpd-2.4.43-lua-resume.patch

@@ -1,95 +0,0 @@
-diff --git a/modules/lua/mod_lua.c b/modules/lua/mod_lua.c
-index 05f1e44..be3bedf 100644
---- a/modules/lua/mod_lua.c
-+++ b/modules/lua/mod_lua.c
-@@ -342,7 +342,7 @@ static apr_status_t lua_setup_filter_ctx(ap_filter_t* f, request_rec* r, lua_fil
- {
-     apr_pool_t *pool;
-     ap_lua_vm_spec *spec;
--    int n, rc;
-+    int n, rc, nres;
-     lua_State *L;
-     lua_filter_ctx *ctx;    
-     ap_lua_server_cfg *server_cfg = ap_get_module_config(r->server->module_config,
-@@ -410,7 +410,7 @@ static apr_status_t lua_setup_filter_ctx(ap_filter_t* f, request_rec* r, lua_fil
-             /* If a Lua filter is interested in filtering a request, it must first do a yield, 
-              * otherwise we'll assume that it's not interested and pretend we didn't find it.
-              */
--            rc = lua_resume(L, 1);
-+            rc = lua_resume(L, 1, &nres);
-             if (rc == LUA_YIELD) {
-                 if (f->frec->providers == NULL) { 
-                     /* Not wired by mod_filter */
-@@ -432,7 +432,7 @@ static apr_status_t lua_setup_filter_ctx(ap_filter_t* f, request_rec* r, lua_fil
- static apr_status_t lua_output_filter_handle(ap_filter_t *f, apr_bucket_brigade *pbbIn)
- {
-     request_rec *r = f->r;
--    int rc;
-+    int rc, nres;
-     lua_State *L;
-     lua_filter_ctx* ctx;
-     conn_rec *c = r->connection;
-@@ -492,7 +492,7 @@ static apr_status_t lua_output_filter_handle(ap_filter_t *f, apr_bucket_brigade
-             lua_setglobal(L, "bucket");
-             
-             /* If Lua yielded, it means we have something to pass on */
--            if (lua_resume(L, 0) == LUA_YIELD) {
-+            if (lua_resume(L, 0, &nres) == LUA_YIELD) {
-                 size_t olen;
-                 const char* output = lua_tolstring(L, 1, &olen);
-                 if (olen > 0) { 
-@@ -524,7 +524,7 @@ static apr_status_t lua_output_filter_handle(ap_filter_t *f, apr_bucket_brigade
-             apr_bucket *pbktEOS;
-             lua_pushnil(L);
-             lua_setglobal(L, "bucket");
--            if (lua_resume(L, 0) == LUA_YIELD) {
-+            if (lua_resume(L, 0, &nres) == LUA_YIELD) {
-                 apr_bucket *pbktOut;
-                 size_t olen;
-                 const char* output = lua_tolstring(L, 1, &olen);
-@@ -558,7 +558,7 @@ static apr_status_t lua_input_filter_handle(ap_filter_t *f,
-                                        apr_off_t nBytes) 
- {
-     request_rec *r = f->r;
--    int rc, lastCall = 0;
-+    int rc, lastCall = 0, nres;
-     lua_State *L;
-     lua_filter_ctx* ctx;
-     conn_rec *c = r->connection;
-@@ -621,7 +621,7 @@ static apr_status_t lua_input_filter_handle(ap_filter_t *f,
-             lua_setglobal(L, "bucket");
-             
-             /* If Lua yielded, it means we have something to pass on */
--            if (lua_resume(L, 0) == LUA_YIELD) {
-+            if (lua_resume(L, 0, &nres) == LUA_YIELD) {
-                 size_t olen;
-                 const char* output = lua_tolstring(L, 1, &olen);
-                 pbktOut = apr_bucket_heap_create(output, olen, 0, c->bucket_alloc);
-@@ -643,7 +643,7 @@ static apr_status_t lua_input_filter_handle(ap_filter_t *f,
-             apr_bucket *pbktEOS = apr_bucket_eos_create(c->bucket_alloc);
-             lua_pushnil(L);
-             lua_setglobal(L, "bucket");
--            if (lua_resume(L, 0) == LUA_YIELD) {
-+            if (lua_resume(L, 0, &nres) == LUA_YIELD) {
-                 apr_bucket *pbktOut;
-                 size_t olen;
-                 const char* output = lua_tolstring(L, 1, &olen);
-diff --git a/modules/lua/mod_lua.h b/modules/lua/mod_lua.h
-index 0e49cdc..8921b87 100644
---- a/modules/lua/mod_lua.h
-+++ b/modules/lua/mod_lua.h
-@@ -48,7 +48,13 @@
- #if LUA_VERSION_NUM > 501
- /* Load mode for lua_load() */
- #define lua_load(a,b,c,d)  lua_load(a,b,c,d,NULL)
--#define lua_resume(a,b)    lua_resume(a, NULL, b)
-+
-+#if LUA_VERSION_NUM > 503
-+#define lua_resume(a,b,c)    lua_resume(a, NULL, b, c)
-+#else
-+#define lua_resume(a,b,c)    lua_resume(a, NULL, b)
-+#endif
-+
- #define luaL_setfuncs_compat(a,b) luaL_setfuncs(a,b,0)
- #else
- #define lua_rawlen(L,i)    lua_objlen(L, (i))

httpd-2.4.43-r1861269.patch

@@ -1,20 +0,0 @@
-diff --git a/modules/ssl/ssl_engine_config.c b/modules/ssl/ssl_engine_config.c
-index b53f3f8..979489c 100644
---- a/modules/ssl/ssl_engine_config.c
-+++ b/modules/ssl/ssl_engine_config.c
-@@ -812,8 +812,14 @@ const char *ssl_cmd_SSLCipherSuite(cmd_parms *cmd,
- static const char *ssl_cmd_check_file(cmd_parms *parms,
-                                       const char **file)
- {
--    const char *filepath = ap_server_root_relative(parms->pool, *file);
-+    const char *filepath;
- 
-+    /* If only dumping the config, don't verify the paths */
-+    if (ap_state_query(AP_SQ_RUN_MODE) == AP_SQ_RM_CONFIG_DUMP) {
-+        return NULL;
-+    }
-+
-+    filepath = ap_server_root_relative(parms->pool, *file);
-     if (!filepath) {
-         return apr_pstrcat(parms->pool, parms->cmd->name,
-                            ": Invalid file path ", *file, NULL);

httpd-2.4.43-r1861793+.patch

@@ -1,271 +0,0 @@
-diff --git a/configure.in b/configure.in
-index cb43246..0bb6b0d 100644
---- httpd-2.4.43/configure.in.r1861793+
-+++ httpd-2.4.43/configure.in
-@@ -465,6 +465,28 @@
- AC_SEARCH_LIBS(crypt, crypt)
- CRYPT_LIBS="$LIBS"
- APACHE_SUBST(CRYPT_LIBS)
-+
-+if test "$ac_cv_search_crypt" != "no"; then
-+   # Test crypt() with the SHA-512 test vector from https://akkadia.org/drepper/SHA-crypt.txt
-+   AC_CACHE_CHECK([whether crypt() supports SHA-2], [ap_cv_crypt_sha2], [
-+    AC_RUN_IFELSE([AC_LANG_PROGRAM([[
-+#include <crypt.h>
-+#include <stdlib.h>
-+#include <string.h>
-+
-+#define PASSWD_0 "Hello world!"
-+#define SALT_0 "\$6\$saltstring"
-+#define EXPECT_0 "\$6\$saltstring\$svn8UoSVapNtMuq1ukKS4tPQd8iKwSMHWjl/O817G3uBnIFNjnQJu" \
-+               "esI68u4OTLiBFdcbYEdFCoEOfaS35inz1"
-+]], [char *result = crypt(PASSWD_0, SALT_0);
-+     if (!result) return 1;
-+     if (strcmp(result, EXPECT_0)) return 2;
-+])], [ap_cv_crypt_sha2=yes], [ap_cv_crypt_sha2=no])])
-+   if test "$ap_cv_crypt_sha2" = yes; then
-+     AC_DEFINE([HAVE_CRYPT_SHA2], 1, [Define if crypt() supports SHA-2 hashes])
-+   fi
-+fi
-+
- LIBS="$saved_LIBS"
- 
- dnl See Comment #Spoon
---- httpd-2.4.43/docs/man/htpasswd.1.r1861793+
-+++ httpd-2.4.43/docs/man/htpasswd.1
-@@ -27,16 +27,16 @@
- .SH "SYNOPSIS"
-  
- .PP
--\fB\fBhtpasswd\fR [ -\fBc\fR ] [ -\fBi\fR ] [ -\fBm\fR | -\fBB\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBC\fR \fIcost\fR ] [ -\fBD\fR ] [ -\fBv\fR ] \fIpasswdfile\fR \fIusername\fR\fR
-+\fB\fBhtpasswd\fR [ -\fBc\fR ] [ -\fBi\fR ] [ -\fBm\fR | -\fBB\fR | -\fB2\fR | -\fB5\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBr\fR \fIrounds\fR ] [ -\fBC\fR \fIcost\fR ] [ -\fBD\fR ] [ -\fBv\fR ] \fIpasswdfile\fR \fIusername\fR\fR
-  
- .PP
--\fB\fBhtpasswd\fR -\fBb\fR [ -\fBc\fR ] [ -\fBm\fR | -\fBB\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBC\fR \fIcost\fR ] [ -\fBD\fR ] [ -\fBv\fR ] \fIpasswdfile\fR \fIusername\fR \fIpassword\fR\fR
-+\fB\fBhtpasswd\fR -\fBb\fR [ -\fBc\fR ] [ -\fBm\fR | -\fBB\fR | -\fB2\fR | -\fB5\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBr\fR \fIrounds\fR ] [ -\fBC\fR \fIcost\fR ] [ -\fBD\fR ] [ -\fBv\fR ] \fIpasswdfile\fR \fIusername\fR \fIpassword\fR\fR
-  
- .PP
--\fB\fBhtpasswd\fR -\fBn\fR [ -\fBi\fR ] [ -\fBm\fR | -\fBB\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBC\fR \fIcost\fR ] \fIusername\fR\fR
-+\fB\fBhtpasswd\fR -\fBn\fR [ -\fBi\fR ] [ -\fBm\fR | -\fBB\fR | -\fB2\fR | -\fB5\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBr\fR \fIrounds\fR ] [ -\fBC\fR \fIcost\fR ] \fIusername\fR\fR
-  
- .PP
--\fB\fBhtpasswd\fR -\fBnb\fR [ -\fBm\fR | -\fBB\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBC\fR \fIcost\fR ] \fIusername\fR \fIpassword\fR\fR
-+\fB\fBhtpasswd\fR -\fBnb\fR [ -\fBm\fR | -\fBB\fR | -\fB2\fR | -\fB5\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBr\fR \fIrounds\fR ] [ -\fBC\fR \fIcost\fR ] \fIusername\fR \fIpassword\fR\fR
-  
- 
- .SH "SUMMARY"
-@@ -48,7 +48,7 @@
- Resources available from the Apache HTTP server can be restricted to just the users listed in the files created by \fBhtpasswd\fR\&. This program can only manage usernames and passwords stored in a flat-file\&. It can encrypt and display password information for use in other types of data stores, though\&. To use a DBM database see dbmmanage or htdbm\&.
-  
- .PP
--\fBhtpasswd\fR encrypts passwords using either bcrypt, a version of MD5 modified for Apache, SHA1, or the system's \fBcrypt()\fR routine\&. Files managed by \fBhtpasswd\fR may contain a mixture of different encoding types of passwords; some user records may have bcrypt or MD5-encrypted passwords while others in the same file may have passwords encrypted with \fBcrypt()\fR\&.
-+\fBhtpasswd\fR encrypts passwords using either bcrypt, a version of MD5 modified for Apache, SHA-1, or the system's \fBcrypt()\fR routine\&. SHA-2-based hashes (SHA-256 and SHA-512) are supported for \fBcrypt()\fR\&. Files managed by \fBhtpasswd\fR may contain a mixture of different encoding types of passwords; some user records may have bcrypt or MD5-encrypted passwords while others in the same file may have passwords encrypted with \fBcrypt()\fR\&.
-  
- .PP
- This manual page only lists the command line arguments\&. For details of the directives necessary to configure user authentication in httpd see the Apache manual, which is part of the Apache distribution or can be found at http://httpd\&.apache\&.org/\&.
-@@ -73,17 +73,26 @@
- \fB-m\fR
- Use MD5 encryption for passwords\&. This is the default (since version 2\&.2\&.18)\&.  
- .TP
-+\fB-2\fR
-+Use SHA-256 \fBcrypt()\fR based hashes for passwords\&. This is supported on most Unix platforms\&.  
-+.TP
-+\fB-5\fR
-+Use SHA-512 \fBcrypt()\fR based hashes for passwords\&. This is supported on most Unix platforms\&.  
-+.TP
- \fB-B\fR
- Use bcrypt encryption for passwords\&. This is currently considered to be very secure\&.  
- .TP
- \fB-C\fR
- This flag is only allowed in combination with \fB-B\fR (bcrypt encryption)\&. It sets the computing time used for the bcrypt algorithm (higher is more secure but slower, default: 5, valid: 4 to 17)\&.  
- .TP
-+\fB-r\fR
-+This flag is only allowed in combination with \fB-2\fR or \fB-5\fR\&. It sets the number of hash rounds used for the SHA-2 algorithms (higher is more secure but slower; the default is 5,000)\&.  
-+.TP
- \fB-d\fR
- Use \fBcrypt()\fR encryption for passwords\&. This is not supported by the httpd server on Windows and Netware\&. This algorithm limits the password length to 8 characters\&. This algorithm is \fBinsecure\fR by today's standards\&. It used to be the default algorithm until version 2\&.2\&.17\&.  
- .TP
- \fB-s\fR
--Use SHA encryption for passwords\&. Facilitates migration from/to Netscape servers using the LDAP Directory Interchange Format (ldif)\&. This algorithm is \fBinsecure\fR by today's standards\&.  
-+Use SHA-1 (160-bit) encryption for passwords\&. Facilitates migration from/to Netscape servers using the LDAP Directory Interchange Format (ldif)\&. This algorithm is \fBinsecure\fR by today's standards\&.  
- .TP
- \fB-p\fR
- Use plaintext passwords\&. Though \fBhtpasswd\fR will support creation on all platforms, the httpd daemon will only accept plain text passwords on Windows and Netware\&.  
-@@ -152,10 +161,13 @@
- When using the \fBcrypt()\fR algorithm, note that only the first 8 characters of the password are used to form the password\&. If the supplied password is longer, the extra characters will be silently discarded\&.
-  
- .PP
--The SHA encryption format does not use salting: for a given password, there is only one encrypted representation\&. The \fBcrypt()\fR and MD5 formats permute the representation by prepending a random salt string, to make dictionary attacks against the passwords more difficult\&.
-+The SHA-1 encryption format does not use salting: for a given password, there is only one encrypted representation\&. The \fBcrypt()\fR and MD5 formats permute the representation by prepending a random salt string, to make dictionary attacks against the passwords more difficult\&.
-+ 
-+.PP
-+The SHA-1 and \fBcrypt()\fR formats are insecure by today's standards\&.
-  
- .PP
--The SHA and \fBcrypt()\fR formats are insecure by today's standards\&.
-+The SHA-2-based \fBcrypt()\fR formats (SHA-256 and SHA-512) are supported on most modern Unix systems, and follow the specification at https://www\&.akkadia\&.org/drepper/SHA-crypt\&.txt\&.
-  
- .SH "RESTRICTIONS"
-  
---- httpd-2.4.43/support/htpasswd.c.r1861793+
-+++ httpd-2.4.43/support/htpasswd.c
-@@ -109,17 +109,21 @@
-             "for it." NL
-         " -i  Read password from stdin without verification (for script usage)." NL
-         " -m  Force MD5 encryption of the password (default)." NL
--        " -B  Force bcrypt encryption of the password (very secure)." NL
-+        " -2  Force SHA-256 crypt() hash of the password (very secure)." NL
-+        " -5  Force SHA-512 crypt() hash of the password (very secure)." NL
-+        " -B  Force bcrypt encryption of the password (very secure)." NL
-         " -C  Set the computing time used for the bcrypt algorithm" NL
-         "     (higher is more secure but slower, default: %d, valid: 4 to 17)." NL
-+        " -r  Set the number of rounds used for the SHA-256, SHA-512 algorithms" NL
-+        "     (higher is more secure but slower, default: 5000)." NL
-         " -d  Force CRYPT encryption of the password (8 chars max, insecure)." NL
--        " -s  Force SHA encryption of the password (insecure)." NL
-+        " -s  Force SHA-1 encryption of the password (insecure)." NL
-         " -p  Do not encrypt the password (plaintext, insecure)." NL
-         " -D  Delete the specified user." NL
-         " -v  Verify password for the specified user." NL
-         "On other systems than Windows and NetWare the '-p' flag will "
-             "probably not work." NL
--        "The SHA algorithm does not use a salt and is less secure than the "
-+        "The SHA-1 algorithm does not use a salt and is less secure than the "
-             "MD5 algorithm." NL,
-         BCRYPT_DEFAULT_COST
-     );
-@@ -178,7 +182,7 @@
-     if (rv != APR_SUCCESS)
-         exit(ERR_SYNTAX);
- 
--    while ((rv = apr_getopt(state, "cnmspdBbDiC:v", &opt, &opt_arg)) == APR_SUCCESS) {
-+    while ((rv = apr_getopt(state, "cnmspdBbDi25C:r:v", &opt, &opt_arg)) == APR_SUCCESS) {
-         switch (opt) {
-         case 'c':
-             *mask |= APHTP_NEWFILE;
---- httpd-2.4.43/support/passwd_common.c.r1861793+
-+++ httpd-2.4.43/support/passwd_common.c
-@@ -179,16 +179,21 @@
- int mkhash(struct passwd_ctx *ctx)
- {
-     char *pw;
--    char salt[16];
-+    char salt[17];
-     apr_status_t rv;
-     int ret = 0;
- #if CRYPT_ALGO_SUPPORTED
-     char *cbuf;
- #endif
-+#ifdef HAVE_CRYPT_SHA2
-+    const char *setting;
-+    char method;
-+#endif
- 
--    if (ctx->cost != 0 && ctx->alg != ALG_BCRYPT) {
-+    if (ctx->cost != 0 && ctx->alg != ALG_BCRYPT
-+        && ctx->alg != ALG_CRYPT_SHA256 && ctx->alg != ALG_CRYPT_SHA512 ) {
-         apr_file_printf(errfile,
--                        "Warning: Ignoring -C argument for this algorithm." NL);
-+                        "Warning: Ignoring -C/-r argument for this algorithm." NL);
-     }
- 
-     if (ctx->passwd == NULL) {
-@@ -246,6 +251,34 @@
-         break;
- #endif /* CRYPT_ALGO_SUPPORTED */
- 
-+#ifdef HAVE_CRYPT_SHA2
-+    case ALG_CRYPT_SHA256:
-+    case ALG_CRYPT_SHA512:
-+        ret = generate_salt(salt, 16, &ctx->errstr, ctx->pool);
-+        if (ret != 0)
-+            break;
-+
-+        method = ctx->alg == ALG_CRYPT_SHA256 ? '5': '6';
-+
-+        if (ctx->cost) 
-+            setting = apr_psprintf(ctx->pool, "$%c$rounds=%d$%s",
-+                                   method, ctx->cost, salt);
-+        else
-+            setting = apr_psprintf(ctx->pool, "$%c$%s",
-+                                   method, salt);
-+
-+        cbuf = crypt(pw, setting);
-+        if (cbuf == NULL) {
-+            rv = APR_FROM_OS_ERROR(errno);
-+            ctx->errstr = apr_psprintf(ctx->pool, "crypt() failed: %pm", &rv);
-+            ret = ERR_PWMISMATCH;
-+            break;
-+        }
-+
-+        apr_cpystrn(ctx->out, cbuf, ctx->out_len - 1);
-+        break;
-+#endif /* HAVE_CRYPT_SHA2 */
-+
- #if BCRYPT_ALGO_SUPPORTED
-     case ALG_BCRYPT:
-         rv = apr_generate_random_bytes((unsigned char*)salt, 16);
-@@ -294,6 +327,19 @@
-     case 's':
-         ctx->alg = ALG_APSHA;
-         break;
-+#ifdef HAVE_CRYPT_SHA2
-+    case '2':
-+        ctx->alg = ALG_CRYPT_SHA256;
-+        break;
-+    case '5':
-+        ctx->alg = ALG_CRYPT_SHA512;
-+        break;
-+#else
-+    case '2':
-+    case '5':
-+        ctx->errstr = "SHA-2 crypt() algorithms are not supported on this platform.";
-+        return ERR_ALG_NOT_SUPP;
-+#endif
-     case 'p':
-         ctx->alg = ALG_PLAIN;
- #if !PLAIN_ALGO_SUPPORTED
-@@ -324,11 +370,12 @@
-         return ERR_ALG_NOT_SUPP;
- #endif
-         break;
--    case 'C': {
-+    case 'C':
-+    case 'r': {
-             char *endptr;
-             long num = strtol(opt_arg, &endptr, 10);
-             if (*endptr != '\0' || num <= 0) {
--                ctx->errstr = "argument to -C must be a positive integer";
-+                ctx->errstr = "argument to -C/-r must be a positive integer";
-                 return ERR_SYNTAX;
-             }
-             ctx->cost = num;
---- httpd-2.4.43/support/passwd_common.h.r1861793+
-+++ httpd-2.4.43/support/passwd_common.h
-@@ -28,6 +28,8 @@
- #include "apu_version.h"
- #endif
- 
-+#include "ap_config_auto.h"
-+
- #define MAX_STRING_LEN 256
- 
- #define ALG_PLAIN 0
-@@ -35,6 +37,8 @@
- #define ALG_APMD5 2
- #define ALG_APSHA 3
- #define ALG_BCRYPT 4
-+#define ALG_CRYPT_SHA256 5
-+#define ALG_CRYPT_SHA512 6
- 
- #define BCRYPT_DEFAULT_COST 5
- 
-@@ -84,7 +88,7 @@
-     apr_size_t      out_len;
-     char            *passwd;
-     int             alg;
--    int             cost;
-+    int             cost; /* cost for bcrypt, rounds for SHA-2 */
-     enum {
-         PW_PROMPT = 0,
-         PW_ARG,

httpd-2.4.43-r1870095+.patch

@@ -1,115 +0,0 @@
-diff --git a/modules/ssl/ssl_engine_kernel.c b/modules/ssl/ssl_engine_kernel.c
-index cbab6a3..765aa4b 100644
---- a/modules/ssl/ssl_engine_kernel.c
-+++ b/modules/ssl/ssl_engine_kernel.c
-@@ -114,6 +114,45 @@ static int has_buffered_data(request_rec *r)
-     return result;
- }
- 
-+/* If a renegotiation is required for the location, and the request
-+ * includes a message body (and the client has not requested a "100
-+ * Continue" response), then the client will be streaming the request
-+ * body over the wire already.  In that case, it is not possible to
-+ * stop and perform a new SSL handshake immediately; once the SSL
-+ * library moves to the "accept" state, it will reject the SSL packets
-+ * which the client is sending for the request body.
-+ *
-+ * To allow authentication to complete in the hook, the solution used
-+ * here is to fill a (bounded) buffer with the request body, and then
-+ * to reinject that request body later.
-+ *
-+ * This function is called to fill the renegotiation buffer for the
-+ * location as required, or fail.  Returns zero on success or HTTP_
-+ * error code on failure.
-+ */
-+static int fill_reneg_buffer(request_rec *r, SSLDirConfigRec *dc)
-+{
-+    int rv;
-+    apr_size_t rsize;
-+
-+    /* ### this is HTTP/1.1 specific, special case for protocol? */
-+    if (r->expecting_100 || !ap_request_has_body(r)) {
-+        return 0;
-+    }
-+
-+    rsize = dc->nRenegBufferSize == UNSET ? DEFAULT_RENEG_BUFFER_SIZE : dc->nRenegBufferSize;
-+    if (rsize > 0) {
-+        /* Fill the I/O buffer with the request body if possible. */
-+        rv = ssl_io_buffer_fill(r, rsize);
-+    }
-+    else {
-+        /* If the reneg buffer size is set to zero, just fail. */
-+        rv = HTTP_REQUEST_ENTITY_TOO_LARGE;
-+    }
-+
-+    return rv;
-+}
-+
- #ifdef HAVE_TLSEXT
- static int ap_array_same_str_set(apr_array_header_t *s1, apr_array_header_t *s2)
- {
-@@ -814,41 +853,14 @@ static int ssl_hook_Access_classic(request_rec *r, SSLSrvConfigRec *sc, SSLDirCo
-         }
-     }
- 
--    /* If a renegotiation is now required for this location, and the
--     * request includes a message body (and the client has not
--     * requested a "100 Continue" response), then the client will be
--     * streaming the request body over the wire already.  In that
--     * case, it is not possible to stop and perform a new SSL
--     * handshake immediately; once the SSL library moves to the
--     * "accept" state, it will reject the SSL packets which the client
--     * is sending for the request body.
--     *
--     * To allow authentication to complete in this auth hook, the
--     * solution used here is to fill a (bounded) buffer with the
--     * request body, and then to reinject that request body later.
--     */
--    if (renegotiate && !renegotiate_quick
--        && !r->expecting_100
--        && ap_request_has_body(r)) {
--        int rv;
--        apr_size_t rsize;
--
--        rsize = dc->nRenegBufferSize == UNSET ? DEFAULT_RENEG_BUFFER_SIZE :
--                                                dc->nRenegBufferSize;
--        if (rsize > 0) {
--            /* Fill the I/O buffer with the request body if possible. */
--            rv = ssl_io_buffer_fill(r, rsize);
--        }
--        else {
--            /* If the reneg buffer size is set to zero, just fail. */
--            rv = HTTP_REQUEST_ENTITY_TOO_LARGE;
--        }
--
--        if (rv) {
-+    /* Fill reneg buffer if required. */
-+    if (renegotiate && !renegotiate_quick) {
-+        rc = fill_reneg_buffer(r, dc);
-+        if (rc) {
-             ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02257)
-                           "could not buffer message body to allow "
-                           "SSL renegotiation to proceed");
--            return rv;
-+            return rc;
-         }
-     }
- 
-@@ -1132,6 +1144,17 @@ static int ssl_hook_Access_modern(request_rec *r, SSLSrvConfigRec *sc, SSLDirCon
-             }
-         }
- 
-+        /* Fill reneg buffer if required. */
-+        if (change_vmode) {
-+            rc = fill_reneg_buffer(r, dc);
-+            if (rc) {
-+                ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10228)
-+                              "could not buffer message body to allow "
-+                              "TLS Post-Handshake Authentication to proceed");
-+                return rc;
-+            }
-+        }
-+
-         if (change_vmode) {
-             char peekbuf[1];
- 

httpd-2.4.43-r1876548.patch

@@ -1,82 +0,0 @@
-# ./pullrev.sh 1876548
-http://svn.apache.org/viewvc?view=revision&revision=1876548
-
---- httpd-2.4.43/modules/ssl/ssl_util_stapling.c
-+++ httpd-2.4.43/modules/ssl/ssl_util_stapling.c
-@@ -130,6 +130,7 @@
-     X509 *issuer = NULL;
-     OCSP_CERTID *cid = NULL;
-     STACK_OF(OPENSSL_STRING) *aia = NULL;
-+    int rv = 1; /* until further notice */
- 
-     if (x == NULL)
-         return 0;
-@@ -154,16 +155,18 @@
-             SSL_CTX_set_tlsext_status_cb(mctx->ssl_ctx, stapling_cb);
-             ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(10177) "OCSP stapling added via hook");
-         }
--        return 1;
-+        goto cleanup;
-     }
-     
-     if (mctx->stapling_enabled != TRUE) {
-         /* mod_ssl's own implementation is not enabled */
--        return 1;
-+        goto cleanup;
-     }
-     
--    if (X509_digest(x, EVP_sha1(), idx, NULL) != 1)
--        return 0;
-+    if (X509_digest(x, EVP_sha1(), idx, NULL) != 1) {
-+        rv = 0;
-+        goto cleanup;
-+    }
- 
-     cinf = apr_hash_get(stapling_certinfo, idx, sizeof(idx));
-     if (cinf) {
-@@ -177,18 +180,18 @@
-                            APLOGNO(02814) "ssl_stapling_init_cert: no OCSP URI "
-                            "in certificate and no SSLStaplingForceURL "
-                            "configured for server %s", mctx->sc->vhost_id);
--            return 0;
-+            rv = 0;
-         }
--        return 1;
-+        goto cleanup;
-     }
- 
-     cid = OCSP_cert_to_id(NULL, x, issuer);
--    X509_free(issuer);
-     if (!cid) {
-         ssl_log_xerror(SSLLOG_MARK, APLOG_ERR, 0, ptemp, s, x, APLOGNO(02815)
-                        "ssl_stapling_init_cert: can't create CertID "
-                        "for OCSP request");
--        return 0;
-+        rv = 0;
-+        goto cleanup;
-     }
- 
-     aia = X509_get1_ocsp(x);
-@@ -197,7 +200,8 @@
-         ssl_log_xerror(SSLLOG_MARK, APLOG_ERR, 0, ptemp, s, x,
-                        APLOGNO(02218) "ssl_stapling_init_cert: no OCSP URI "
-                        "in certificate and no SSLStaplingForceURL set");
--        return 0;
-+        rv = 0;
-+        goto cleanup;
-     }
- 
-     /* At this point, we have determined that there's something to store */
-@@ -218,8 +222,10 @@
-                    mctx->sc->vhost_id);
- 
-     apr_hash_set(stapling_certinfo, cinf->idx, sizeof(cinf->idx), cinf);
--    
--    return 1;
-+
-+cleanup:
-+    X509_free(issuer);
-+    return rv;
- }
- 
- static certinfo *stapling_get_certinfo(server_rec *s, X509 *x, modssl_ctx_t *mctx,

httpd-2.4.43-selinux.patch

@@ -1,60 +0,0 @@
-diff --git a/configure.in b/configure.in
-index c8f9aa2..cb43246 100644
---- a/configure.in
-+++ b/configure.in
-@@ -484,6 +484,11 @@ getloadavg
- dnl confirm that a void pointer is large enough to store a long integer
- APACHE_CHECK_VOID_PTR_LEN
- 
-+AC_CHECK_LIB(selinux, is_selinux_enabled, [
-+   AC_DEFINE(HAVE_SELINUX, 1, [Defined if SELinux is supported])
-+   APR_ADDTO(HTTPD_LIBS, [-lselinux])
-+])
-+
- AC_CACHE_CHECK([for gettid()], ac_cv_gettid,
- [AC_TRY_RUN(#define _GNU_SOURCE
- #include <unistd.h>
-diff --git a/server/core.c b/server/core.c
-index dc0f17a..7ed9527 100644
---- a/server/core.c
-+++ b/server/core.c
-@@ -59,6 +59,10 @@
- #include <unistd.h>
- #endif
- 
-+#ifdef HAVE_SELINUX
-+#include <selinux/selinux.h>
-+#endif
-+
- /* LimitRequestBody handling */
- #define AP_LIMIT_REQ_BODY_UNSET         ((apr_off_t) -1)
- #define AP_DEFAULT_LIMIT_REQ_BODY       ((apr_off_t) 0)
-@@ -5015,6 +5019,28 @@ static int core_post_config(apr_pool_t *pconf, apr_pool_t *plog, apr_pool_t *pte
-     }
- #endif
- 
-+#ifdef HAVE_SELINUX
-+    {
-+        static int already_warned = 0;
-+        int is_enabled = is_selinux_enabled() > 0;
-+        
-+        if (is_enabled && !already_warned) {
-+            security_context_t con;
-+            
-+            if (getcon(&con) == 0) {
-+                
-+                ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, NULL,
-+                             "SELinux policy enabled; "
-+                             "httpd running as context %s", con);
-+                
-+                already_warned = 1;
-+                
-+                freecon(con);
-+            }
-+        }
-+    }
-+#endif
-+
-     return OK;
- }
- 

httpd-2.4.43-socket-activation.patch

@@ -1,300 +0,0 @@
-diff --git a/server/listen.c b/server/listen.c
-index 5242c2a..e2e028a 100644
---- a/server/listen.c
-+++ b/server/listen.c
-@@ -34,6 +34,10 @@
- #include <unistd.h>
- #endif
- 
-+#ifdef HAVE_SYSTEMD
-+#include <systemd/sd-daemon.h>
-+#endif
-+
- /* we know core's module_index is 0 */
- #undef APLOG_MODULE_INDEX
- #define APLOG_MODULE_INDEX AP_CORE_MODULE_INDEX
-@@ -59,9 +63,12 @@ static int ap_listenbacklog;
- static int ap_listencbratio;
- static int send_buffer_size;
- static int receive_buffer_size;
-+#ifdef HAVE_SYSTEMD
-+static int use_systemd = -1;
-+#endif
- 
- /* TODO: make_sock is just begging and screaming for APR abstraction */
--static apr_status_t make_sock(apr_pool_t *p, ap_listen_rec *server)
-+static apr_status_t make_sock(apr_pool_t *p, ap_listen_rec *server, int do_bind_listen)
- {
-     apr_socket_t *s = server->sd;
-     int one = 1;
-@@ -94,20 +101,6 @@ static apr_status_t make_sock(apr_pool_t *p, ap_listen_rec *server)
-         return stat;
-     }
- 
--#if APR_HAVE_IPV6
--    if (server->bind_addr->family == APR_INET6) {
--        stat = apr_socket_opt_set(s, APR_IPV6_V6ONLY, v6only_setting);
--        if (stat != APR_SUCCESS && stat != APR_ENOTIMPL) {
--            ap_log_perror(APLOG_MARK, APLOG_CRIT, stat, p, APLOGNO(00069)
--                          "make_sock: for address %pI, apr_socket_opt_set: "
--                          "(IPV6_V6ONLY)",
--                          server->bind_addr);
--            apr_socket_close(s);
--            return stat;
--        }
--    }
--#endif
--
-     /*
-      * To send data over high bandwidth-delay connections at full
-      * speed we must force the TCP window to open wide enough to keep the
-@@ -169,21 +162,37 @@ static apr_status_t make_sock(apr_pool_t *p, ap_listen_rec *server)
-     }
- #endif
- 
--    if ((stat = apr_socket_bind(s, server->bind_addr)) != APR_SUCCESS) {
--        ap_log_perror(APLOG_MARK, APLOG_STARTUP|APLOG_CRIT, stat, p, APLOGNO(00072)
--                      "make_sock: could not bind to address %pI",
--                      server->bind_addr);
--        apr_socket_close(s);
--        return stat;
--    }
-+    if (do_bind_listen) {
-+#if APR_HAVE_IPV6
-+        if (server->bind_addr->family == APR_INET6) {
-+            stat = apr_socket_opt_set(s, APR_IPV6_V6ONLY, v6only_setting);
-+            if (stat != APR_SUCCESS && stat != APR_ENOTIMPL) {
-+                ap_log_perror(APLOG_MARK, APLOG_CRIT, stat, p, APLOGNO(00069)
-+                              "make_sock: for address %pI, apr_socket_opt_set: "
-+                              "(IPV6_V6ONLY)",
-+                              server->bind_addr);
-+                apr_socket_close(s);
-+                return stat;
-+            }
-+        }
-+#endif
- 
--    if ((stat = apr_socket_listen(s, ap_listenbacklog)) != APR_SUCCESS) {
--        ap_log_perror(APLOG_MARK, APLOG_STARTUP|APLOG_ERR, stat, p, APLOGNO(00073)
--                      "make_sock: unable to listen for connections "
--                      "on address %pI",
--                      server->bind_addr);
--        apr_socket_close(s);
--        return stat;
-+        if ((stat = apr_socket_bind(s, server->bind_addr)) != APR_SUCCESS) {
-+            ap_log_perror(APLOG_MARK, APLOG_STARTUP|APLOG_CRIT, stat, p, APLOGNO(00072)
-+                          "make_sock: could not bind to address %pI",
-+                          server->bind_addr);
-+            apr_socket_close(s);
-+            return stat;
-+        }
-+
-+        if ((stat = apr_socket_listen(s, ap_listenbacklog)) != APR_SUCCESS) {
-+            ap_log_perror(APLOG_MARK, APLOG_STARTUP|APLOG_ERR, stat, p, APLOGNO(00073)
-+                          "make_sock: unable to listen for connections "
-+                          "on address %pI",
-+                          server->bind_addr);
-+            apr_socket_close(s);
-+            return stat;
-+        }
-     }
- 
- #ifdef WIN32
-@@ -315,6 +324,123 @@ static int find_listeners(ap_listen_rec **from, ap_listen_rec **to,
-     return found;
- }
- 
-+#ifdef HAVE_SYSTEMD
-+
-+static int find_systemd_socket(process_rec * process, apr_port_t port) {
-+    int fdcount, fd;
-+    int sdc = sd_listen_fds(0);
-+
-+    if (sdc < 0) {
-+        ap_log_perror(APLOG_MARK, APLOG_CRIT, sdc, process->pool, APLOGNO(02486)
-+                      "find_systemd_socket: Error parsing enviroment, sd_listen_fds returned %d",
-+                      sdc);
-+        return -1;
-+    }
-+
-+    if (sdc == 0) {
-+        ap_log_perror(APLOG_MARK, APLOG_CRIT, sdc, process->pool, APLOGNO(02487)
-+                      "find_systemd_socket: At least one socket must be set.");
-+        return -1;
-+    }
-+
-+    fdcount = atoi(getenv("LISTEN_FDS"));
-+    for (fd = SD_LISTEN_FDS_START; fd < SD_LISTEN_FDS_START + fdcount; fd++) {
-+        if (sd_is_socket_inet(fd, 0, 0, -1, port) > 0) {
-+            return fd;
-+        }
-+    }
-+
-+    return -1;
-+}
-+
-+static apr_status_t alloc_systemd_listener(process_rec * process,
-+                                           int fd, const char *proto,
-+                                           ap_listen_rec **out_rec)
-+{
-+    apr_status_t rv;
-+    struct sockaddr sa;
-+    socklen_t len = sizeof(struct sockaddr);
-+    apr_os_sock_info_t si;
-+    ap_listen_rec *rec;
-+    *out_rec = NULL;
-+
-+    memset(&si, 0, sizeof(si));
-+
-+    rv = getsockname(fd, &sa, &len);
-+
-+    if (rv != 0) {
-+        rv = apr_get_netos_error();
-+        ap_log_perror(APLOG_MARK, APLOG_CRIT, rv, process->pool, APLOGNO(02489)
-+                      "getsockname on %d failed.", fd);
-+        return rv;
-+    }
-+
-+    si.os_sock = &fd;
-+    si.family = sa.sa_family;
-+    si.local = &sa;
-+    si.type = SOCK_STREAM;
-+    si.protocol = APR_PROTO_TCP;
-+
-+    rec = apr_palloc(process->pool, sizeof(ap_listen_rec));
-+    rec->active = 0;
-+    rec->next = 0;
-+
-+
-+    rv = apr_os_sock_make(&rec->sd, &si, process->pool);
-+    if (rv != APR_SUCCESS) {
-+        ap_log_perror(APLOG_MARK, APLOG_CRIT, rv, process->pool, APLOGNO(02490)
-+                      "apr_os_sock_make on %d failed.", fd);
-+        return rv;
-+    }
-+
-+    rv = apr_socket_addr_get(&rec->bind_addr, APR_LOCAL, rec->sd);
-+    if (rv != APR_SUCCESS) {
-+        ap_log_perror(APLOG_MARK, APLOG_CRIT, rv, process->pool, APLOGNO(02491)
-+                      "apr_socket_addr_get on %d failed.", fd);
-+        return rv;
-+    }
-+
-+    rec->protocol = apr_pstrdup(process->pool, proto);
-+
-+    *out_rec = rec;
-+
-+    return make_sock(process->pool, rec, 0);
-+}
-+
-+static const char *set_systemd_listener(process_rec *process, apr_port_t port,
-+                                        const char *proto)
-+{
-+    ap_listen_rec *last, *new;
-+    apr_status_t rv;
-+    int fd = find_systemd_socket(process, port);
-+    if (fd < 0) {
-+        return "Systemd socket activation is used, but this port is not "
-+                "configured in systemd";
-+    }
-+
-+    last = ap_listeners;
-+    while (last && last->next) {
-+        last = last->next;
-+    }
-+
-+    rv = alloc_systemd_listener(process, fd, proto, &new);
-+    if (rv != APR_SUCCESS) {
-+        return "Failed to setup socket passed by systemd using socket activation";
-+    }
-+
-+    if (last == NULL) {
-+        ap_listeners = last = new;
-+    }
-+    else {
-+        last->next = new;
-+        last = new;
-+    }
-+
-+    return NULL;
-+}
-+
-+#endif /* HAVE_SYSTEMD */
-+
- static const char *alloc_listener(process_rec *process, const char *addr,
-                                   apr_port_t port, const char* proto,
-                                   void *slave)
-@@ -495,7 +621,7 @@ static int open_listeners(apr_pool_t *pool)
-                 }
-             }
- #endif
--            if (make_sock(pool, lr) == APR_SUCCESS) {
-+            if (make_sock(pool, lr, 1) == APR_SUCCESS) {
-                 ++num_open;
-             }
-             else {
-@@ -607,8 +733,28 @@ AP_DECLARE(int) ap_setup_listeners(server_rec *s)
-         }
-     }
- 
--    if (open_listeners(s->process->pool)) {
--        return 0;
-+#ifdef HAVE_SYSTEMD
-+    if (use_systemd) {
-+        const char *userdata_key = "ap_open_systemd_listeners";
-+        void *data;
-+        /* clear the enviroment on our second run
-+        * so that none of our future children get confused.
-+        */
-+        apr_pool_userdata_get(&data, userdata_key, s->process->pool);
-+        if (!data) {
-+            apr_pool_userdata_set((const void *)1, userdata_key,
-+                                apr_pool_cleanup_null, s->process->pool);
-+        }
-+        else {
-+            sd_listen_fds(1);
-+        }
-+    }
-+    else
-+#endif
-+    {
-+        if (open_listeners(s->process->pool)) {
-+            return 0;
-+        }
-     }
- 
-     for (lr = ap_listeners; lr; lr = lr->next) {
-@@ -698,7 +844,7 @@ AP_DECLARE(apr_status_t) ap_duplicate_listeners(apr_pool_t *p, server_rec *s,
-                             duplr->bind_addr);
-                 return stat;
-             }
--            make_sock(p, duplr);
-+            make_sock(p, duplr, 1);
- #if AP_NONBLOCK_WHEN_MULTI_LISTEN
-             use_nonblock = (ap_listeners && ap_listeners->next);
-             stat = apr_socket_opt_set(duplr->sd, APR_SO_NONBLOCK, use_nonblock);
-@@ -825,6 +971,11 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy,
-     if (argc < 1 || argc > 2) {
-         return "Listen requires 1 or 2 arguments.";
-     }
-+#ifdef HAVE_SYSTEMD
-+    if (use_systemd == -1) {
-+        use_systemd = sd_listen_fds(0) > 0;
-+    }
-+#endif
- 
-     rv = apr_parse_addr_port(&host, &scope_id, &port, argv[0], cmd->pool);
-     if (rv != APR_SUCCESS) {
-@@ -856,6 +1007,12 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy,
-         ap_str_tolower(proto);
-     }
- 
-+#ifdef HAVE_SYSTEMD
-+    if (use_systemd) {
-+        return set_systemd_listener(cmd->server->process, port, proto);
-+    }
-+#endif
-+
-     return alloc_listener(cmd->server->process, host, port, proto, NULL);
- }
- 

httpd-2.4.43-sslcoalesce.patch

@@ -1,192 +0,0 @@
-
-http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/ssl/ssl_engine_io.c?r1=1836237&r2=1836236&pathrev=1836237&view=patch
-http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/ssl/ssl_engine_io.c?r1=1873985&r2=1876037&view=patch
-
---- httpd-2.4.43/modules/ssl/ssl_engine_io.c.sslcoalesce
-+++ httpd-2.4.43/modules/ssl/ssl_engine_io.c
-@@ -1585,18 +1585,32 @@
- }
- 
- 
--/* ssl_io_filter_output() produces one SSL/TLS message per bucket
-+/* ssl_io_filter_output() produces one SSL/TLS record per bucket
-  * passed down the output filter stack.  This results in a high
-- * overhead (network packets) for any output comprising many small
-- * buckets.  SSI page applied through the HTTP chunk filter, for
-- * example, may produce many brigades containing small buckets -
-- * [chunk-size CRLF] [chunk-data] [CRLF].
-+ * overhead (more network packets & TLS processing) for any output
-+ * comprising many small buckets.  SSI output passed through the HTTP
-+ * chunk filter, for example, may produce many brigades containing
-+ * small buckets - [chunk-size CRLF] [chunk-data] [CRLF].
-  *
-- * The coalescing filter merges many small buckets into larger buckets
-- * where possible, allowing the SSL I/O output filter to handle them
-- * more efficiently. */
-+ * Sending HTTP response headers as a separate TLS record to the
-+ * response body also reveals information to a network observer (the
-+ * size of headers) which can be significant.
-+ *
-+ * The coalescing filter merges data buckets with the aim of producing
-+ * fewer, larger TLS records - without copying/buffering all content
-+ * and introducing unnecessary overhead.
-+ *
-+ * ### This buffering could be probably be done more comprehensively
-+ * ### in ssl_io_filter_output itself. 
-+ * 
-+ * ### Another possible performance optimisation in particular for the
-+ * ### [HEAP] [FILE] HTTP response case is using a brigade rather than
-+ * ### a char array to buffer; using apr_brigade_write() to append
-+ * ### will use already-allocated memory from the HEAP, reducing # of
-+ * ### copies.
-+ */
- 
--#define COALESCE_BYTES (2048)
-+#define COALESCE_BYTES (AP_IOBUFSIZE)
- 
- struct coalesce_ctx {
-     char buffer[COALESCE_BYTES];
-@@ -1609,11 +1623,12 @@
-     apr_bucket *e, *upto;
-     apr_size_t bytes = 0;
-     struct coalesce_ctx *ctx = f->ctx;
-+    apr_size_t buffered = ctx ? ctx->bytes : 0; /* space used on entry */
-     unsigned count = 0;
- 
-     /* The brigade consists of zero-or-more small data buckets which
--     * can be coalesced (the prefix), followed by the remainder of the
--     * brigade.
-+     * can be coalesced (referred to as the "prefix"), followed by the
-+     * remainder of the brigade.
-      *
-      * Find the last bucket - if any - of that prefix.  count gives
-      * the number of buckets in the prefix.  The "prefix" must contain
-@@ -1628,24 +1643,97 @@
-          e != APR_BRIGADE_SENTINEL(bb)
-              && !APR_BUCKET_IS_METADATA(e)
-              && e->length != (apr_size_t)-1
--             && e->length < COALESCE_BYTES
--             && (bytes + e->length) < COALESCE_BYTES
--             && (ctx == NULL
--                 || bytes + ctx->bytes + e->length < COALESCE_BYTES);
-+             && e->length <= COALESCE_BYTES
-+             && (buffered + bytes + e->length) <= COALESCE_BYTES;
-          e = APR_BUCKET_NEXT(e)) {
--        if (e->length) count++; /* don't count zero-length buckets */
--        bytes += e->length;
-+        /* don't count zero-length buckets */
-+        if (e->length) {
-+            bytes += e->length;
-+            count++;
-+        }
-     }
-+
-+    /* If there is room remaining and the next bucket is a data
-+     * bucket, try to include it in the prefix to coalesce.  For a
-+     * typical [HEAP] [FILE] HTTP response brigade, this handles
-+     * merging the headers and the start of the body into a single TLS
-+     * record. */
-+    if (bytes + buffered > 0
-+        && bytes + buffered < COALESCE_BYTES
-+        && e != APR_BRIGADE_SENTINEL(bb)
-+        && !APR_BUCKET_IS_METADATA(e)) {
-+        apr_status_t rv = APR_SUCCESS;
-+
-+        /* For an indeterminate length bucket (PIPE/CGI/...), try a
-+         * non-blocking read to have it morph into a HEAP.  If the
-+         * read fails with EAGAIN, it is harmless to try a split
-+         * anyway, split is ENOTIMPL for most PIPE-like buckets. */
-+        if (e->length == (apr_size_t)-1) {
-+            const char *discard;
-+            apr_size_t ignore;
-+
-+            rv = apr_bucket_read(e, &discard, &ignore, APR_NONBLOCK_READ);
-+            if (rv != APR_SUCCESS && !APR_STATUS_IS_EAGAIN(rv)) {
-+                ap_log_cerror(APLOG_MARK, APLOG_ERR, rv, f->c, APLOGNO(10232)
-+                              "coalesce failed to read from %s bucket",
-+                              e->type->name);
-+                return AP_FILTER_ERROR;
-+            }
-+        }
-+
-+        if (rv == APR_SUCCESS) {
-+            /* If the read above made the bucket morph, it may now fit
-+             * entirely within the buffer.  Otherwise, split it so it does
-+             * fit. */
-+            if (e->length > COALESCE_BYTES
-+                || e->length + buffered + bytes > COALESCE_BYTES) {
-+                rv = apr_bucket_split(e, COALESCE_BYTES - (buffered + bytes));
-+            }
-+
-+            if (rv == APR_SUCCESS && e->length == 0) {
-+                /* As above, don't count in the prefix if the bucket is
-+                 * now zero-length. */
-+            }
-+            else if (rv == APR_SUCCESS) {
-+                ap_log_cerror(APLOG_MARK, APLOG_TRACE4, 0, f->c,
-+                              "coalesce: adding %" APR_SIZE_T_FMT " bytes "
-+                              "from split %s bucket, total %" APR_SIZE_T_FMT,
-+                              e->length, e->type->name, bytes + buffered);
-+
-+                count++;
-+                bytes += e->length;
-+                e = APR_BUCKET_NEXT(e);
-+            }
-+            else if (rv != APR_ENOTIMPL) {
-+                ap_log_cerror(APLOG_MARK, APLOG_ERR, rv, f->c, APLOGNO(10233)
-+                              "coalesce: failed to split data bucket");
-+                return AP_FILTER_ERROR;
-+            }
-+        }
-+    }
-+
-     upto = e;
- 
--    /* Coalesce the prefix, if:
--     * a) more than one bucket is found to coalesce, or
--     * b) the brigade contains only a single data bucket, or
--     * c) the data bucket is not last but we have buffered data already.
-+    /* Coalesce the prefix, if any of the following are true:
-+     * 
-+     * a) the prefix is more than one bucket
-+     * OR
-+     * b) the prefix is the entire brigade, which is a single bucket
-+     *    AND the prefix length is smaller than the buffer size,
-+     * OR
-+     * c) the prefix is a single bucket
-+     *    AND there is buffered data from a previous pass.
-+     * 
-+     * The aim with (b) is to buffer a small bucket so it can be
-+     * coalesced with future invocations of this filter.  e.g.  three
-+     * calls each with a single 100 byte HEAP bucket should get
-+     * coalesced together.  But an invocation with a 8192 byte HEAP
-+     * should pass through untouched.
-      */
-     if (bytes > 0
-         && (count > 1
--            || (upto == APR_BRIGADE_SENTINEL(bb))
-+            || (upto == APR_BRIGADE_SENTINEL(bb)
-+                && bytes < COALESCE_BYTES)
-             || (ctx && ctx->bytes > 0))) {
-         /* If coalescing some bytes, ensure a context has been
-          * created. */
-@@ -1656,7 +1744,8 @@
- 
-         ap_log_cerror(APLOG_MARK, APLOG_TRACE4, 0, f->c,
-                       "coalesce: have %" APR_SIZE_T_FMT " bytes, "
--                      "adding %" APR_SIZE_T_FMT " more", ctx->bytes, bytes);
-+                      "adding %" APR_SIZE_T_FMT " more (buckets=%u)",
-+                      ctx->bytes, bytes, count);
- 
-         /* Iterate through the prefix segment.  For non-fatal errors
-          * in this loop it is safe to break out and fall back to the
-@@ -1671,7 +1760,8 @@
-             if (APR_BUCKET_IS_METADATA(e)
-                 || e->length == (apr_size_t)-1) {
-                 ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, f->c, APLOGNO(02012)
--                              "unexpected bucket type during coalesce");
-+                              "unexpected %s bucket during coalesce",
-+                              e->type->name);
-                 break; /* non-fatal error; break out */
-             }
- 

httpd-2.4.43-sslmultiproxy.patch

@@ -1,118 +0,0 @@
-diff --git a/modules/ssl/mod_ssl.c b/modules/ssl/mod_ssl.c
-index 12617b2..0fe7464 100644
---- a/modules/ssl/mod_ssl.c
-+++ b/modules/ssl/mod_ssl.c
-@@ -459,6 +459,10 @@ static int ssl_hook_pre_config(apr_pool_t *pconf,
-     return OK;
- }
- 
-+static APR_OPTIONAL_FN_TYPE(ssl_engine_disable) *othermod_engine_disable;
-+static APR_OPTIONAL_FN_TYPE(ssl_engine_set) *othermod_engine_set;
-+
-+
- static SSLConnRec *ssl_init_connection_ctx(conn_rec *c,
-                                            ap_conf_vector_t *per_dir_config,
-                                            int new_proxy)
-@@ -466,6 +470,10 @@ static SSLConnRec *ssl_init_connection_ctx(conn_rec *c,
-     SSLConnRec *sslconn = myConnConfig(c);
-     int need_setup = 0;
- 
-+    if (othermod_engine_disable) {
-+        othermod_engine_disable(c);
-+    }
-+
-     /* mod_proxy's (r->)per_dir_config has the lifetime of the request, thus
-      * it uses ssl_engine_set() to reset sslconn->dc when reusing SSL backend
-      * connections, so we must fall through here. But in the case where we are
-@@ -544,6 +552,10 @@ static int ssl_engine_set(conn_rec *c,
- {
-     SSLConnRec *sslconn;
-     int status;
-+
-+    if (othermod_engine_set) {
-+        return othermod_engine_set(c, per_dir_config, proxy, enable);
-+    }
-     
-     if (proxy) {
-         sslconn = ssl_init_connection_ctx(c, per_dir_config, 1);
-@@ -572,12 +584,18 @@ static int ssl_engine_set(conn_rec *c,
- 
- static int ssl_proxy_enable(conn_rec *c)
- {
--    return ssl_engine_set(c, NULL, 1, 1);
-+    if (othermod_engine_set)
-+        return othermod_engine_set(c, NULL, 1, 1);
-+    else
-+        return ssl_engine_set(c, NULL, 1, 1);
- }
- 
- static int ssl_engine_disable(conn_rec *c)
- {
--    return ssl_engine_set(c, NULL, 0, 0);
-+    if (othermod_engine_set)
-+        return othermod_engine_set(c, NULL, 0, 0);
-+    else
-+        return ssl_engine_set(c, NULL, 0, 0);
- }
- 
- int ssl_init_ssl_connection(conn_rec *c, request_rec *r)
-@@ -753,6 +771,9 @@ static void ssl_register_hooks(apr_pool_t *p)
-                       APR_HOOK_MIDDLE);
- 
-     ssl_var_register(p);
-+    
-+    othermod_engine_disable = APR_RETRIEVE_OPTIONAL_FN(ssl_engine_disable);
-+    othermod_engine_set = APR_RETRIEVE_OPTIONAL_FN(ssl_engine_set);
- 
-     APR_REGISTER_OPTIONAL_FN(ssl_proxy_enable);
-     APR_REGISTER_OPTIONAL_FN(ssl_engine_disable);
-diff --git a/modules/ssl/ssl_engine_vars.c b/modules/ssl/ssl_engine_vars.c
-index 5724f18..81c56ba 100644
---- a/modules/ssl/ssl_engine_vars.c
-+++ b/modules/ssl/ssl_engine_vars.c
-@@ -54,6 +54,8 @@ static char *ssl_var_lookup_ssl_cipher(apr_pool_t *p, SSLConnRec *sslconn, char
- static void  ssl_var_lookup_ssl_cipher_bits(SSL *ssl, int *usekeysize, int *algkeysize);
- static char *ssl_var_lookup_ssl_version(apr_pool_t *p, char *var);
- static char *ssl_var_lookup_ssl_compress_meth(SSL *ssl);
-+static APR_OPTIONAL_FN_TYPE(ssl_is_https) *othermod_is_https;
-+static APR_OPTIONAL_FN_TYPE(ssl_var_lookup) *othermod_var_lookup;
- 
- static SSLConnRec *ssl_get_effective_config(conn_rec *c)
- {
-@@ -68,7 +70,9 @@ static SSLConnRec *ssl_get_effective_config(conn_rec *c)
- static int ssl_is_https(conn_rec *c)
- {
-     SSLConnRec *sslconn = ssl_get_effective_config(c);
--    return sslconn && sslconn->ssl;
-+
-+    return (sslconn && sslconn->ssl)
-+        || (othermod_is_https && othermod_is_https(c));
- }
- 
- static const char var_interface[] = "mod_ssl/" AP_SERVER_BASEREVISION;
-@@ -137,6 +141,9 @@ void ssl_var_register(apr_pool_t *p)
- {
-     char *cp, *cp2;
- 
-+    othermod_is_https = APR_RETRIEVE_OPTIONAL_FN(ssl_is_https);
-+    othermod_var_lookup = APR_RETRIEVE_OPTIONAL_FN(ssl_var_lookup);
-+
-     APR_REGISTER_OPTIONAL_FN(ssl_is_https);
-     APR_REGISTER_OPTIONAL_FN(ssl_var_lookup);
-     APR_REGISTER_OPTIONAL_FN(ssl_ext_list);
-@@ -271,6 +278,15 @@ char *ssl_var_lookup(apr_pool_t *p, server_rec *s, conn_rec *c, request_rec *r,
-      */
-     if (result == NULL && c != NULL) {
-         SSLConnRec *sslconn = ssl_get_effective_config(c);
-+
-+        if (strlen(var) > 4 && strcEQn(var, "SSL_", 4)
-+            && (!sslconn || !sslconn->ssl) && othermod_var_lookup) {
-+            /* For an SSL_* variable, if mod_ssl is not enabled for
-+             * this connection and another SSL module is present, pass
-+             * through to that module. */
-+            return othermod_var_lookup(p, s, c, r, var);
-+        }
-+
-         if (strlen(var) > 4 && strcEQn(var, "SSL_", 4)
-             && sslconn && sslconn->ssl)
-             result = ssl_var_lookup_ssl(p, sslconn, r, var+4);

httpd-2.4.48-r1842929+.patch

@@ -1,8 +1,11 @@
+
+Upstream-Status: in trunk, not proposed for 2.4.x
+
 diff --git a/Makefile.in b/Makefile.in
-index 06b8c5a..9eeb5c7 100644
+index 6747aea..40c7076 100644
 --- a/Makefile.in
 +++ b/Makefile.in
-@@ -213,6 +213,7 @@ install-cgi:
+@@ -233,6 +233,7 @@ install-cgi:
  install-other:
  	@test -d $(DESTDIR)$(logfiledir) || $(MKINSTALLDIRS) $(DESTDIR)$(logfiledir)
  	@test -d $(DESTDIR)$(runtimedir) || $(MKINSTALLDIRS) $(DESTDIR)$(runtimedir)
@@ -11,7 +14,7 @@ index 06b8c5a..9eeb5c7 100644
  		file=apachecore.$$ext; \
  		if test -f $$file; then \
 diff --git a/acinclude.m4 b/acinclude.m4
-index 95232f5..5d9d669 100644
+index b6ef442..98f1441 100644
 --- a/acinclude.m4
 +++ b/acinclude.m4
 @@ -45,6 +45,7 @@ AC_DEFUN([APACHE_GEN_CONFIG_VARS],[
@@ -22,7 +25,7 @@ index 95232f5..5d9d669 100644
    APACHE_SUBST(other_targets)
    APACHE_SUBST(progname)
    APACHE_SUBST(prefix)
-@@ -688,6 +689,7 @@ AC_DEFUN([APACHE_EXPORT_ARGUMENTS],[
+@@ -665,6 +666,7 @@ AC_DEFUN([APACHE_EXPORT_ARGUMENTS],[
    APACHE_SUBST_EXPANDED_ARG(runtimedir)
    APACHE_SUBST_EXPANDED_ARG(logfiledir)
    APACHE_SUBST_EXPANDED_ARG(proxycachedir)
@@ -31,7 +34,7 @@ index 95232f5..5d9d669 100644
  
  dnl 
 diff --git a/configure.in b/configure.in
-index a63eada..c8f9aa2 100644
+index 37346b2..f303784 100644
 --- a/configure.in
 +++ b/configure.in
 @@ -41,7 +41,7 @@ dnl Something seems broken here.
@@ -56,7 +59,7 @@ index 2b4a70c..e076f41 100644
  
  #endif /* AP_CONFIG_LAYOUT_H */
 diff --git a/include/http_config.h b/include/http_config.h
-index f9c2d77..c229bc9 100644
+index 77657ae..384a90f 100644
 --- a/include/http_config.h
 +++ b/include/http_config.h
 @@ -757,6 +757,14 @@ AP_DECLARE(char *) ap_server_root_relative(apr_pool_t *p, const char *fname);
@@ -124,10 +127,10 @@ index addfd7e..2389f8f 100644
                               APR_HOOK_MIDDLE);
      dav_hook_find_liveprop(dav_fs_find_liveprop, NULL, NULL, APR_HOOK_MIDDLE);
 diff --git a/server/core.c b/server/core.c
-index 3db9d61..79b2a82 100644
+index d135764..c2176b9 100644
 --- a/server/core.c
 +++ b/server/core.c
-@@ -129,6 +129,8 @@ AP_DECLARE_DATA int ap_main_state = AP_SQ_MS_INITIAL_STARTUP;
+@@ -142,6 +142,8 @@ AP_DECLARE_DATA int ap_main_state = AP_SQ_MS_INITIAL_STARTUP;
  AP_DECLARE_DATA int ap_run_mode = AP_SQ_RM_UNKNOWN;
  AP_DECLARE_DATA int ap_config_generation = 0;
  
@@ -136,7 +139,7 @@ index 3db9d61..79b2a82 100644
  static void *create_core_dir_config(apr_pool_t *a, char *dir)
  {
      core_dir_config *conf;
-@@ -1409,12 +1411,15 @@ AP_DECLARE(const char *) ap_resolve_env(apr_pool_t *p, const char * word)
+@@ -1444,13 +1446,16 @@ AP_DECLARE(const char *) ap_resolve_env(apr_pool_t *p, const char * word)
      return res_buf;
  }
  
@@ -147,6 +150,7 @@ index 3db9d61..79b2a82 100644
      ap_server_config_defines = saved_server_config_defines;
      saved_server_config_defines = NULL;
      server_config_defined_vars = NULL;
+     ap_runtime_dir = NULL;
 -    return OK;
 +    core_state_dir = NULL;
 +
@@ -154,7 +158,7 @@ index 3db9d61..79b2a82 100644
  }
  
  /*
-@@ -3120,6 +3125,24 @@ static const char *set_runtime_dir(cmd_parms *cmd, void *dummy, const char *arg)
+@@ -3220,6 +3225,24 @@ static const char *set_runtime_dir(cmd_parms *cmd, void *dummy, const char *arg)
      return NULL;
  }
  
@@ -179,7 +183,7 @@ index 3db9d61..79b2a82 100644
  static const char *set_timeout(cmd_parms *cmd, void *dummy, const char *arg)
  {
      const char *err = ap_check_cmd_context(cmd, NOT_IN_DIR_CONTEXT);
-@@ -4414,6 +4437,8 @@ AP_INIT_TAKE1("ServerRoot", set_server_root, NULL, RSRC_CONF | EXEC_ON_READ,
+@@ -4521,6 +4544,8 @@ AP_INIT_TAKE1("ServerRoot", set_server_root, NULL, RSRC_CONF | EXEC_ON_READ,
    "Common directory of server-related files (logs, confs, etc.)"),
  AP_INIT_TAKE1("DefaultRuntimeDir", set_runtime_dir, NULL, RSRC_CONF | EXEC_ON_READ,
    "Common directory for run-time files (shared memory, locks, etc.)"),
@@ -188,7 +192,7 @@ index 3db9d61..79b2a82 100644
  AP_INIT_TAKE1("ErrorLog", set_server_string_slot,
    (void *)APR_OFFSETOF(server_rec, error_fname), RSRC_CONF,
    "The filename of the error log"),
-@@ -4941,8 +4966,7 @@ static int core_pre_config(apr_pool_t *pconf, apr_pool_t *plog, apr_pool_t *ptem
+@@ -5055,8 +5080,7 @@ static int core_pre_config(apr_pool_t *pconf, apr_pool_t *plog, apr_pool_t *ptem
  
      if (!saved_server_config_defines)
          init_config_defines(pconf);
@@ -198,7 +202,7 @@ index 3db9d61..79b2a82 100644
  
      ap_regcomp_set_default_cflags(AP_REG_DEFAULT);
  
-@@ -5170,6 +5194,27 @@ AP_DECLARE(int) ap_state_query(int query)
+@@ -5303,6 +5327,27 @@ AP_DECLARE(int) ap_state_query(int query)
      }
  }
  

httpd-2.4.53-detect-systemd.patch

@@ -1,5 +1,5 @@
 diff --git a/Makefile.in b/Makefile.in
-index ea8366e..06b8c5a 100644
+index a2e9c82..bd8045c 100644
 --- a/Makefile.in
 +++ b/Makefile.in
 @@ -4,7 +4,7 @@ CLEAN_SUBDIRS = test
@@ -11,19 +11,31 @@ index ea8366e..06b8c5a 100644
  PROGRAM_PRELINK      = $(COMPILE) -c $(top_srcdir)/server/buildmark.c
  PROGRAM_DEPENDENCIES = \
    server/libmain.la \
+diff --git a/acinclude.m4 b/acinclude.m4
+index 97484c9..05abe18 100644
+--- a/acinclude.m4
++++ b/acinclude.m4
+@@ -631,6 +631,7 @@ case $host in
+       if test "${ac_cv_header_systemd_sd_daemon_h}" = "no" || test -z "${SYSTEMD_LIBS}"; then
+         AC_MSG_WARN([Your system does not support systemd.])
+       else
++        APR_ADDTO(HTTPD_LIBS, [$SYSTEMD_LIBS])
+         AC_DEFINE(HAVE_SYSTEMD, 1, [Define if systemd is supported])
+       fi
+    fi
 diff --git a/configure.in b/configure.in
-index f276550..a63eada 100644
+index cf437fe..521fc45 100644
 --- a/configure.in
 +++ b/configure.in
-@@ -234,6 +234,7 @@ if test "$PCRE_CONFIG" != "false"; then
+@@ -239,6 +239,7 @@ if test "x$PCRE_CONFIG" != "x"; then
    AC_MSG_NOTICE([Using external PCRE library from $PCRE_CONFIG])
    APR_ADDTO(PCRE_INCLUDES, [`$PCRE_CONFIG --cflags`])
-   APR_ADDTO(PCRE_LIBS, [`$PCRE_CONFIG --libs`])
+   APR_ADDTO(PCRE_LIBS, [`$PCRE_CONFIG --libs8 2>/dev/null || $PCRE_CONFIG --libs`])
 +  APR_ADDTO(HTTPD_LIBS, [\$(PCRE_LIBS)])
  else
-   AC_MSG_ERROR([pcre-config for libpcre not found. PCRE is required and available from http://pcre.org/])
+   AC_MSG_ERROR([pcre(2)-config for libpcre not found. PCRE is required and available from http://pcre.org/])
  fi
-@@ -679,6 +682,7 @@ APACHE_SUBST(OS_DIR)
+@@ -734,6 +735,7 @@ APACHE_SUBST(OS_DIR)
  APACHE_SUBST(BUILTIN_LIBS)
  APACHE_SUBST(SHLIBPATH_VAR)
  APACHE_SUBST(OS_SPECIFIC_VARS)

httpd-2.4.53-export.patch

@@ -1,12 +1,8 @@
 
-Reduce size of httpd binary by telling linker to export all symbols
-from libmain.a, rather than bloating the symbol table with ap_hack_*
-to do so indirectly.
-
-Upstream: https://svn.apache.org/r1861685 (as new default-off configure option)
+Upstream-Status: r1861685 in trunk, not proposed for 2.4.x
 
 diff --git a/Makefile.in b/Makefile.in
-index 9eeb5c7..8746a10 100644
+index bd8045c..d6733a5 100644
 --- a/Makefile.in
 +++ b/Makefile.in
 @@ -4,8 +4,15 @@ CLEAN_SUBDIRS = test
@@ -27,7 +23,7 @@ index 9eeb5c7..8746a10 100644
    server/libmain.la \
    $(BUILTIN_LIBS) \
 diff --git a/server/Makefile.in b/server/Makefile.in
-index 1fa3344..116850b 100644
+index 8111877..f00bb3f 100644
 --- a/server/Makefile.in
 +++ b/server/Makefile.in
 @@ -12,7 +12,7 @@ LTLIBRARY_SOURCES = \
@@ -36,14 +32,14 @@ index 1fa3344..116850b 100644
  	util_charset.c util_cookies.c util_debug.c util_xml.c \
 -	util_filter.c util_pcre.c util_regex.c exports.c \
 +	util_filter.c util_pcre.c util_regex.c \
- 	scoreboard.c error_bucket.c protocol.c core.c request.c provider.c \
+ 	scoreboard.c error_bucket.c protocol.c core.c request.c ssl.c provider.c \
  	eoc_bucket.c eor_bucket.c core_filters.c \
  	util_expr_parse.c util_expr_scan.c util_expr_eval.c
 diff --git a/server/main.c b/server/main.c
-index 62e06df..17c09ee 100644
+index 7da7aa2..e63d2eb 100644
 --- a/server/main.c
 +++ b/server/main.c
-@@ -835,17 +835,3 @@ int main(int argc, const char * const argv[])
+@@ -857,17 +857,3 @@ int main(int argc, const char * const argv[])
      return !OK;
  }
  

httpd-2.4.54-icons.patch

@@ -0,0 +1,49 @@
+diff --git a/docs/conf/extra/httpd-autoindex.conf.in b/docs/conf/extra/httpd-autoindex.conf.in
+index 51b02ed..93a2b87 100644
+--- a/docs/conf/extra/httpd-autoindex.conf.in
++++ b/docs/conf/extra/httpd-autoindex.conf.in
+@@ -21,7 +21,7 @@ IndexOptions FancyIndexing HTMLTable VersionSort
+ Alias /icons/ "@exp_iconsdir@/"
+ 
+ <Directory "@exp_iconsdir@">
+-    Options Indexes MultiViews
++    Options Indexes MultiViews FollowSymlinks
+     AllowOverride None
+     Require all granted
+ </Directory>
+@@ -37,6 +37,7 @@ AddIconByType (TXT,/icons/text.gif) text/*
+ AddIconByType (IMG,/icons/image2.gif) image/*
+ AddIconByType (SND,/icons/sound2.gif) audio/*
+ AddIconByType (VID,/icons/movie.gif) video/*
++AddIconByType /icons/bomb.gif application/x-coredump
+ 
+ AddIcon /icons/binary.gif .bin .exe
+ AddIcon /icons/binhex.gif .hqx
+@@ -53,7 +54,6 @@ AddIcon /icons/dvi.gif .dvi
+ AddIcon /icons/uuencoded.gif .uu
+ AddIcon /icons/script.gif .conf .sh .shar .csh .ksh .tcl
+ AddIcon /icons/tex.gif .tex
+-AddIcon /icons/bomb.gif core
+ 
+ AddIcon /icons/back.gif ..
+ AddIcon /icons/hand.right.gif README
+diff --git a/docs/conf/magic b/docs/conf/magic
+index bc891d9..9a41b44 100644
+--- a/docs/conf/magic
++++ b/docs/conf/magic
+@@ -383,3 +383,15 @@
+ 4   string      moov        video/quicktime
+ 4   string      mdat        video/quicktime
+ 
++
++#------------------------------------------------------------------------------
++# application/x-coredump for LE/BE ELF
++#
++0       string          \177ELF
++>5      byte            1
++>16     leshort         4               application/x-coredump
++
++0       string          \177ELF
++>5      byte            2
++>16     beshort         4               application/x-coredump
++

httpd-2.4.63-r1912477+.patch

@@ -0,0 +1,383 @@
+# ./pullrev.sh 1912477 1912571 1912718 1913654 1914438
+http://svn.apache.org/viewvc?view=revision&revision=1912477
+http://svn.apache.org/viewvc?view=revision&revision=1912571
+http://svn.apache.org/viewvc?view=revision&revision=1912718
+http://svn.apache.org/viewvc?view=revision&revision=1913654
+http://svn.apache.org/viewvc?view=revision&revision=1914438
+
+Upstream-Status: in trunk, not proposed for 2.4.x
+
+diff --git a/modules/dav/fs/config6.m4 b/modules/dav/fs/config6.m4
+index dd26ec8..72fff9a 100644
+--- a/modules/dav/fs/config6.m4
++++ b/modules/dav/fs/config6.m4
+@@ -20,4 +20,10 @@ esac
+ 
+ APACHE_MODULE(dav_fs, DAV provider for the filesystem.  --enable-dav also enables mod_dav_fs., $dav_fs_objects, , $dav_fs_enable,,dav)
+ 
++if test "x$enable_dav_fs" = "xshared"; then
++    # The only symbol which needs to be exported is the module
++    # structure, so ask libtool to hide everything else:
++    APR_ADDTO(MOD_DAV_FS_LDADD, [-export-symbols-regex dav_fs_module])
++fi
++
+ APACHE_MODPATH_FINISH
+diff --git a/modules/dav/fs/dbm.c b/modules/dav/fs/dbm.c
+index 39ab4ad..4551f70 100644
+--- a/modules/dav/fs/dbm.c
++++ b/modules/dav/fs/dbm.c
+@@ -47,6 +47,10 @@
+ #include "http_log.h"
+ #include "http_main.h"      /* for ap_server_conf */
+ 
++#ifndef DEFAULT_PROPDB_DBM_TYPE
++#define DEFAULT_PROPDB_DBM_TYPE "default"
++#endif
++
+ APLOG_USE_MODULE(dav_fs);
+ 
+ struct dav_db {
+@@ -129,10 +133,10 @@ void dav_fs_ensure_state_dir(apr_pool_t * p, const char *dirname)
+ /* dav_dbm_open_direct:  Opens a *dbm database specified by path.
+  *    ro = boolean read-only flag.
+  */
+-dav_error * dav_dbm_open_direct(apr_pool_t *p, const char *pathname, int ro,
+-                                dav_db **pdb)
++dav_error * dav_dbm_open_direct(apr_pool_t *p, const char *pathname,
++                                const char *dbmtype, int ro, dav_db **pdb)
+ {
+-#if APU_MAJOR_VERSION > 1 || (APU_MAJOR_VERSION == 1 && APU_MINOR_VERSION >= 7)
++#if APR_MAJOR_VERSION > 1 || (APU_MAJOR_VERSION == 1 && APU_MINOR_VERSION >= 7)
+     const apr_dbm_driver_t *driver;
+     const apu_err_t *err;
+ #endif
+@@ -141,11 +145,12 @@ dav_error * dav_dbm_open_direct(apr_pool_t *p, const char *pathname, int ro,
+ 
+     *pdb = NULL;
+ 
+-#if APU_MAJOR_VERSION > 1 || (APU_MAJOR_VERSION == 1 && APU_MINOR_VERSION >= 7)
+-    if ((status = apr_dbm_get_driver(&driver, NULL, &err, p)) != APR_SUCCESS) {
++#if APR_MAJOR_VERSION > 1 || (APU_MAJOR_VERSION == 1 && APU_MINOR_VERSION >= 7)
++    if ((status = apr_dbm_get_driver(&driver, dbmtype, &err, p)) != APR_SUCCESS) {
++
+         ap_log_error(APLOG_MARK, APLOG_ERR, status, ap_server_conf, APLOGNO(10289)
+-                     "mod_dav_fs: The DBM library '%s' could not be loaded: %s",
+-                             err->reason, err->msg);
++                     "mod_dav_fs: The DBM library '%s' for '%s' could not be loaded: %s",
++                     err->reason, dbmtype, err->msg);
+         return dav_new_error(p, HTTP_INTERNAL_SERVER_ERROR, 1, status,
+                 "Could not load library for database.");
+     }
+@@ -156,7 +161,7 @@ dav_error * dav_dbm_open_direct(apr_pool_t *p, const char *pathname, int ro,
+         return dav_fs_dbm_error(NULL, p, status);
+     }
+ #else
+-    if ((status = apr_dbm_open(&file, pathname,
++    if ((status = apr_dbm_open_ex(&file, dbmtype, pathname,
+                                ro ? APR_DBM_READONLY : APR_DBM_RWCREATE,
+                                APR_OS_DEFAULT, p))
+                 != APR_SUCCESS
+@@ -206,7 +211,7 @@ static dav_error * dav_dbm_open(apr_pool_t * p, const dav_resource *resource,
+ 
+     /* ### do we need to deal with the umask? */
+ 
+-    return dav_dbm_open_direct(p, pathname, ro, pdb);
++    return dav_dbm_open_direct(p, pathname, DEFAULT_PROPDB_DBM_TYPE, ro, pdb);
+ }
+ 
+ void dav_dbm_close(dav_db *db)
+diff --git a/modules/dav/fs/lock.c b/modules/dav/fs/lock.c
+index ef18c4a..29d167d 100644
+--- a/modules/dav/fs/lock.c
++++ b/modules/dav/fs/lock.c
+@@ -181,8 +181,7 @@ struct dav_lockdb_private
+ {
+     request_rec *r;                  /* for accessing the uuid state */
+     apr_pool_t *pool;                /* a pool to use */
+-    const char *lockdb_path;         /* where is the lock database? */
+-
++    const dav_fs_server_conf *conf;  /* lock database config & metadata */
+     int opened;                      /* we opened the database */
+     dav_db *db;                      /* if non-NULL, the lock database */
+ };
+@@ -292,6 +291,19 @@ static int dav_fs_compare_locktoken(
+     return dav_compare_locktoken(lt1, lt2);
+ }
+ 
++static apr_status_t dav_fs_lockdb_cleanup(void *data)
++{
++    dav_lockdb *lockdb = data;
++
++    apr_global_mutex_unlock(lockdb->info->conf->lockdb_mutex);
++
++    if (lockdb->info->db) {
++        dav_dbm_close(lockdb->info->db);
++    }
++    
++    return APR_SUCCESS;
++}
++
+ /*
+ ** dav_fs_really_open_lockdb:
+ **
+@@ -300,15 +312,27 @@ static int dav_fs_compare_locktoken(
+ static dav_error * dav_fs_really_open_lockdb(dav_lockdb *lockdb)
+ {
+     dav_error *err;
++    apr_status_t rv;
+ 
+     if (lockdb->info->opened)
+         return NULL;
+ 
++    rv = apr_global_mutex_lock(lockdb->info->conf->lockdb_mutex);
++    if (rv) {
++        return dav_new_error(lockdb->info->pool,
++                             HTTP_INTERNAL_SERVER_ERROR,
++                             DAV_ERR_LOCK_OPENDB, rv,
++                             "Could not lock mutex for lock database.");
++    }
++    
+     err = dav_dbm_open_direct(lockdb->info->pool,
+-                              lockdb->info->lockdb_path,
++                              lockdb->info->conf->lockdb_path,
++                              lockdb->info->conf->lockdb_type,
+                               lockdb->ro,
+                               &lockdb->info->db);
+     if (err != NULL) {
++        apr_global_mutex_unlock(lockdb->info->conf->lockdb_mutex);
++        
+         return dav_push_error(lockdb->info->pool,
+                               HTTP_INTERNAL_SERVER_ERROR,
+                               DAV_ERR_LOCK_OPENDB,
+@@ -316,6 +340,10 @@ static dav_error * dav_fs_really_open_lockdb(dav_lockdb *lockdb)
+                               err);
+     }
+ 
++    apr_pool_cleanup_register(lockdb->info->pool, lockdb,
++                              dav_fs_lockdb_cleanup,
++                              dav_fs_lockdb_cleanup);
++
+     /* all right. it is opened now. */
+     lockdb->info->opened = 1;
+ 
+@@ -341,9 +369,9 @@ static dav_error * dav_fs_open_lockdb(request_rec *r, int ro, int force,
+     comb->pub.info = &comb->priv;
+     comb->priv.r = r;
+     comb->priv.pool = r->pool;
+-
+-    comb->priv.lockdb_path = dav_get_lockdb_path(r);
+-    if (comb->priv.lockdb_path == NULL) {
++    comb->priv.conf = dav_fs_get_server_conf(r);
++    
++    if (comb->priv.conf == NULL || comb->priv.conf->lockdb_path == NULL) {
+         return dav_new_error(r->pool, HTTP_INTERNAL_SERVER_ERROR,
+                              DAV_ERR_LOCK_NO_DB, 0,
+                              "A lock database was not specified with the "
+@@ -369,8 +397,8 @@ static dav_error * dav_fs_open_lockdb(request_rec *r, int ro, int force,
+ */
+ static void dav_fs_close_lockdb(dav_lockdb *lockdb)
+ {
+-    if (lockdb->info->db != NULL)
+-        dav_dbm_close(lockdb->info->db);
++    apr_pool_cleanup_run(lockdb->info->pool, lockdb,
++                         dav_fs_lockdb_cleanup);
+ }
+ 
+ /*
+diff --git a/modules/dav/fs/mod_dav_fs.c b/modules/dav/fs/mod_dav_fs.c
+index 2389f8f..4bf6c51 100644
+--- a/modules/dav/fs/mod_dav_fs.c
++++ b/modules/dav/fs/mod_dav_fs.c
+@@ -14,31 +14,35 @@
+  * limitations under the License.
+  */
+ 
++#if !defined(_MSC_VER) && !defined(NETWARE)
++#include "ap_config_auto.h"
++#endif
++
+ #include "httpd.h"
+ #include "http_config.h"
++#include "http_core.h"
++#include "http_log.h"
+ #include "apr_strings.h"
+ 
+ #include "mod_dav.h"
+ #include "repos.h"
+ 
+-/* per-server configuration */
+-typedef struct {
+-    const char *lockdb_path;
+-
+-} dav_fs_server_conf;
+-
+ extern module AP_MODULE_DECLARE_DATA dav_fs_module;
+ 
+ #ifndef DEFAULT_DAV_LOCKDB
+ #define DEFAULT_DAV_LOCKDB "davlockdb"
+ #endif
++#ifndef DEFAULT_DAV_LOCKDB_TYPE
++#define DEFAULT_DAV_LOCKDB_TYPE "default"
++#endif
+ 
+-const char *dav_get_lockdb_path(const request_rec *r)
+-{
+-    dav_fs_server_conf *conf;
++static const char dav_fs_mutexid[] = "dav_fs-lockdb";
+ 
+-    conf = ap_get_module_config(r->server->module_config, &dav_fs_module);
+-    return conf->lockdb_path;
++static apr_global_mutex_t *dav_fs_lockdb_mutex;
++
++const dav_fs_server_conf *dav_fs_get_server_conf(const request_rec *r)
++{
++    return ap_get_module_config(r->server->module_config, &dav_fs_module);
+ }
+ 
+ static void *dav_fs_create_server_config(apr_pool_t *p, server_rec *s)
+@@ -57,15 +61,50 @@ static void *dav_fs_merge_server_config(apr_pool_t *p,
+ 
+     newconf->lockdb_path =
+         child->lockdb_path ? child->lockdb_path : parent->lockdb_path;
++    newconf->lockdb_type =
++        child->lockdb_type ? child->lockdb_type : parent->lockdb_type;
+ 
+     return newconf;
+ }
+ 
++static int dav_fs_pre_config(apr_pool_t *pconf, apr_pool_t *plog, apr_pool_t *ptemp)
++{
++    if (ap_mutex_register(pconf, dav_fs_mutexid, NULL, APR_LOCK_DEFAULT, 0))
++        return !OK;
++    return OK;
++}
++
++static void dav_fs_child_init(apr_pool_t *p, server_rec *s)
++{
++    apr_status_t rv;
++    
++    rv = apr_global_mutex_child_init(&dav_fs_lockdb_mutex,
++                                     apr_global_mutex_lockfile(dav_fs_lockdb_mutex),
++                                     p);
++    if (rv) {
++        ap_log_error(APLOG_MARK, APLOG_ERR, rv, s,
++                     APLOGNO(10488) "child init failed for mutex");
++    }                     
++}
++
+ static apr_status_t dav_fs_post_config(apr_pool_t *p, apr_pool_t *plog,
+                                        apr_pool_t *ptemp, server_rec *base_server)
+ {
+     server_rec *s;
+-
++    apr_status_t rv;
++
++    /* Ignore first pass through the config. */
++    if (ap_state_query(AP_SQ_MAIN_STATE) == AP_SQ_MS_CREATE_PRE_CONFIG)
++        return OK;
++
++    rv = ap_global_mutex_create(&dav_fs_lockdb_mutex, NULL, dav_fs_mutexid, NULL,
++                                base_server, p, 0);
++    if (rv) {
++        ap_log_error(APLOG_MARK, APLOG_ERR, rv, base_server,
++                     APLOGNO(10489) "could not create lock mutex");
++        return !OK;
++    }                     
++    
+     for (s = base_server; s; s = s->next) {
+         dav_fs_server_conf *conf;
+ 
+@@ -74,6 +113,13 @@ static apr_status_t dav_fs_post_config(apr_pool_t *p, apr_pool_t *plog,
+         if (!conf->lockdb_path) {
+             conf->lockdb_path = ap_state_dir_relative(p, DEFAULT_DAV_LOCKDB);
+         }
++        if (!conf->lockdb_type) {
++            conf->lockdb_type = DEFAULT_DAV_LOCKDB_TYPE;
++        }
++
++        /* Mutex is common across all vhosts, but could have one per
++         * vhost if required. */
++        conf->lockdb_mutex = dav_fs_lockdb_mutex;
+     }
+ 
+     return OK;
+@@ -98,19 +144,36 @@ static const char *dav_fs_cmd_davlockdb(cmd_parms *cmd, void *config,
+     return NULL;
+ }
+ 
++/*
++ * Command handler for the DAVLockDBType directive, which is TAKE1
++ */
++static const char *dav_fs_cmd_davlockdbtype(cmd_parms *cmd, void *config,
++                                        const char *arg1)
++{
++    dav_fs_server_conf *conf = ap_get_module_config(cmd->server->module_config,
++                                                    &dav_fs_module);
++    conf->lockdb_type = arg1;
++
++    return NULL;
++}
++
+ static const command_rec dav_fs_cmds[] =
+ {
+     /* per server */
+     AP_INIT_TAKE1("DAVLockDB", dav_fs_cmd_davlockdb, NULL, RSRC_CONF,
+                   "specify a lock database"),
++    AP_INIT_TAKE1("DAVLockDBType", dav_fs_cmd_davlockdbtype, NULL, RSRC_CONF,
++                  "specify a lock database DBM type"),
+ 
+     { NULL }
+ };
+ 
+ static void register_hooks(apr_pool_t *p)
+ {
++    ap_hook_pre_config(dav_fs_pre_config, NULL, NULL, APR_HOOK_MIDDLE);
+     ap_hook_post_config(dav_fs_post_config, NULL, NULL, APR_HOOK_MIDDLE);
+-
++    ap_hook_child_init(dav_fs_child_init, NULL, NULL, APR_HOOK_MIDDLE);
++    
+     dav_hook_gather_propsets(dav_fs_gather_propsets, NULL, NULL,
+                              APR_HOOK_MIDDLE);
+     dav_hook_find_liveprop(dav_fs_find_liveprop, NULL, NULL, APR_HOOK_MIDDLE);
+diff --git a/modules/dav/fs/repos.h b/modules/dav/fs/repos.h
+index b164611..d3a55a5 100644
+--- a/modules/dav/fs/repos.h
++++ b/modules/dav/fs/repos.h
+@@ -25,6 +25,8 @@
+ #ifndef _DAV_FS_REPOS_H_
+ #define _DAV_FS_REPOS_H_
+ 
++#include "util_mutex.h"
++
+ /* the subdirectory to hold all DAV-related information for a directory */
+ #define DAV_FS_STATE_DIR                ".DAV"
+ #define DAV_FS_STATE_FILE_FOR_DIR       ".state_for_dir"
+@@ -53,8 +55,8 @@ dav_error * dav_fs_get_locknull_members(const dav_resource *resource,
+ /* DBM functions used by the repository and locking providers */
+ extern const dav_hooks_db dav_hooks_db_dbm;
+ 
+-dav_error * dav_dbm_open_direct(apr_pool_t *p, const char *pathname, int ro,
+-                                dav_db **pdb);
++dav_error * dav_dbm_open_direct(apr_pool_t *p, const char *pathname,
++                                const char *dbmtype, int ro, dav_db **pdb);
+ void dav_dbm_get_statefiles(apr_pool_t *p, const char *fname,
+                             const char **state1, const char **state2);
+ dav_error * dav_dbm_delete(dav_db *db, apr_datum_t key);
+@@ -64,8 +66,15 @@ void dav_dbm_freedatum(dav_db *db, apr_datum_t data);
+ int dav_dbm_exists(dav_db *db, apr_datum_t key);
+ void dav_dbm_close(dav_db *db);
+ 
+-/* where is the lock database located? */
+-const char *dav_get_lockdb_path(const request_rec *r);
++/* Per-server configuration. */
++typedef struct {
++    const char *lockdb_path;
++    const char *lockdb_type;
++    apr_global_mutex_t *lockdb_mutex;
++} dav_fs_server_conf;
++
++/* Returns server configuration for the request. */
++const dav_fs_server_conf *dav_fs_get_server_conf(const request_rec *r);
+ 
+ const dav_hooks_locks *dav_fs_get_lock_hooks(request_rec *r);
+ const dav_hooks_propdb *dav_fs_get_propdb_hooks(request_rec *r);

httpd-2.4.64-mod_systemd.patch

@@ -1,10 +1,12 @@
 
 More verbose startup logging for mod_systemd.
 
---- httpd-2.4.43/modules/arch/unix/mod_systemd.c.mod_systemd
-+++ httpd-2.4.43/modules/arch/unix/mod_systemd.c
-@@ -29,11 +29,14 @@
- #include "mpm_common.h"
+diff --git a/modules/arch/unix/mod_systemd.c b/modules/arch/unix/mod_systemd.c
+index 22482fd..b46d3ef 100644
+--- a/modules/arch/unix/mod_systemd.c
++++ b/modules/arch/unix/mod_systemd.c
+@@ -34,11 +34,14 @@
+ #endif
  
  #include "systemd/sd-daemon.h"
 +#include "systemd/sd-journal.h"
@@ -18,9 +20,9 @@ More verbose startup logging for mod_systemd.
  static int systemd_pre_config(apr_pool_t *pconf, apr_pool_t *plog,
                                apr_pool_t *ptemp)
  {
-@@ -44,6 +47,20 @@
-     return OK;
+@@ -63,6 +66,20 @@ static void log_selinux_context(void)
  }
+ #endif
  
 +static char *dump_listener(ap_listen_rec *lr, apr_pool_t *p)
 +{
@@ -39,21 +41,17 @@ More verbose startup logging for mod_systemd.
  /* Report the service is ready in post_config, which could be during
   * startup or after a reload.  The server could still hit a fatal
   * startup error after this point during ap_run_mpm(), so this is
-@@ -51,19 +68,51 @@
-  * the TCP ports so new connections will not be rejected.  There will
-  * always be a possible async failure event simultaneous to the
-  * service reporting "ready", so this should be good enough. */
--static int systemd_post_config(apr_pool_t *p, apr_pool_t *plog,
-+static int systemd_post_config(apr_pool_t *pconf, apr_pool_t *plog,
+@@ -73,23 +90,52 @@ static void log_selinux_context(void)
+ static int systemd_post_config(apr_pool_t *pconf, apr_pool_t *plog,
                                 apr_pool_t *ptemp, server_rec *main_server)
  {
 +    ap_listen_rec *lr;
 +    apr_size_t plen = sizeof describe_listeners;
 +    char *p = describe_listeners;
 +
-+    if (ap_state_query(AP_SQ_MAIN_STATE) == AP_SQ_MS_CREATE_PRE_CONFIG)
-+        return OK;
-+
+     if (ap_state_query(AP_SQ_MAIN_STATE) == AP_SQ_MS_CREATE_PRE_CONFIG)
+         return OK;
+ 
 +    for (lr = ap_listeners; lr; lr = lr->next) {
 +        char *s = dump_listener(lr, ptemp);
 +
@@ -74,6 +72,10 @@ More verbose startup logging for mod_systemd.
 +        }
 +    }
 +
+ #ifdef HAVE_SELINUX
+     log_selinux_context();
+ #endif
+ 
      sd_notify(0, "READY=1\n"
                "STATUS=Configuration loaded.\n");
 +

httpd-2.4.64-separate-systemd-fns.patch

@@ -0,0 +1,101 @@
+diff --git a/acinclude.m4 b/acinclude.m4
+index 05abe18..97484c9 100644
+--- a/acinclude.m4
++++ b/acinclude.m4
+@@ -631,7 +631,6 @@ case $host in
+       if test "${ac_cv_header_systemd_sd_daemon_h}" = "no" || test -z "${SYSTEMD_LIBS}"; then
+         AC_MSG_WARN([Your system does not support systemd.])
+       else
+-        APR_ADDTO(HTTPD_LIBS, [$SYSTEMD_LIBS])
+         AC_DEFINE(HAVE_SYSTEMD, 1, [Define if systemd is supported])
+       fi
+    fi
+diff --git a/modules/arch/unix/mod_systemd.c b/modules/arch/unix/mod_systemd.c
+index af68249..7232a45 100644
+--- a/modules/arch/unix/mod_systemd.c
++++ b/modules/arch/unix/mod_systemd.c
+@@ -40,6 +40,9 @@
+ #include <unistd.h>
+ #endif
+ 
++APR_DECLARE_OPTIONAL_FN(int,
++                        ap_systemd_journal_stream_fd, (const char *, int, int));
++
+ static char describe_listeners[30];
+ 
+ static int systemd_pre_config(apr_pool_t *pconf, apr_pool_t *plog,
+@@ -217,10 +220,15 @@ static int ap_systemd_listen_fds(int unset_environment){
+     return sd_listen_fds(unset_environment);
+ }
+ 
++static int ap_systemd_journal_stream_fd(const char *identifier, int priority, int level_prefix){
++    return sd_journal_stream_fd("httpd", priority, 0);
++}
++
+ static void systemd_register_hooks(apr_pool_t *p)
+ {
+     APR_REGISTER_OPTIONAL_FN(ap_systemd_listen_fds);
+     APR_REGISTER_OPTIONAL_FN(ap_find_systemd_socket);
++    APR_REGISTER_OPTIONAL_FN(ap_systemd_journal_stream_fd);
+ 
+     /* Enable ap_extended_status. */
+     ap_hook_pre_config(systemd_pre_config, NULL, NULL, APR_HOOK_LAST);
+diff --git a/modules/loggers/config.m4 b/modules/loggers/config.m4
+index 0848d2e..8af2299 100644
+--- a/modules/loggers/config.m4
++++ b/modules/loggers/config.m4
+@@ -5,7 +5,6 @@ dnl APACHE_MODULE(name, helptext[, objects[, structname[, default[, config]]]])
+ APACHE_MODPATH_INIT(loggers)
+ 	
+ APACHE_MODULE(log_config, logging configuration.  You won't be able to log requests to the server without this module., , , yes)
+-APR_ADDTO(MOD_LOG_CONFIG_LDADD, [$SYSTEMD_LIBS])
+ 
+ APACHE_MODULE(log_debug, configurable debug logging, , , most)
+ APACHE_MODULE(log_forensic, forensic logging)
+diff --git a/modules/loggers/mod_log_config.c b/modules/loggers/mod_log_config.c
+index 694f447..a65b982 100644
+--- a/modules/loggers/mod_log_config.c
++++ b/modules/loggers/mod_log_config.c
+@@ -172,10 +172,6 @@
+ #include <limits.h>
+ #endif
+ 
+-#ifdef HAVE_SYSTEMD
+-#include <systemd/sd-journal.h>
+-#endif
+-
+ #define DEFAULT_LOG_FORMAT "%h %l %u %t \"%r\" %>s %b"
+ 
+ module AP_MODULE_DECLARE_DATA log_config_module;
+@@ -1640,8 +1636,15 @@ static apr_status_t wrap_journal_stream(apr_pool_t *p, apr_file_t **outfd,
+ {
+ #ifdef HAVE_SYSTEMD
+     int fd;
++    APR_OPTIONAL_FN_TYPE(ap_systemd_journal_stream_fd) *systemd_journal_stream_fd;
++    
++    systemd_journal_stream_fd = APR_RETRIEVE_OPTIONAL_FN(ap_systemd_journal_stream_fd);
++    if (systemd_journal_stream_fd == NULL) {
++        return APR_ENOTIMPL;
++    }
+ 
+-    fd = sd_journal_stream_fd("httpd", priority, 0);
++    fd = systemd_journal_stream_fd("httpd", priority, 0);
++    
+     if (fd < 0) return fd;
+ 
+     /* This is an AF_UNIX socket fd so is more pipe-like than
+diff --git a/modules/loggers/mod_log_config.h b/modules/loggers/mod_log_config.h
+index 877a593..bd52a98 100644
+--- a/modules/loggers/mod_log_config.h
++++ b/modules/loggers/mod_log_config.h
+@@ -69,6 +69,10 @@ APR_DECLARE_OPTIONAL_FN(ap_log_writer_init*, ap_log_set_writer_init,(ap_log_writ
+  */
+ APR_DECLARE_OPTIONAL_FN(ap_log_writer*, ap_log_set_writer, (ap_log_writer* func));
+ 
++#ifdef HAVE_SYSTEMD
++APR_DECLARE_OPTIONAL_FN(int, ap_systemd_journal_stream_fd, (const char *, int, int));
++#endif
++
+ #endif /* MOD_LOG_CONFIG */
+ /** @} */
+ 

httpd-2.4.64-sslprotdefault.patch

@@ -1,8 +1,8 @@
 diff --git a/modules/ssl/ssl_engine_config.c b/modules/ssl/ssl_engine_config.c
-index 27e7a53..b53f3f8 100644
+index 8fae1f8..c5dce7f 100644
 --- a/modules/ssl/ssl_engine_config.c
 +++ b/modules/ssl/ssl_engine_config.c
-@@ -119,7 +119,7 @@ static void modssl_ctx_init(modssl_ctx_t *mctx, apr_pool_t *p)
+@@ -127,7 +127,7 @@ static void modssl_ctx_init(modssl_ctx_t *mctx, apr_pool_t *p)
      mctx->ticket_key          = NULL;
  #endif
  
@@ -11,7 +11,7 @@ index 27e7a53..b53f3f8 100644
      mctx->protocol_set        = 0;
  
      mctx->pphrase_dialog_type = SSL_PPTYPE_UNSET;
-@@ -263,6 +263,7 @@ static void modssl_ctx_cfg_merge(apr_pool_t *p,
+@@ -268,6 +268,7 @@ static void modssl_ctx_cfg_merge(apr_pool_t *p,
      if (add->protocol_set) {
          mrg->protocol_set = 1;
          mrg->protocol = add->protocol;
@@ -19,20 +19,19 @@ index 27e7a53..b53f3f8 100644
      }
      else {
          mrg->protocol_set = base->protocol_set;
-
 diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c
-index bfad47a..b0fcf81 100644
+index 4e265b3..2fbd076 100644
 --- a/modules/ssl/ssl_engine_init.c
 +++ b/modules/ssl/ssl_engine_init.c
-@@ -577,6 +577,7 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
+@@ -638,6 +638,7 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
      MODSSL_SSL_METHOD_CONST SSL_METHOD *method = NULL;
      char *cp;
      int protocol = mctx->protocol;
 +    int protocol_set = mctx->protocol_set;
      SSLSrvConfigRec *sc = mySrvConfig(s);
  #if OPENSSL_VERSION_NUMBER >= 0x10100000L
-     int prot;
-@@ -586,12 +587,18 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
+     /* default is highest supported version, will be overridden below */
+@@ -652,12 +653,18 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
       *  Create the new per-server SSL context
       */
      if (protocol == SSL_PROTOCOL_NONE) {
@@ -56,7 +55,7 @@ index bfad47a..b0fcf81 100644
  #ifndef OPENSSL_NO_SSL3
                       (protocol & SSL_PROTOCOL_SSLV3 ? "SSLv3, " : ""),
  #endif
-@@ -604,7 +611,8 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
+@@ -670,7 +677,8 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
  #endif
  #endif
                       NULL);
@@ -66,7 +65,7 @@ index bfad47a..b0fcf81 100644
  
      ap_log_error(APLOG_MARK, APLOG_TRACE3, 0, s,
                   "Creating new SSL context (protocols: %s)", cp);
-@@ -705,13 +713,15 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
+@@ -776,13 +784,15 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
          prot = SSL3_VERSION;
  #endif
      } else {
@@ -88,7 +87,7 @@ index bfad47a..b0fcf81 100644
  
      /* Next we scan for the minimal protocol version we should provide,
       * but we do not allow holes between max and min */
-@@ -731,7 +741,7 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
+@@ -806,7 +816,7 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
          prot = SSL3_VERSION;
      }
  #endif

httpd-2.4.65-hcheck-stuck.patch

@@ -0,0 +1,66 @@
+--- a/modules/proxy/mod_proxy_hcheck.c
++++ b/modules/proxy/mod_proxy_hcheck.c
+@@ -989,12 +989,30 @@ static apr_status_t hc_watchdog_callback(int state
+     sctx_t *ctx = (sctx_t *)data;
+     server_rec *s = ctx->s;
+     proxy_server_conf *conf;
++    proxy_worker **workers;
++    proxy_worker *worker;
++    apr_time_t now;
++    int i, n;
+ 
++    conf = (proxy_server_conf *) ap_get_module_config(s->module_config, &proxy_module);
++    balancer = (proxy_balancer *)conf->balancers->elts;
++
+     switch (state) {
+         case AP_WATCHDOG_STATE_STARTING:
+             ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(03258)
+                          "%s watchdog started.",
+                          HCHECK_WATHCHDOG_NAME);
++            /* set last update time for all workers */
++            now = apr_time_now();
++            for (i = 0; i < conf->balancers->nelts; i++, balancer++) {
++                workers = (proxy_worker **)balancer->workers->elts;
++                for (n = 0; n < balancer->workers->nelts; n++, ++workers) {
++                    worker = *workers;
++                    if (worker->s->updated == 0) {
++                        worker->s->updated = now;
++                    }
++                }
++            }
+ #if HC_USE_THREADS
+             if (tpsize && hctp == NULL) {
+                 rv =  apr_thread_pool_create(&hctp, tpsize,
+@@ -1020,21 +1038,13 @@ static apr_status_t hc_watchdog_callback(int state
+ 
+         case AP_WATCHDOG_STATE_RUNNING:
+             /* loop thru all workers */
+-            if (s) {
+-                int i;
+-                conf = (proxy_server_conf *) ap_get_module_config(s->module_config, &proxy_module);
+-                balancer = (proxy_balancer *)conf->balancers->elts;
+-                ctx->s = s;
++            {
++                now = apr_time_now();
+                 for (i = 0; i < conf->balancers->nelts; i++, balancer++) {
+-                    int n;
+-                    apr_time_t now;
+-                    proxy_worker **workers;
+-                    proxy_worker *worker;
+                     /* Have any new balancers or workers been added dynamically? */
+                     ap_proxy_sync_balancer(balancer, s, conf);
+                     workers = (proxy_worker **)balancer->workers->elts;
+-                    now = apr_time_now();
+-                    for (n = 0; n < balancer->workers->nelts; n++) {
++                    for (n = 0; n < balancer->workers->nelts; n++, workers++) {
+                         worker = *workers;
+                         if (!PROXY_WORKER_IS(worker, PROXY_WORKER_STOPPED) &&
+                             (worker->s->method != NONE) &&
+@@ -1074,7 +1084,6 @@ static apr_status_t hc_watchdog_callback(int state
+                                 hc_check(NULL, baton);
+                             }
+                         }
+-                        workers++;
+                     }
+                 }
+             }

httpd-init.service

@@ -8,5 +8,6 @@ ConditionPathExists=|!/etc/pki/tls/private/localhost.key
 [Service]
 Type=oneshot
 RemainAfterExit=no
+PrivateTmp=true
 
 ExecStart=/usr/libexec/httpd-ssl-gencerts

httpd-ssl-gencerts

@@ -33,6 +33,7 @@ sscg -q                                                             \
      --cert-file           /etc/pki/tls/certs/localhost.crt         \
      --cert-key-file       /etc/pki/tls/private/localhost.key       \
      --ca-file             /etc/pki/tls/certs/localhost.crt         \
+     --no-dhparams-file                                             \
      --lifetime            365                                      \
      --hostname            $FQDN                                    \
      --email               root@$FQDN

httpd.conf

@@ -38,8 +38,10 @@ ServerRoot "/etc/httpd"
 # ports, instead of the default. See also the <VirtualHost>
 # directive.
 #
-# Change this to Listen on specific IP addresses as shown below to 
-# prevent Apache from glomming onto all bound IP addresses.
+# Change this to Listen on a specific IP address, but note that if
+# httpd.service is enabled to run at boot time, the address may not be
+# available when the service starts.  See the httpd.service(8) man
+# page for more information.
 #
 #Listen 12.34.56.78:80
 Listen 80
@@ -149,7 +151,7 @@ DocumentRoot "/var/www/html"
     #
     # AllowOverride controls what directives may be placed in .htaccess files.
     # It can be "All", "None", or any combination of the keywords:
-    #   Options FileInfo AuthConfig Limit
+    #   AllowOverride FileInfo AuthConfig Limit
     #
     AllowOverride None
 
@@ -197,6 +199,7 @@ LogLevel warn
     # a CustomLog directive (see below).
     #
     LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
+    LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" PID: %P %{tid}P %T" combined_ext
     LogFormat "%h %l %u %t \"%r\" %>s %b" common
 
     <IfModule logio_module>
@@ -214,10 +217,11 @@ LogLevel warn
     #CustomLog "logs/access_log" common
 
     #
-    # If you prefer a logfile with access, agent, and referer information
-    # (Combined Logfile Format) you can use the following directive.
+    # If you prefer a logfile with access, agent, referer, and process/thread
+    # information (an extended Combined Logfile Format), you can use the
+    # following directive.
     #
-    CustomLog "logs/access_log" combined
+    CustomLog "logs/access_log" combined_ext
 </IfModule>
 
 <IfModule alias_module>
@@ -261,6 +265,15 @@ LogLevel warn
     Require all granted
 </Directory>
 
+<IfModule headers_module>
+    #
+    # Avoid passing HTTP_PROXY environment to CGI's on this or any proxied
+    # backend servers which have lingering "httpoxy" defects.
+    # 'Proxy' request header is undefined by the IETF, not listed by IANA
+    #
+    RequestHeader unset Proxy early
+</IfModule>
+
 <IfModule mime_module>
     #
     # TypesConfig points to the file containing the list of mappings from
@@ -338,6 +351,13 @@ AddDefaultCharset UTF-8
 #ErrorDocument 402 http://www.example.com/subscription_info.html
 #
 
+#
+# MaxRanges: Maximum number of Ranges in a request before
+# returning the entire resource, or one of the special
+# values 'default', 'none' or 'unlimited'.
+# Default setting is to accept 200 Ranges.
+#MaxRanges unlimited
+
 #
 # EnableMMAP and EnableSendfile: On systems that support it, 
 # memory-mapping or the sendfile syscall may be used to deliver

httpd.conf.xml

@@ -241,6 +241,11 @@
       <filename>/etc/httpd/conf.modules.d</filename>
     </para>
   </refsect1>
+
+  <refsect1>
+    <title>Reporting Bugs</title>
+    <para>Please report bugs by filing an issue in @BUG_REPORT_URL@.</para>
+  </refsect1>
   
   <refsect1>
     <title>See also</title>

httpd.service

@@ -26,7 +26,25 @@ ExecReload=/usr/sbin/httpd $OPTIONS -k graceful
 # Send SIGWINCH for graceful stop
 KillSignal=SIGWINCH
 KillMode=mixed
+DevicePolicy=closed
+KeyringMode=private
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+OOMPolicy=continue
+PrivateDevices=yes
 PrivateTmp=true
+ProtectClock=yes
+ProtectControlGroups=yes
+ProtectHome=read-only
+ProtectHostname=yes
+ProtectKernelLogs=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+ProtectSystem=yes
+RestrictNamespaces=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+SystemCallArchitectures=native
 
 [Install]
 WantedBy=multi-user.target

httpd.service.xml

@@ -175,7 +175,7 @@ Wants=network-online.target</programlisting>
       <para>System packages (including the httpd package itself) may
       restart the httpd service automatically after packages are
       upgraded, installed, or removed. This is done using the
-      <command>systemctl try-restart httpd.service</command>, which
+      <command>systemctl try-restart httpd.service</command> command, which
       stops then starts the service if it is running.</para>
 
       <para>To disable automatic restarts, create the file
@@ -183,8 +183,9 @@ Wants=network-online.target</programlisting>
       When <command>httpd</command> interfaces are added in an update,
       it may not be safe to <emphasis>reload</emphasis> a running
       service after upgrading, if updated modules require interfaces
-      only available in the updated httpd.  It is recommended to allow
-      automatic restarts for this reason.</para>
+      only available in the updated <command>httpd</command> binary.
+      It is recommended to allow automatic restarts for this
+      reason.</para>
     </refsect2>
 
     <refsect2>
@@ -225,14 +226,50 @@ Wants=network-online.target</programlisting>
       types. See
       <citerefentry><refentrytitle>httpd_selinux</refentrytitle><manvolnum>8</manvolnum></citerefentry>
       for more information.</para>
+    </refsect2>
 
-      <para>The httpd service enables <emphasis>PrivateTmp</emphasis>
-      by default. The <filename>/tmp</filename> and
-      <filename>/var/tmp</filename> directories available within the
-      httpd process (and CGI scripts, etc) are not shared by other
-      processes. See
+    <refsect2>
+      <title>Process policies and restrictions</title>
+
+      <para>The <command>httpd.service</command> unit enables a
+      variety of sandboxing options. Many of these prevent the service
+      from changing the system configuration or attributes of the
+      kernel - such as <emphasis>ProtectClock</emphasis> and
+      <emphasis>ProtectKernelModules</emphasis>. See
       <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>
-      for more information.</para>
+      and
+      <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>
+      for more information on these options. Particular notice should
+      be taken of the following:
+
+      <itemizedlist>
+        <listitem><para><emphasis>PrivateTmp</emphasis> is enabled by
+        default. The <filename>/tmp</filename> and
+        <filename>/var/tmp</filename> directories available within the
+        httpd process (and CGI scripts, etc) are not shared by other
+        processes.</para></listitem>
+
+        <listitem><para><emphasis>OOMPolicy</emphasis> is set to
+        <emphasis>continue</emphasis> by default.  Under the default
+        Out-of-Memory policy, the entire service will be terminated if
+        any process is killed by the kernel OOM killer.  By setting
+        the policy to <emphasis>continue</emphasis>, httpd will
+        continue to run (and recover) if a single child is terminated
+        because of excess memory consumption.</para></listitem>
+
+        <listitem><para><emphasis>ProtectHome</emphasis> is set to
+        <emphasis>read-only</emphasis> by default. CGI scripts run via
+        <emphasis>UserDir</emphasis> will not be able modify any
+        content in <filename>/home</filename> by
+        default.</para></listitem>
+
+        <listitem><para><emphasis>ProtectSystem</emphasis> is set to
+        <emphasis>yes</emphasis> by default; this mounts various
+        system paths like <filename>/usr</filename> and
+        <filename>/boot</filename> as read-only by
+        default.</para></listitem>
+
+      </itemizedlist></para>
 
     </refsect2>
 
@@ -331,7 +368,12 @@ ReloadPropagatedFrom=httpd.service</programlisting>
     <filename>/usr/lib/systemd/system/httpd@.service</filename>,
     <filename>/etc/systemd/systemd/httpd.service.d</filename></para>
   </refsect1>
-  
+
+  <refsect1>
+    <title>Reporting Bugs</title>
+    <para>Please report bugs by filing an issue in @BUG_REPORT_URL@.</para>
+  </refsect1>
+
   <refsect1>
     <title>See also</title>
 

httpd.spec

@@ -3,17 +3,35 @@
 %define suexec_caller apache
 %define mmn 20120211
 %define mmnisa %{mmn}%{__isa_name}%{__isa_bits}
-%define vstring %(source /etc/os-release; echo ${REDHAT_SUPPORT_PRODUCT})
+%define vstring %(source /etc/os-release; echo ${NAME})
+%define bugurl %(source /etc/os-release; echo ${BUG_REPORT_URL})
 %if 0%{?fedora} > 26 || 0%{?rhel} > 7
 %global mpm event
 %else
 %global mpm prefork
 %endif
 
+%if 0%{?fedora} > 35 || 0%{?rhel} > 9
+%bcond_without pcre2
+%bcond_with pcre
+%else
+%bcond_with pcre2
+%bcond_without pcre
+%endif
+
+%if 0%{?fedora} > 40 || 0%{?rhel} > 9
+%bcond_with engine
+%else
+%bcond_without engine
+%endif
+
+# Similar issue to https://bugzilla.redhat.com/show_bug.cgi?id=2043092
+%undefine _package_note_flags
+
 Summary: Apache HTTP Server
 Name: httpd
-Version: 2.4.43
-Release: 7%{?dist}
+Version: 2.4.66
+Release: 1%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -52,6 +70,7 @@ Source31: README.confmod
 Source32: httpd.service.xml
 Source33: htcacheclean.service.xml
 Source34: httpd.conf.xml
+Source35: 00-brotli.conf
 Source40: htcacheclean.service
 Source41: htcacheclean.sysconf
 Source42: httpd-init.service
@@ -60,69 +79,96 @@ Source44: httpd@.service
 Source45: config.layout
 Source46: apachectl.sh
 Source47: apachectl.xml
+Source48: apache-poweredby.png
+Source49: httpd.sysusers
 
 # build/scripts patches
 Patch2: httpd-2.4.43-apxs.patch
 Patch3: httpd-2.4.43-deplibs.patch
 # Needed for socket activation and mod_systemd patch
-Patch19: httpd-2.4.43-detect-systemd.patch
+Patch19: httpd-2.4.53-detect-systemd.patch
 # Features/functional changes
-Patch21: httpd-2.4.43-r1842929+.patch
-Patch22: httpd-2.4.43-mod_systemd.patch
-Patch23: httpd-2.4.43-export.patch
-Patch24: httpd-2.4.43-corelimit.patch
-Patch25: httpd-2.4.43-selinux.patch
-Patch26: httpd-2.4.43-gettid.patch
-Patch27: httpd-2.4.43-icons.patch
-Patch30: httpd-2.4.43-cachehardmax.patch
-Patch31: httpd-2.4.43-sslmultiproxy.patch
-Patch34: httpd-2.4.43-socket-activation.patch
-Patch38: httpd-2.4.43-sslciphdefault.patch
-Patch39: httpd-2.4.43-sslprotdefault.patch
-Patch40: httpd-2.4.43-r1861269.patch
-Patch41: httpd-2.4.43-r1861793+.patch
-Patch42: httpd-2.4.43-r1828172+.patch
-Patch43: httpd-2.4.43-sslcoalesce.patch
-Patch44: httpd-2.4.43-lua-resume.patch
+Patch20: httpd-2.4.48-r1842929+.patch
+Patch21: httpd-2.4.64-mod_systemd.patch
+Patch22: httpd-2.4.53-export.patch
+Patch23: httpd-2.4.43-corelimit.patch
+Patch24: httpd-2.4.54-icons.patch
+Patch25: httpd-2.4.43-cachehardmax.patch
+Patch26: httpd-2.4.43-sslciphdefault.patch
+Patch27: httpd-2.4.64-sslprotdefault.patch
+Patch28: httpd-2.4.43-logjournal.patch
+Patch29: httpd-2.4.63-r1912477+.patch
+Patch30: httpd-2.4.64-separate-systemd-fns.patch
 
 # Bug fixes
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
 Patch60: httpd-2.4.43-enable-sslv3.patch
-Patch62: httpd-2.4.43-r1870095+.patch
-Patch63: httpd-2.4.43-r1876548.patch
+Patch61: httpd-2.4.65-hcheck-stuck.patch
 
 # Security fixes
+# Patch200: ...
+
+# Apache-2.0: everything
+# BSD-3-Clause: util_pcre.c, ap_regex.h
+# metamail AND HPND-sell-variant:: server/util_md5.c:
+# Spencer-94: modules/metadata/mod_mime_magic.c
+License: Apache-2.0 AND (BSD-3-Clause AND metamail AND HPND-sell-variant AND Spencer-94)
 
-License: ASL 2.0
 BuildRequires: gcc, autoconf, pkgconfig, findutils, xmlto
 BuildRequires: perl-interpreter, perl-generators, systemd-devel
 BuildRequires: zlib-devel, libselinux-devel, lua-devel, brotli-devel
-BuildRequires: apr-devel >= 1.5.0, apr-util-devel >= 1.5.0, pcre-devel >= 5.0
+BuildRequires: apr-devel >= 1.5.0, apr-util-devel >= 1.5.0
+BuildRequires: openldap-devel
+BuildRequires: systemd-rpm-macros
+BuildRequires: libxcrypt-devel
+%if %{with pcre2}
+BuildRequires: pcre2-devel
+%endif
+%if %{with pcre}
+BuildRequires: pcre-devel > 5.0
+%endif
 BuildRequires: gnupg2
-Requires: /etc/mime.types, system-logos-httpd
-Obsoletes: httpd-suexec
+Requires: system-logos(httpd-logo-ng)
 Provides: webserver
-Provides: mod_dav = %{version}-%{release}, httpd-suexec = %{version}-%{release}
-Provides: httpd-mmn = %{mmn}, httpd-mmn = %{mmnisa}
-Requires: httpd-tools = %{version}-%{release}
-Requires: httpd-filesystem = %{version}-%{release}
-Requires: mod_http2
-Requires(pre): httpd-filesystem
-Requires(preun): systemd-units
-Requires(postun): systemd-units
-Requires(post): systemd-units
-Conflicts: apr < 1.5.0-1
-Provides: mod_proxy_uwsgi = %{version}-%{release}
-Obsoletes: mod_proxy_uwsgi < 2.0.17.1-2
+Requires: httpd-core = 0:%{version}-%{release}
+Recommends: mod_http2, mod_lua
+%{?systemd_requires}
 
 %description
 The Apache HTTP Server is a powerful, efficient, and extensible
 web server.
 
+%package core
+Summary: httpd minimal core
+Provides: mod_dav = %{version}-%{release}, httpd-suexec = %{version}-%{release}
+Provides: httpd-mmn = %{mmn}, httpd-mmn = %{mmnisa}
+Provides: mod_proxy_uwsgi = %{version}-%{release}
+Requires: /etc/mime.types
+Requires: httpd-tools = %{version}-%{release}
+Requires: httpd-filesystem = %{version}-%{release}
+%if 0%{?fedora} > 39 || 0%{?rhel} > 9
+Requires: apr-util-1(dbm)%{_isa}
+%endif
+Requires(pre): httpd-filesystem
+Conflicts: apr < 1.5.0-1
+Conflicts: httpd < 2.4.53-2
+Obsoletes: mod_proxy_uwsgi < 2.0.17.1-2
+
+# Compat symlinks for Requires in other packages.
+%if "%{_sbindir}" == "%{_bindir}"
+# We rely on filesystem to create the symlink for us.
+Requires:           filesystem(unmerged-sbin-symlinks)
+Provides:           /usr/sbin/apachectl
+Provides:           /usr/sbin/httpd
+%endif
+
+%description core
+The httpd-core package contains essential httpd binaries.
+
 %package devel
 Summary: Development interfaces for the Apache HTTP Server
-Requires: apr-devel, apr-util-devel, pkgconfig
-Requires: httpd = %{version}-%{release}
+Requires: apr-devel, apr-util-devel, pkgconfig, libtool
+Requires: httpd-core = 0:%{version}-%{release}
 
 %description devel
 The httpd-devel package contains the APXS binary and other files
@@ -135,7 +181,7 @@ to install this package.
 
 %package manual
 Summary: Documentation for the Apache HTTP Server
-Requires: httpd = %{version}-%{release}
+Requires: httpd-core = 0:%{version}-%{release}
 BuildArch: noarch
 
 %description manual
@@ -146,7 +192,7 @@ also be found at https://httpd.apache.org/docs/2.4/.
 %package filesystem
 Summary: The basic directory layout for the Apache HTTP Server
 BuildArch: noarch
-Requires(pre): /usr/sbin/useradd
+%{?sysusers_requires_compat}
 
 %description filesystem
 The httpd-filesystem package contains the basic directory layout
@@ -165,20 +211,23 @@ Summary: SSL/TLS module for the Apache HTTP Server
 Epoch: 1
 BuildRequires: openssl-devel
 Requires(pre): httpd-filesystem
-Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa}
-Requires: sscg >= 2.2.0, /usr/bin/hostname
+Requires: httpd-core = 0:%{version}-%{release}, httpd-mmn = %{mmnisa}
+Requires: sscg >= 3.0.3, /usr/bin/hostname
 # Require an OpenSSL which supports PROFILE=SYSTEM
 Conflicts: openssl-libs < 1:1.0.1h-4
+# mod_ssl/mod_nss cannot both be loaded simultaneously
+Conflicts: mod_nss
 
 %description -n mod_ssl
-The mod_ssl module provides strong cryptography for the Apache Web
+The mod_ssl module provides strong cryptography for the Apache HTTP
 server via the Secure Sockets Layer (SSL) and Transport Layer
 Security (TLS) protocols.
 
 %package -n mod_proxy_html
 Summary: HTML and XML content filters for the Apache HTTP Server
-Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa}
+Requires: httpd-core = 0:%{version}-%{release}, httpd-mmn = %{mmnisa}
 BuildRequires: libxml2-devel
+BuildRequires: make
 Epoch: 1
 Obsoletes: mod_proxy_html < 1:2.4.1-2
 
@@ -188,7 +237,7 @@ transform and modify HTML and XML content.
 
 %package -n mod_ldap
 Summary: LDAP authentication modules for the Apache HTTP Server
-Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa}
+Requires: httpd-core = 0:%{version}-%{release}, httpd-mmn = %{mmnisa}
 Requires: apr-util-ldap
 
 %description -n mod_ldap
@@ -197,41 +246,23 @@ authentication to the Apache HTTP Server.
 
 %package -n mod_session
 Summary: Session interface for the Apache HTTP Server
-Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa}
+Requires: httpd-core = 0:%{version}-%{release}, httpd-mmn = %{mmnisa}
 
 %description -n mod_session
 The mod_session module and associated backends provide an abstract
 interface for storing and accessing per-user session data.
 
+%package -n mod_lua
+Summary: Lua scripting support for the Apache HTTP Server
+Requires: httpd-core = 0:%{version}-%{release}, httpd-mmn = %{mmnisa}
+
+%description -n mod_lua
+The mod_lua module allows the server to be extended with scripts
+written in the Lua programming language.
+
 %prep
 %{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}'
-%setup -q
-%patch2 -p1 -b .apxs
-%patch3 -p1 -b .deplibs
-
-%patch19 -p1 -b .detectsystemd
-
-%patch21 -p1 -b .r1842929+
-%patch22 -p1 -b .mod_systemd
-%patch23 -p1 -b .export
-%patch24 -p1 -b .corelimit
-%patch25 -p1 -b .selinux
-%patch26 -p1 -b .gettid
-%patch27 -p1 -b .icons
-%patch30 -p1 -b .cachehardmax
-#patch31 -p1 -b .sslmultiproxy
-%patch34 -p1 -b .socketactivation
-%patch38 -p1 -b .sslciphdefault
-%patch39 -p1 -b .sslprotdefault
-%patch40 -p1 -b .r1861269
-%patch41 -p1 -b .r1861793+
-%patch42 -p1 -b .r1828172+
-%patch43 -p1 -b .sslcoalesce
-%patch44 -p1 -b .luaresume
-
-%patch60 -p1 -b .enable-sslv3
-%patch62 -p1 -b .r1870095
-%patch63 -p1 -b .r1876548
+%autosetup -p1 -S gendiff
 
 # Patch in the vendor string
 sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h
@@ -239,6 +270,12 @@ sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h
 # Prevent use of setcap in "install-suexec-caps" target.
 sed -i '/suexec/s,setcap ,echo Skipping setcap for ,' Makefile.in
 
+%if %{without engine}
+: Forcibly disable ENGINE support in mod_ssl
+sed -i.engine '/^#define MODSSL_HAVE_ENGINE_API/{s/1/0/}' modules/ssl/ssl_private.h
+! diff -u modules/ssl/ssl_private.h{.engine,}
+%endif
+
 # Example conf for instances
 cp $RPM_SOURCE_DIR/instance.conf .
 sed < $RPM_SOURCE_DIR/httpd.conf >> instance.conf '
@@ -258,25 +295,26 @@ if test "x${vmmn}" != "x%{mmn}"; then
    exit 1
 fi
 
+# A new logo which comes together with a new test page
+cp %{SOURCE48} ./docs/icons/apache_pb3.png
+
 # Provide default layout
 cp $RPM_SOURCE_DIR/config.layout .
 
-sed '
+for f in httpd.conf htcacheclean.service httpd.service apachectl; do
+   sed '
 s,@MPM@,%{mpm},g
 s,@DOCROOT@,%{docroot},g
 s,@LOGDIR@,%{_localstatedir}/log/httpd,g
-' < $RPM_SOURCE_DIR/httpd.conf.xml \
-    > httpd.conf.xml
-
-xmlto man ./httpd.conf.xml
-xmlto man $RPM_SOURCE_DIR/htcacheclean.service.xml
-xmlto man $RPM_SOURCE_DIR/httpd.service.xml
-
-# apachectl.xml => apachectl.8
-xmlto man %{SOURCE47}
+s|@BUG_REPORT_URL@|%{bugurl}|g
+' < $RPM_SOURCE_DIR/${f}.xml > ${f}.xml
+   xmlto man ${f}.xml
+done
 
 : Building with MMN %{mmn}, MMN-ISA %{mmnisa}
 : Default MPM is %{mpm}, vendor string is '%{vstring}'
+: Regex Engine: PCRE=%{with pcre} PCRE2=%{with pcre2}
+: mod_ssl ENGINE support: %{with engine}
 
 %build
 # forcibly prevent use of bundled apr, apr-util, pcre
@@ -289,11 +327,7 @@ autoheader && autoconf || exit 1
 %{__perl} -pi -e "s:\@exp_installbuilddir\@:%{_libdir}/httpd/build:g" \
         support/apxs.in
 
-export CFLAGS=$RPM_OPT_FLAGS
-export LDFLAGS="-Wl,-z,relro,-z,now"
-
-# Hard-code path to links to avoid unnecessary builddep
-export LYNX_PATH=/usr/bin/links
+%set_build_flags
 
 # Build the daemon
 ./configure \
@@ -321,14 +355,19 @@ export LYNX_PATH=/usr/bin/links
         --with-suexec-uidmin=1000 --with-suexec-gidmin=1000 \
         --with-brotli \
         --enable-pie \
-        --with-pcre \
+%if %{with pcre2}
+        --with-pcre2=%{_bindir}/pcre2-config \
+%endif
+%if %{with pcre}
+        --with-pcre=%{_bindir}/pcre-config \
+%endif
         --enable-mods-shared=all \
         --enable-ssl --with-ssl --disable-distcache \
         --enable-proxy --enable-proxy-fdpass \
         --enable-cache \
         --enable-disk-cache \
         --enable-ldap --enable-authnz-ldap \
-        --enable-cgid --enable-cgi \
+        --enable-cgid --enable-cgi --enable-authnz-fcgi \
         --enable-cgid-fdpassing \
         --enable-authn-anon --enable-authn-alias \
         --enable-systemd \
@@ -336,12 +375,19 @@ export LYNX_PATH=/usr/bin/links
         --disable-http2 \
         --disable-md \
         $*
-make %{?_smp_mflags}
+
+if grep -q ac_cv_have_threadsafe_pollset=no config.log; then
+   cat config.log
+   : Failed to find thread-safe APR.
+   exit 1
+fi
+
+%make_build
 
 %install
 rm -rf $RPM_BUILD_ROOT
 
-make DESTDIR=$RPM_BUILD_ROOT install
+%make_install
 
 # Install systemd service files
 mkdir -p $RPM_BUILD_ROOT%{_unitdir}
@@ -360,7 +406,8 @@ install -m 644 $RPM_SOURCE_DIR/README.confmod \
     $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf.modules.d/README
 for f in 00-base.conf 00-mpm.conf 00-lua.conf 01-cgi.conf 00-dav.conf \
          00-proxy.conf 00-ssl.conf 01-ldap.conf 00-proxyhtml.conf \
-         01-ldap.conf 00-systemd.conf 01-session.conf 00-optional.conf; do
+         01-ldap.conf 00-systemd.conf 01-session.conf 00-optional.conf \
+         00-brotli.conf; do
   install -m 644 -p $RPM_SOURCE_DIR/$f \
         $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf.modules.d/$f
 done
@@ -373,8 +420,9 @@ touch -r $RPM_SOURCE_DIR/00-mpm.conf \
 # install systemd override drop directory
 # Web application packages can drop snippets into this location if
 # they need ExecStart[pre|post].
-mkdir $RPM_BUILD_ROOT%{_unitdir}/httpd.service.d
-mkdir $RPM_BUILD_ROOT%{_unitdir}/httpd.socket.d
+mkdir $RPM_BUILD_ROOT%{_unitdir}/httpd.service.d \
+      $RPM_BUILD_ROOT%{_unitdir}/httpd.socket.d
+mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/systemd/system/httpd.service.d
 
 install -m 644 -p $RPM_SOURCE_DIR/10-listen443.conf \
       $RPM_BUILD_ROOT%{_unitdir}/httpd.socket.d/10-listen443.conf
@@ -433,17 +481,19 @@ echo %{mmnisa} > $RPM_BUILD_ROOT%{_includedir}/httpd/.mmn
 mkdir -p $RPM_BUILD_ROOT%{_rpmconfigdir}/macros.d
 cat > $RPM_BUILD_ROOT%{_rpmconfigdir}/macros.d/macros.httpd <<EOF
 %%_httpd_mmn %{mmnisa}
-%%_httpd_apxs %%{_bindir}/apxs
+%%_httpd_apxs %%{_libdir}/httpd/build/vendor-apxs
 %%_httpd_modconfdir %%{_sysconfdir}/httpd/conf.modules.d
 %%_httpd_confdir %%{_sysconfdir}/httpd/conf.d
 %%_httpd_contentdir %{contentdir}
 %%_httpd_moddir %%{_libdir}/httpd/modules
+%%_httpd_requires Requires: httpd-mmn = %%{_httpd_mmn}
+%%_httpd_statedir %%{_localstatedir}/lib/httpd
 EOF
 
 # Handle contentdir
 mkdir $RPM_BUILD_ROOT%{contentdir}/noindex \
       $RPM_BUILD_ROOT%{contentdir}/server-status
-ln -s ../../fedora-testpage/index.html \
+ln -s ../../testpage/index.html \
       $RPM_BUILD_ROOT%{contentdir}/noindex/index.html
 install -m 644 -p docs/server-status/* \
         $RPM_BUILD_ROOT%{contentdir}/server-status
@@ -472,6 +522,12 @@ rm -v $RPM_BUILD_ROOT%{docroot}/html/*.html \
 ln -s ../../pixmaps/poweredby.png \
         $RPM_BUILD_ROOT%{contentdir}/icons/poweredby.png
 
+# Symlink for the system logo
+%if 0%{?rhel} >= 9
+ln -s ../../pixmaps/system-noindex-logo.png \
+        $RPM_BUILD_ROOT%{contentdir}/icons/system_noindex_logo.png
+%endif
+
 # symlinks for /etc/httpd
 rmdir $RPM_BUILD_ROOT/etc/httpd/{state,run}
 ln -s ../..%{_localstatedir}/log/httpd $RPM_BUILD_ROOT/etc/httpd/logs
@@ -528,6 +584,29 @@ sed -i '/.*DEFAULT_..._LIBEXECDIR/d;/DEFAULT_..._INSTALLBUILDDIR/d' \
 sed -i '/instdso/s,top_srcdir,top_builddir,' \
     $RPM_BUILD_ROOT%{_libdir}/httpd/build/special.mk
 
+# vendor-apxs uses an unsanitized config_vars.mk which may
+# have dependencies on redhat-rpm-config.  apxs uses the
+# config_vars.mk with a sanitized config_vars.mk
+cp -p $RPM_BUILD_ROOT%{_libdir}/httpd/build/config_vars.mk \
+      $RPM_BUILD_ROOT%{_libdir}/httpd/build/vendor_config_vars.mk
+
+# Sanitize CFLAGS & LIBTOOL in standard config_vars.mk
+sed -e '/^[A-Z]*FLAGS = /s,-specs[^ ]*,,g' \
+    -e '/^LIBTOOL/s,/.*/libtool,%{_bindir}/libtool,' \
+    -i $RPM_BUILD_ROOT%{_libdir}/httpd/build/config_vars.mk
+diff -u $RPM_BUILD_ROOT%{_libdir}/httpd/build/vendor_config_vars.mk \
+     $RPM_BUILD_ROOT%{_libdir}/httpd/build/config_vars.mk || true
+
+sed 's/config_vars.mk/vendor_config_vars.mk/' \
+    $RPM_BUILD_ROOT%{_bindir}/apxs \
+    > $RPM_BUILD_ROOT%{_libdir}/httpd/build/vendor-apxs
+touch -r $RPM_BUILD_ROOT%{_bindir}/apxs \
+      $RPM_BUILD_ROOT%{_libdir}/httpd/build/vendor-apxs
+chmod 755 $RPM_BUILD_ROOT%{_libdir}/httpd/build/vendor-apxs
+
+# Fix content dir in sysusers file and install it
+install -p -D -m 0644 %{SOURCE49} %{buildroot}%{_sysusersdir}/httpd.conf
+
 # Remove unpackaged files
 rm -vf \
       $RPM_BUILD_ROOT%{_libdir}/*.exp \
@@ -543,11 +622,7 @@ rm -vf \
 rm -rf $RPM_BUILD_ROOT/etc/httpd/conf/{original,extra}
 
 %pre filesystem
-getent group apache >/dev/null || groupadd -g 48 -r apache
-getent passwd apache >/dev/null || \
-  useradd -r -u 48 -g apache -s /sbin/nologin \
-    -d %{contentdir} -c "Apache" apache
-exit 0
+%sysusers_create_compat %{SOURCE49}
 
 %post
 %systemd_post httpd.service htcacheclean.service httpd.socket
@@ -558,17 +633,6 @@ exit 0
 %postun
 %systemd_postun httpd.service htcacheclean.service httpd.socket
 
-# Trigger for conversion from SysV, per guidelines at:
-# https://fedoraproject.org/wiki/Packaging:ScriptletSnippets#Systemd
-%triggerun -- httpd < 2.2.21-5
-# Save the current service runlevel info
-# User must manually run systemd-sysv-convert --apply httpd
-# to migrate them to systemd targets
-/usr/bin/systemd-sysv-convert --save httpd.service >/dev/null 2>&1 ||:
-
-# Run these because the SysV package being removed won't do them
-/sbin/chkconfig --del httpd >/dev/null 2>&1 || :
-
 %posttrans
 test -f /etc/sysconfig/httpd-disable-posttrans || \
   /bin/systemctl try-restart --no-block httpd.service htcacheclean.service >/dev/null 2>&1 || :
@@ -621,7 +685,21 @@ set -x
 exit $rv
 
 %files
+%{_mandir}/man8/*
+%{_mandir}/man5/*
+%exclude %{_mandir}/man8/httpd-init.*
 
+%config(noreplace) %{_sysconfdir}/httpd/conf.modules.d/00-brotli.conf
+%config(noreplace) %{_sysconfdir}/httpd/conf.modules.d/00-systemd.conf
+%{_libdir}/httpd/modules/mod_brotli.so
+%{_libdir}/httpd/modules/mod_systemd.so
+
+%{_unitdir}/httpd.service
+%{_unitdir}/httpd@.service
+%{_unitdir}/htcacheclean.service
+%{_unitdir}/*.socket
+
+%files core
 %doc ABOUT_APACHE README CHANGES LICENSE VERSIONING NOTICE
 %doc docs/conf/extra/*.conf
 %doc instance.conf server-status.conf
@@ -631,6 +709,7 @@ exit $rv
 %{_sysconfdir}/httpd/state
 %{_sysconfdir}/httpd/run
 %dir %{_sysconfdir}/httpd/conf
+
 %config(noreplace) %{_sysconfdir}/httpd/conf/httpd.conf
 %config(noreplace) %{_sysconfdir}/httpd/conf/magic
 
@@ -642,9 +721,13 @@ exit $rv
 
 %dir %{_sysconfdir}/httpd/conf.modules.d
 %{_sysconfdir}/httpd/conf.modules.d/README
+
 %config(noreplace) %{_sysconfdir}/httpd/conf.modules.d/*.conf
+%exclude %{_sysconfdir}/httpd/conf.modules.d/00-brotli.conf
+%exclude %{_sysconfdir}/httpd/conf.modules.d/00-systemd.conf
 %exclude %{_sysconfdir}/httpd/conf.modules.d/00-ssl.conf
 %exclude %{_sysconfdir}/httpd/conf.modules.d/00-proxyhtml.conf
+%exclude %{_sysconfdir}/httpd/conf.modules.d/00-lua.conf
 %exclude %{_sysconfdir}/httpd/conf.modules.d/01-ldap.conf
 %exclude %{_sysconfdir}/httpd/conf.modules.d/01-session.conf
 
@@ -654,7 +737,8 @@ exit $rv
 %dir %{_libexecdir}/initscripts/legacy-actions/httpd
 %{_libexecdir}/initscripts/legacy-actions/httpd/*
 
-%{_sbindir}/ht*
+%{_sbindir}/httpd
+%{_sbindir}/htcacheclean
 %{_sbindir}/fcgistarter
 %{_sbindir}/apachectl
 %{_sbindir}/rotatelogs
@@ -663,12 +747,15 @@ exit $rv
 %dir %{_libdir}/httpd
 %dir %{_libdir}/httpd/modules
 %{_libdir}/httpd/modules/mod*.so
+%exclude %{_libdir}/httpd/modules/mod_brotli.so
+%exclude %{_libdir}/httpd/modules/mod_systemd.so
 %exclude %{_libdir}/httpd/modules/mod_auth_form.so
 %exclude %{_libdir}/httpd/modules/mod_ssl.so
 %exclude %{_libdir}/httpd/modules/mod_*ldap.so
 %exclude %{_libdir}/httpd/modules/mod_proxy_html.so
 %exclude %{_libdir}/httpd/modules/mod_xml2enc.so
 %exclude %{_libdir}/httpd/modules/mod_session*.so
+%exclude %{_libdir}/httpd/modules/mod_lua.so
 
 %dir %{contentdir}/error
 %dir %{contentdir}/error/include
@@ -688,14 +775,6 @@ exit $rv
 %attr(0700,apache,apache) %dir %{_localstatedir}/cache/httpd
 %attr(0700,apache,apache) %dir %{_localstatedir}/cache/httpd/proxy
 
-%{_mandir}/man8/*
-%{_mandir}/man5/*
-%exclude %{_mandir}/man8/httpd-init.*
-
-%{_unitdir}/httpd.service
-%{_unitdir}/httpd@.service
-%{_unitdir}/htcacheclean.service
-%{_unitdir}/*.socket
 
 %files filesystem
 %dir %{_sysconfdir}/httpd
@@ -708,9 +787,16 @@ exit $rv
 %dir %{contentdir}/icons
 %attr(755,root,root) %dir %{_unitdir}/httpd.service.d
 %attr(755,root,root) %dir %{_unitdir}/httpd.socket.d
+%attr(755,root,root) %dir %{_sysconfdir}/systemd/system/httpd.service.d
+%{_sysusersdir}/httpd.conf
 
 %files tools
-%{_bindir}/*
+%{_bindir}/ab
+%{_bindir}/htdbm
+%{_bindir}/htdigest
+%{_bindir}/httxt2dbm
+%{_bindir}/htpasswd
+%{_bindir}/logresolve
 %{_mandir}/man1/*
 %doc LICENSE NOTICE
 %exclude %{_bindir}/apxs
@@ -745,6 +831,10 @@ exit $rv
 %{_libdir}/httpd/modules/mod_auth_form.so
 %config(noreplace) %{_sysconfdir}/httpd/conf.modules.d/01-session.conf
 
+%files -n mod_lua
+%{_libdir}/httpd/modules/mod_lua.so
+%config(noreplace) %{_sysconfdir}/httpd/conf.modules.d/00-lua.conf
+
 %files devel
 %{_includedir}/httpd
 %{_bindir}/apxs
@@ -752,9 +842,302 @@ exit $rv
 %dir %{_libdir}/httpd/build
 %{_libdir}/httpd/build/*.mk
 %{_libdir}/httpd/build/*.sh
+%{_libdir}/httpd/build/vendor-apxs
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Tue Dec 09 2025 Luboš Uhliarik <luhliari@redhat.com> - 2.4.66-1
+- new version 2.4.66
+
+* Thu Nov 27 2025 Luboš Uhliarik <luhliari@redhat.com> - 2.4.65-5
+- Improve default httpd LogFormats for better support diagnostics
+
+* Wed Nov 12 2025 Luboš Uhliarik <luhliari@redhat.com> - 2.4.65-3
+- mod_ssl: SSLVHostSNIPolicy - Fix handling of STRICT mode
+
+* Tue Nov 04 2025 Luboš Uhliarik <luhliari@redhat.com> - 2.4.65-2
+- mod_ssl: Add SSLVHostSNIPolicy directive to set the compatibility level
+  required for VirtualHost matching.
+
+* Sat Oct 18 2025 Luboš Uhliarik <luhliari@redhat.com> - 2.4.65-1
+- new version 2.4.65
+- mod_proxy_hcheck: reschedule health checks after child process restart
+
+* Mon Sep 08 2025 Luboš Uhliarik <luhliari@redhat.com> - 2.4.64-4
+- Add tmpfiles.d rules for /var directories (bootc compatibility)
+
+* Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.64-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
+
+* Thu Jul 17 2025 Luboš Uhliarik <luhliari@redhat.com> - 2.4.64-2
+- Fix RewriteRule with inverted pattern and RewriteCond regression
+
+* Fri Jul 11 2025 Luboš Uhliarik <luhliari@redhat.com> - 2.4.64-1
+- new version 2.4.64
+
+* Tue Jun 24 2025 Joe Orton  <jorton@redhat.com> - 2.4.63-4
+- mod_dav: add dav_get_base_path() API
+
+* Mon Feb 10 2025 Joe Orton <jorton@redhat.com> - 2.4.63-3
+- sync default httpd.conf with upstream
+
+* Sat Feb 01 2025 Björn Esser <besser82@fedoraproject.org> - 2.4.63-2
+- Add explicit BR: libxcrypt-devel
+
+* Fri Jan 24 2025 Luboš Uhliarik <luhliari@redhat.com> - 2.4.63-1
+- new version 2.4.63
+
+* Fri Jan 17 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.62-6
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
+
+* Sun Jan 12 2025 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 2.4.62-5
+- Rebuilt for the bin-sbin merge (2nd attempt)
+
+* Fri Oct 11 2024 Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-4
+- mod_rewrite: regression fixes
+
+* Thu Aug 01 2024 Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-3
+- Fix regression introduced by CVE-2024-38474 fix
+- added openldap-devel build dependency
+
+* Fri Jul 19 2024 Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-1
+- new version 2.4.62
+
+* Thu Jul 18 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.61-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
+
+* Tue Jul 09 2024 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 2.4.61-2
+- Rebuilt for the bin-sbin merge
+
+* Wed Jul 03 2024 Luboš Uhliarik <luhliari@redhat.com> - 2.4.61-1
+- new version 2.4.61
+
+* Thu May 23 2024 Joe Orton <jorton@redhat.com> - 2.4.59-4
+- mod_ssl: add engine bcond, disable ENGINE support by default for F41+
+- mod_ssl: enable SSL_OP_NO_RENEGOTIATION (upstream PR#426)
+
+* Fri May  3 2024 Joe Orton <jorton@redhat.com> - 2.4.59-3
+- apachectl(8): use BUG_REPORT_URL from /etc/os-release
+- apachectl(8): fix grammar (#2278748)
+- httpd.service.xml(8): mention ProtectSystem= setting
+
+* Mon Apr 15 2024 Joe Orton <jorton@redhat.com> - 2.4.59-2
+- mod_ssl: add DH param handling fix (r1916863)
+
+* Fri Apr  5 2024 Joe Orton <jorton@redhat.com> - 2.4.59-1
+- update to 2.4.59
+
+* Thu Mar 28 2024 Joe Orton <jorton@redhat.com> - 2.4.58-8
+- rebuild to fix changelog ordering
+
+* Thu Mar 7 2024 Rahul Sundaram <sundaram@fedoraproject.org> - 2.4.58-7
+- Update Systemd security settings as part of https://fedoraproject.org/wiki/Changes/SystemdSecurityHardening
+- updated httpd.service(5) (Joe Orton)
+
+* Wed Jan 24 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.58-6
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Sat Jan 20 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.58-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Fri Jan  5 2024 Joe Orton <jorton@redhat.com> - 2.4.58-4
+- fix OpenSSL 3.0 deprecation warnings (r1913912, r1915067)
+- mod_ssl: move to provider API for pkcs11 support (#2253014)
+
+* Fri Dec  8 2023 Joe Orton <jorton@redhat.com> - 2.4.58-3
+- mod_dav_fs: add DAVLockDBType, use global lock around lockdb
+- fix build with libxml2 2.12
+
+* Thu Nov  2 2023 Joe Orton <jorton@redhat.com> - 2.4.58-2
+- add dependency on apr-util-1(dbm) so a DBM provider is present
+
+* Fri Oct 20 2023 Luboš Uhliarik <luhliari@redhat.com> - 2.4.58-1
+- new version 2.4.58
+
+* Fri Oct 06 2023 Luboš Uhliarik <luhliari@redhat.com> - 2.4.57-4
+- SPDX migration
+
+* Thu Jul 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.57-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
+
+* Wed Jul  5 2023 Joe Orton <jorton@redhat.com> - 2.4.57-2
+- package /etc/systemd/httpd/httpd.service.d
+- also sanitize LDFLAGS/CXXFLAGS in non-vendor config_vars.mk
+
+* Tue Apr 11 2023 Luboš Uhliarik <luhliari@redhat.com> - 2.4.57-1
+- new version 2.4.57
+
+* Thu Mar 09 2023 Luboš Uhliarik <luhliari@redhat.com> - 2.4.56-1
+- new version 2.4.56
+
+* Tue Mar  7 2023 Joe Orton <jorton@redhat.com> - 2.4.55-3
+- build and load mod_authnz_fcgi
+
+* Fri Feb 03 2023 Luboš Uhliarik <luhliari@redhat.com> - 2.4.55-2
+- rebuilt with new apr/apr-util
+
+* Wed Jan 25 2023 Luboš Uhliarik <luhliari@redhat.com> - 2.4.55-1
+- new version 2.4.55
+
+* Tue Jan 24 2023 Luboš Uhliarik <luhliari@redhat.com> - 2.4.54-12
+- prevent sscg writing /dhparams.pem
+
+* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.54-11
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
+
+* Tue Dec 20 2022 Joe Orton <jorton@redhat.com> - 2.4.54-10
+- htcacheclean.service: add [Install] section, PrivateTmp=yes,
+  Environment=LANG=C (#2149714)
+
+* Mon Dec 19 2022 Joe Orton <jorton@redhat.com> - 2.4.54-9
+- move SELinux context logging to mod_systemd
+
+* Mon Dec 19 2022 Joe Orton <jorton@redhat.com> - 2.4.54-8
+- define _httpd_statedir macro
+
+* Wed Nov 30 2022 Luboš Uhliarik <luhliari@redhat.com> - 2.4.54-7
+- reduce AH03408 level to INFO in proxy_util.c
+
+* Thu Oct 13 2022 Luboš Uhliarik <luhliari@redhat.com> - 2.4.54-6
+- Provide a sysusers.d file to get user() and group() provides (#2134430)
+
+* Thu Jul 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.54-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
+
+* Fri Jun 24 2022 Luboš Uhliarik <luhliari@redhat.com> - 2.4.54-4
+- fix downgrade/upgrade issues
+- mod_ssl and other modules should depend only on httpd-core package
+
+* Fri Jun 17 2022 Joe Orton <jorton@redhat.com> - 2.4.54-3
+- update PCRE config selection
+
+* Thu Jun 09 2022 Luboš Uhliarik <luhliari@redhat.com> - 2.4.54-2
+- new version 2.4.54
+
+* Mon May 16 2022 Joe Orton <jorton@redhat.com> - 2.4.53-7
+- disable package notes
+
+* Fri May 13 2022 Joe Orton <jorton@redhat.com> - 2.4.53-6
+- use %%set_build_flags macro
+
+* Thu Apr 21 2022 Luboš Uhliarik <luhliari@redhat.com> - 2.4.53-5
+- don't use bomb.gif icon for all files/dirs ending with core
+
+* Wed Apr 20 2022 Joe Orton <jorton@redhat.com> - 2.4.53-4
+- switch to PCRE2 for new releases
+
+* Thu Apr 07 2022 Luboš Uhliarik <luhliari@redhat.com> - 2.4.53-3
+- Related: #2070517 - fix issue when mod_systemd is not loaded
+
+* Wed Mar 30 2022 Luboš Uhliarik <luhliari@redhat.com> - 2.4.53-2
+- Resolves: #2070517 - Allow install httpd with smaller footprint
+- try to minimize httpd dependencies (new httpd-core package)
+- mod_systemd and mod_brotli are now in the main httpd package
+
+* Thu Mar 17 2022 Luboš Uhliarik <luhliari@redhat.com> - 2.4.53-1
+- new version 2.4.53
+- fixes CVE-2022-23943, CVE-2022-22721, CVE-2022-22720 and CVE-2022-22719
+
+* Tue Feb  1 2022 Joe Orton <jorton@redhat.com> - 2.4.52-5
+- rebuild for new OpenLDAP (#2032699)
+
+* Mon Jan 31 2022 Joe Orton <jorton@redhat.com> - 2.4.52-4
+- add libtool to Requires: for httpd-devel (#2048281)
+
+* Fri Jan 28 2022 Joe Orton <jorton@redhat.com> - 2.4.52-3
+- use LIBTOOL=/usr/bin/libtool in the non-vendor config_vars.mk
+
+* Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.52-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
+
+* Wed Dec 22 2021 Joe Orton <jorton@redhat.com> - 2.4.52-1
+- update to 2.4.52
+
+* Mon Dec 06 2021 Neal Gompa <ngompa@fedoraproject.org> - 2.4.51-3
+- Use NAME from os-release(5) for vendor string
+  Related: #2029071 - httpd on CentOS identifies as RHEL
+
+* Tue Oct 12 2021 Joe Orton <jorton@redhat.com> - 2.4.51-2
+- mod_ssl: updated patch for OpenSSL 3.0 compatibility (#2007178)
+- mod_deflate/core: add two brigade handling correctness fixes
+
+* Thu Oct 07 2021 Patrick Uiterwijk <patrick@puiterwijk.org> - 2.4.51-1
+- new version 2.4.51
+
+* Tue Oct 05 2021 Luboš Uhliarik <luhliari@redhat.com> - 2.4.50-1
+- new version 2.4.50
+
+* Wed Sep 22 2021 Luboš Uhliarik <luhliari@redhat.com> - 2.4.49-3
+- Rebuilt for CI testing
+
+* Thu Sep 16 2021 Luboš Uhliarik <luhliari@redhat.com> - 2.4.49-1
+- new version 2.4.49 (#2004776)
+
+* Tue Sep 14 2021 Sahana Prasad <sahana@redhat.com> - 2.4.48-8
+- Rebuilt with OpenSSL 3.0.0
+
+* Fri Aug 06 2021 Luboš Uhliarik <luhliari@redhat.com> - 2.4.48-7
+- add symlink to system logo for noindex test page
+
+* Fri Aug  6 2021 Joe Orton <jorton@redhat.com> - 2.4.48-4
+- add OpenSSL 3.x compatibility patch
+
+* Thu Jul 22 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.48-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
+
+* Fri Jul 16 2021 Joe Orton <jorton@redhat.com> - 2.4.48-2
+- mod_cgi/mod_cgid: update to unification from trunk
+- httpd.conf: add note on care with Listen and starting at boot
+
+* Wed Jun 02 2021 Luboš Uhliarik <luhliari@redhat.com> - 2.4.48-1
+- new version 2.4.48
+- Resolves: #1964746 - httpd-2.4.48 is available
+
+* Mon May 03 2021 Lubos Uhliarik <luhliari@redhat.com> - 2.4.46-13
+- Related: #1934739 - Apache trademark update - new logo
+
+* Fri Apr  9 2021 Joe Orton <jorton@redhat.com> - 2.4.46-12
+- use OOMPolicy=continue in httpd.service, httpd@.service (#1947475)
+
+* Wed Mar 31 2021 Lubos Uhliarik <luhliari@redhat.com> - 2.4.46-11
+- Resolves: #1934739 - Apache trademark update - new logo
+
+* Tue Feb 23 2021 Joe Orton <jorton@redhat.com> - 2.4.46-10
+- add Conflicts: with mod_nss
+- drop use of apr_ldap_rebind (r1878890, #1847585)
+
+* Mon Feb 01 2021 Lubos Uhliarik <luhliari@redhat.com> - 2.4.46-9
+- Resolves: #1914182 - RFE: CustomLog should be able to use journald
+
+* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.46-8
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
+
+* Wed Jan 20 2021 Artem Egorenkov <aegorenk@redhat.com> - 2.4.46-7
+- prevent htcacheclean from while break when first file processed
+
+* Thu Dec 17 2020 Joe Orton <jorton@redhat.com> - 2.4.46-6
+- move mod_lua to a subpackage
+- Recommends: both mod_lua and mod_http2
+
+* Fri Nov  6 2020 Joe Orton <jorton@redhat.com> - 2.4.46-5
+- add %%_httpd_requires to macros
+
+* Thu Aug 27 2020 Joe Orton <jorton@redhat.com> - 2.4.46-4
+- use make macros (Tom Stellard)
+
+* Thu Aug 27 2020 Joe Orton <jorton@redhat.com> - 2.4.46-3
+- strip /usr/bin/apxs CFLAGS further
+
+* Thu Aug 27 2020 Joe Orton <jorton@redhat.com> - 2.4.46-2
+- sanitize CFLAGS used by /usr/bin/apxs by default (#1873020)
+- add $libdir/httpd/build/vendor-apxs which exposes full CFLAGS
+- redefine _httpd_apxs RPM macro to use vendor-apxs
+
+* Tue Aug 25 2020 Lubos Uhliarik <luhliari@redhat.com> - 2.4.46-1
+- new version 2.4.46
+- remove obsolete parts of this spec file
+- fix systemd detection patch
+
 * Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.43-7
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
 

httpd.sysusers

@@ -0,0 +1,2 @@
+g apache 48
+u apache 48 "Apache" /usr/share/httpd /sbin/nologin

httpd.tmpfiles

@@ -1,2 +1,9 @@
 d /run/httpd   710 root apache
 d /run/httpd/htcacheclean   700 apache apache
+d /var/log/httpd 700 root root -
+d /var/www       755 root root -
+d /var/www/html  755 root root -
+d /var/www/cgi-bin 755 root root -
+d /var/lib/httpd 700 apache apache -
+d /var/cache/httpd 700 apache apache -
+d /var/cache/httpd/proxy 700 apache apache -

httpd@.service

@@ -19,7 +19,25 @@ ExecReload=/usr/sbin/httpd $OPTIONS -k graceful -f conf/%i.conf
 # Send SIGWINCH for graceful stop
 KillSignal=SIGWINCH
 KillMode=mixed
+DevicePolicy=closed
+KeyringMode=private
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+OOMPolicy=continue
+PrivateDevices=yes
 PrivateTmp=true
+ProtectClock=yes
+ProtectControlGroups=yes
+ProtectHome=read-only
+ProtectHostname=yes
+ProtectKernelLogs=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+ProtectSystem=yes
+RestrictNamespaces=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+SystemCallArchitectures=native
 
 [Install]
 WantedBy=multi-user.target

plans/all.fmf

@@ -0,0 +1,6 @@
+summary: Test plan with all beakerlib tests
+discover:
+    how: fmf
+    url: https://src.fedoraproject.org/tests/httpd.git
+execute:
+    how: tmt

plans/tier1-public.fmf

@@ -0,0 +1,7 @@
+summary: Public (Fedora) Tier1 beakerlib tests
+discover:
+    how: fmf
+    url: https://src.fedoraproject.org/tests/httpd.git
+    filter: 'tier: 1'
+execute:
+    how: tmt

pullrev.sh

@@ -6,8 +6,8 @@ if [ $# -lt 1 ]; then
 fi
 
 repo="https://svn.apache.org/repos/asf/httpd/httpd/trunk"
-#repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x"
-ver=2.4.43
+repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x"
+ver=$(rpm -q --specfile httpd.spec --qf '%{VERSION}\n' | sed 1q)
 prefix="httpd-${ver}"
 suffix="${SUFFIX:-r$1${2:++}}"
 fn="${prefix}-${suffix}.patch"
@@ -43,7 +43,9 @@ for r in $*; do
         http*) curl -s "$r" | filterdiff --strip=3 ;;
         *) svn diff -c ${r} ${repo}  ;;
     esac | filterdiff --remove-timestamps --clean \
-                      -x 'CHANGES' -x '*/next-number' -x 'STATUS' -x '*.xml' \
+                      -x 'CHANGES' -x 'changes-entries/*.txt' \
+                      -x '*/next-number' -x 'STATUS' -x '*.xml' \
+                      -x '.github/*' \
                       --addprefix="${prefix}/" > ${this}
     next=`mktemp /tmp/pullrevXXXXXX`
     if ! combinediff -w ${prev} ${this} > ${next}; then
@@ -62,4 +64,3 @@ echo "+ git add ${fn}"
 git add "${fn}"
 echo "+ spec template:"
 echo "PatchN: ${fn}"
-echo "%patchN -p1 -b .${suffix}"

rpminspect.yaml

@@ -0,0 +1,22 @@
+---
+badfuncs:
+  # mod_proxy uses inet_ntoa (safely) for IPv4 address matching,
+  # and APR interfaces for IPv6 addresses.
+  allowed:
+    /usr/lib*/httpd/modules/mod_proxy.so:
+      - inet_ntoa
+upstream:
+  ignore:
+    - '*.xml'
+    - '*.service'
+    - '*.socket'
+    - '*.conf'
+    - '*.sysconf'
+    - '*.tmpfiles'
+    - 'README.*'
+    - '*.sysusers'
+    - '*.png'
+    - 'httpd-ssl-*'
+    - config.layout
+    - 'action*.sh'
+    - 'apachectl.*'

sources

@@ -1,3 +1,3 @@
-SHA512 (httpd-2.4.43.tar.bz2) = 16cfeecc8f6fab6eca478065a384bdf1872f7ac42206b0bc2bcac6c0d9c576f392c07107201f39e0601dec1bbafcb33d66153544de4d87d79b9a52094d334b64
-SHA512 (httpd-2.4.43.tar.bz2.asc) = 7a1a12d6f58d8235dcf8b23bae3960e99dc99764928752f870f32e654aa5e3cf78a38fb14f3cb84c5a8ab9b05095beec4739a50c6efcf22e3ecbdf0255ac783d
-SHA512 (KEYS) = b776ca20863f8d9e4f66e8b56cbe020de34af5b268e93776d482392171f0e0aeee4f8d74477d128dc9fd24b30bbe33b39439964f1bd22a99782f1e4a08c85056
+SHA512 (httpd-2.4.66.tar.bz2) = 49031a3465d956ee3b755e65810b6c35561ddd5fac2c624a273b733c238e115b914cd7b246837e5a3090ccfded6e0b8b3059bfd1f8ce4419081c805a38d05a4b
+SHA512 (httpd-2.4.66.tar.bz2.asc) = 3fc7a4c6c0705adc3f8223ed3d6ebc45f09b7a19ab63a8b4d359835d2b592cf11f0fd0438a40b5a43c0684b36602484bb908bf46b0c068dd22bacc2c194e7fbd
+SHA512 (KEYS) = 88c848b7ab9e4915d6625dcad3e8328673b0448f2ce76f2c44eecc612cf6afbce3287a4ee7219a44c6fcc61d5ecb2a1a8545456a4a16b90400263d7249cbf192

tests/httpd-php-mysql-sanity-test/PURPOSE

@@ -1,3 +0,0 @@
-PURPOSE of /CoreOS/httpd/Sanity/httpd-php-mysql-sanity-test
-Description: test fetching data from mysqldb/mariadb through php
-Author: Karel Srot <ksrot@redhat.com>

tests/httpd-php-mysql-sanity-test/new_mysql.php

@@ -1,12 +0,0 @@
-<?php
-$db = mysqli_connect("localhost", "root");
-if (!$db) {
-    die("Could not connect");
-}
-if (!mysqli_select_db($db, "php_mysql_test")) {
-    die("Could not select database");
-}
-$res = mysqli_query($db, "SELECT * from foobar");
-$row = mysqli_fetch_assoc($res);
-printf("%s is %d\n", $row['name'], $row['value']);
-?>

tests/httpd-php-mysql-sanity-test/old_mysql.php

@@ -1,12 +0,0 @@
-<?php
-$db = mysql_connect("localhost", "root");
-if (!$db) {
-    die("Could not connect");
-}
-if (!mysql_select_db("php_mysql_test")) {
-    die("Could not select database");
-}
-$res = mysql_query("SELECT * from foobar");
-$row = mysql_fetch_assoc($res);
-printf("%s is %d\n", $row['name'], $row['value']);
-?>

tests/httpd-php-mysql-sanity-test/php_mysql_test.conf

@@ -1,5 +0,0 @@
-
-Alias /php_mysql_test /var/www/php_mysql_test
-
-<Directory /var/www/php_mysql_test>
-</Directory>

tests/httpd-php-mysql-sanity-test/php_mysql_test.sql

@@ -1,6 +0,0 @@
-
-CREATE DATABASE php_mysql_test;
-USE php_mysql_test;
-
-CREATE TABLE foobar (name VARCHAR(10), value INTEGER);
-INSERT INTO foobar VALUES("fish", 42);

tests/httpd-php-mysql-sanity-test/runtest.sh

@@ -1,102 +0,0 @@
-#!/bin/bash
-# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-#   runtest.sh of /CoreOS/httpd/Sanity/httpd-php-mysql-sanity-test
-#   Description: test fetching data from mysqldb/mariadb through php
-#   Author: Karel Srot <ksrot@redhat.com>
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-#   Copyright (c) 2013 Red Hat, Inc. All rights reserved.
-#
-#   This copyrighted material is made available to anyone wishing
-#   to use, modify, copy, or redistribute it subject to the terms
-#   and conditions of the GNU General Public License version 2.
-#
-#   This program is distributed in the hope that it will be
-#   useful, but WITHOUT ANY WARRANTY; without even the implied
-#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
-#   PURPOSE. See the GNU General Public License for more details.
-#
-#   You should have received a copy of the GNU General Public
-#   License along with this program; if not, write to the Free
-#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-#   Boston, MA 02110-1301, USA.
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-# Include Beaker environment
-[ -e /usr/bin/rhts-environment.sh ] && . /usr/bin/rhts-environment.sh
-. /usr/share/beakerlib/beakerlib.sh || exit 1
-
-PACKAGES="${PACKAGES:-httpd}"
-REQUIRES="${REQUIRES:-php $DB}"
-
-rlJournalStart
-    rlPhaseStartSetup
-        rlRun "rlImport httpd/http" 0 "Import httpd library"
-        if rlIsRHEL 5 6 && [ $httpCOLLECTION = 0 ]; then
-            DB="mysql-server"
-            rlRun "rlImport mysql/basic" 0 "Import mysqld library"
-            SERVICE=${mysqlServiceName}
-        else
-            DB="mariadb-server"
-            rlRun "rlImport mariadb55/basic" 0 "Import mariadb library"
-            SERVICE=${mariadbServiceName}
-        fi
-	# install also php-mysql on rhel-6 (instead of php-mysqlnd on rhel-7)
-        rlRun "rlImport php/utils"
-        phpPdoPhpMysqlSetup
-        rlAssertRpm --all
-        rlRun "rlServiceStart $SERVICE" 0
-        rlRun "echo DROP DATABASE php_mysql_test | mysql -u root" 0,1
-        rlRun "mysql --verbose -u root < php_mysql_test.sql"
-        rlRun "httpStop" 0 "Stop httpd if running"
-        rlRun "> $httpLOGDIR/error_log"
-        rlRun "rm -rvf $httpROOTDIR/php_mysql_test"
-        rlRun "mkdir -v $httpROOTDIR/php_mysql_test"
-        rlRun "cp -v php_mysql_test.conf $httpCONFDIR/conf.d/"
-        php_version=`rlCheckRpm php`
-        if [[ $php_version =~ php-7* ]] || [[ $php_version =~ php-5.[5-6]* ]]; then
-            rlRun "cp -v new_mysql.php $httpROOTDIR/php_mysql_test/mysql.php"
-        else
-            rlRun "cp -v old_mysql.php $httpROOTDIR/php_mysql_test/mysql.php"
-        fi
-        rlRun "sed -i 's|/var/www|$httpROOTDIR|' $httpCONFDIR/conf.d/php_mysql_test.conf"
-        rlRun "chown -R apache:  $httpROOTDIR/php_mysql_test"
-        #rlRun "restorecon  $httpROOTDIR/php_mysql_test"
-        selinuxenabled && rlRun "chcon -Rv -t httpd_sys_content_t $httpROOTDIR/php_mysql_test"
-        rlRun "httpStart" 0 "Start httpd"
-    rlPhaseEnd
-
-    rlPhaseStartTest
-        URL="http://localhost/php_mysql_test/"
-        RETVAL=0
-        tries=`seq 1 10`
-
-        for n in ${tries}; do
-            output=`curl -s $URL/mysql.php`
-            rv=$?
-            echo "PHP output ${n}: ${rv} x${output}y"
-            [ ${rv} -ne 0 -o "x${output}y" != "xfish is 42y" ] && RETVAL=66
-        done
-
-        if [ $RETVAL -ne 0 ]; then
-            rlFail
-        else
-            rlPass
-        fi
-    rlPhaseEnd
-
-    rlPhaseStartCleanup
-        rlRun "rm -f $httpCONFDIR/conf.d/php_mysql_test.conf"
-        rlRun "rm -rf $httpROOTDIR/php_mysql_test"
-        rlRun "echo DROP DATABASE php_mysql_test | mysql -u root"
-        rlRun "rlServiceRestore ${SERVICE}" 0
-        rlRun "httpStop" 0 "Stop httpd if running"
-	# uninstall php-mysql on rhel-6 if it was installed during setup
-        phpPdoPhpMysqlCleanup
-    rlPhaseEnd
-rlJournalPrintText
-rlJournalEnd

tests/ignore_tests.yml

@@ -6,7 +6,7 @@
     tags:
     - classic
     tests:
-    - httpd-php-mysql-sanity-test
+    - smoke
     required_packages:
     - findutils         # beakerlib needs find command
     - which             # smoke requires which command

tests/smoke/Makefile

@@ -1,12 +1,12 @@
 # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 #
-#   Makefile of /CoreOS/httpd/Sanity/httpd-php-mysql-sanity-test
-#   Description: test fetching data from mysqldb/mariadb through php
-#   Author: Karel Srot <ksrot@redhat.com>
+#   Makefile of /CoreOS/httpd/Sanity/smoke
+#   Description: Simple check of httpd test page
+#   Author: Branislav Nater <bnater@redhat.com>
 #
 # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 #
-#   Copyright (c) 2013 Red Hat, Inc. All rights reserved.
+#   Copyright (c) 2021 Red Hat, Inc.
 #
 #   This copyrighted material is made available to anyone wishing
 #   to use, modify, copy, or redistribute it subject to the terms
@@ -24,12 +24,12 @@
 #
 # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-export TEST=/CoreOS/httpd/Sanity/httpd-php-mysql-sanity-test
+export TEST=/CoreOS/httpd/Sanity/smoke
 export TESTVERSION=1.0
 
 BUILT_FILES=
 
-FILES=$(METADATA) runtest.sh Makefile PURPOSE new_mysql.php old_mysql.php php_mysql_test.sql php_mysql_test.conf
+FILES=$(METADATA) runtest.sh Makefile PURPOSE
 
 .PHONY: all install download clean
 
@@ -43,25 +43,23 @@ clean:
 	rm -f *~ $(BUILT_FILES)
 
 
--include /usr/share/rhts/lib/rhts-make.include
+include /usr/share/rhts/lib/rhts-make.include
 
 $(METADATA): Makefile
-	@echo "Owner:           Karel Srot <ksrot@redhat.com>" > $(METADATA)
+	@echo "Owner:           Branislav Nater <bnater@redhat.com>" > $(METADATA)
 	@echo "Name:            $(TEST)" >> $(METADATA)
 	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
 	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
-	@echo "Description:     test fetching data from mysqldb/mariadb through php" >> $(METADATA)
+	@echo "Description:     Simple check of httpd test page" >> $(METADATA)
 	@echo "Type:            Sanity" >> $(METADATA)
 	@echo "TestTime:        5m" >> $(METADATA)
 	@echo "RunFor:          httpd" >> $(METADATA)
-	@echo "Requires:        httpd php php-zts php-mysqlnd mysql-server mariadb-server" >> $(METADATA)
+	@echo "Requires:        httpd mod_ssl" >> $(METADATA)
 	@echo "RhtsRequires:    library(httpd/http)" >> $(METADATA)
-	@echo "RhtsRequires:    library(mysql/basic)" >> $(METADATA)
-	@echo "RhtsRequires:    library(mariadb55/basic)" >> $(METADATA)
-	@echo "RhtsRequires:    library(php/utils)" >> $(METADATA)
 	@echo "Priority:        Normal" >> $(METADATA)
 	@echo "License:         GPLv2" >> $(METADATA)
 	@echo "Confidential:    no" >> $(METADATA)
 	@echo "Destructive:     no" >> $(METADATA)
+	@echo "Releases:        -RHEL4 -RHELClient5 -RHELServer5" >> $(METADATA)
 
 	rhts-lint $(METADATA)

tests/smoke/PURPOSE

@@ -0,0 +1,3 @@
+PURPOSE of /CoreOS/httpd/Sanity/smoke
+Description: Simple check of httpd
+Author: Branislav Nater <bnater@redhat.com>

tests/smoke/runtest.sh

@@ -0,0 +1,64 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /CoreOS/httpd/Sanity/smoke
+#   Description: Simple check of httpd test page
+#   Author: Branislav Nater <bnater@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2021 Red Hat, Inc.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include rhts environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGES="${PACKAGES:-httpd}"
+REQUIRES=${REQUIRES:-}
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlRun "rlImport --all" 0 "Importing Beaker libraries" || rlDie
+        rlAssertRpm --all
+        rlFileBackup --clean ${httpCONFDIR}/conf/
+        rlFileBackup --clean ${httpCONFDIR}/conf.d/
+        rlFileBackup --clean ${httpCONFDIR}/conf.modules.d/
+        rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
+        rlRun "pushd $TmpDir"
+    rlPhaseEnd
+
+    rlPhaseStartTest
+        rlRun "httpStart" 0 "Start httpd"
+        rlRun "httpStatus" 0 "Check status"
+        rlRun "httpStop" 0 "Stop httpd"
+
+        rlRun "httpSecureStart" 0 "Start httpd with ssl"
+        rlRun "httpInstallCa $(hostname)" 0 "Install CA"
+        rlRun "httpSecureStatus" 0 "Check status"
+        rlRun "httpRemoveCa" 0 "Remove CA"
+        rlRun "httpSecureStop" 0 "Stop httpd with ssl"
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlRun "rlFileRestore" 0 "Restoring original configuration"
+        rlRun "popd"
+        rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
+    rlPhaseEnd
+rlJournalEnd
+rlJournalPrintText

welcome.conf

@@ -16,4 +16,5 @@
 </Directory>
 
 Alias /.noindex.html /usr/share/httpd/noindex/index.html
-Alias /poweredby.png /usr/share/httpd/icons/apache_pb2.png
+Alias /poweredby.png /usr/share/httpd/icons/apache_pb3.png
+Alias /system_noindex_logo.png /usr/share/httpd/icons/system_noindex_logo.png