Topic: Apache httpd 2.4.39-dev VC15 snapshot 1 available

[Steffen]

The snapshot contains already committed changes for the coming 2.4.39.

When more changes are applied we come with a new snapshot.

Download: Removed, released as 2.4.39

The snapshot is based on svn branches/2.4 Revision 1856037 Fri Mar 22 10:16:22 2019 UTC.

25-March-2019 Changes with 2.4.39-dev-snap1

Apache Lounge changes:

*) Upgraded nghttp2 to 1.37.0 from 1.36.0

ASF changes:

*) mod_proxy/ssl: Cleanup per-request SSL configuration anytime a backend
connection is recycled/reused to avoid a possible crash with some SSLProxy
configurations in <Location> or <Proxy> context. PR 63256. [Yann Ylavic]

*) mod_ssl: Correctly restore SSL verify state after TLSv1.3 PHA failure.
[Michael Kaufmann <mail michael-kaufmann.ch>]

*) mod_log_config: Support %{c}h for conn-hostname, %h for useragent_host
PR 55348

*) mod_socache_redis: Support for Redis as socache storage provider.

*) core: new configuration option 'MergeSlashes on|off' that controls handling of
multiple, consecutive slash ('/') characters in the path component of the request URL.
[Eric Covener]

*) mod_http2: when SSL renegotiation is inhibited and a 403 ErrorDocument is
in play, the proper HTTP/2 stream reset did not trigger with H2_ERR_HTTP_1_1_REQUIRED.
Fixed. [Michael Kaufmann]

*) mod_http2: new configuration directive: `H2Padding numbits` to control
padding of HTTP/2 payload frames. 'numbits' is a number from 0-8,
controlling the range of padding bytes added to a frame. The actual number
added is chosen randomly per frame. This applies to HEADERS, DATA and PUSH_PROMISE
frames equally. The default continues to be 0, e.g. no padding. [Stefan Eissing]

*) mod_http2: ripping out all the h2_req_engine internal features now that mod_proxy_http2
has no more need for it. Optional functions are still declared but no longer implemented.
While previous mod_proxy_http2 will work with this, it is recommeneded to run the matching
versions of both modules. [Stefan Eissing]

*) mod_proxy_http2: changed mod_proxy_http2 implementation and fixed several bugs which
resolve PR63170. The proxy module does now a single h2 request on the (reused)
connection and returns. [Stefan Eissing]

*) mod_http2/mod_proxy_http2: proxy_http2 checks correct master connection aborted status
to trigger immediate shutdown of backend connections. This is now always signalled
by mod_http2 when the the session is being released.
proxy_http2 now only sends a PING frame to the backend when there is not already one
in flight. [Stefan Eissing]

*) mod_proxy_http2: fixed an issue where a proxy_http2 handler entered an infinite
loop when encountering certain errors on the backend connection.
See <https://bz.apache.org/bugzilla/show_bug.cgi?id=63170>. [Stefan Eissing]

*) mod_http2: Configuration directives H2Push and H2Upgrade can now be specified per
Location/Directory, e.g. disabling PUSH for a specific set of resources. [Stefan Eissing]

*) mod_http2: HEAD requests to some module such as mod_cgid caused the stream to
terminate improperly and cause a HTTP/2 PROTOCOL_ERROR.
Fixes <https://github.com/icing/mod_h2/issues/167>. [Michael Kaufmann]

*) http: Fix possible empty response with mod_ratelimit for HEAD requests.
PR 63192. [Yann Ylavic]

*) mod_cache_socache: Avoid reallocations and be safe with outgoing data
lifetime. [Yann Ylavic]

*) MPMs unix: bind the bucket number of each child to its slot number, for a
more efficient per bucket maintenance. [Yann Ylavic]

*) mod_auth_digest: Fix a race condition. Authentication with valid
credentials could be refused in case of concurrent accesses from
different users. PR 63124. [Simon Kappel <simon.kappel axis.com>]

*) mod_http2: enable re-use of slave connections again. Fixed slave connection
keepalives counter. [Stefan Eissing]

*) mod_reqtimeout: Allow to configure (TLS-)handshake timeouts.
PR 61310. [Yann Ylavic]

*) mod_proxy_wstunnel: Fix websocket proxy over UDS.
PR 62932 <pavel dcmsys.com>

*) mod_ssl: Don't unset FIPS mode on restart unless it's forced by
configuration (SSLFIPS on) and not active by default in OpenSSL.
PR 63136. [Yann Ylavic]

[Steffen]

The above download is called for a VOTE over the next few days to release this as GA.

No changes since above download.

Please give it a try.

[DnvrSysEngr]

Been running 2.4.39-Dev for the past few days with no issues.

[Steffen]

Thanks for trying.

Vote passed, stay tuned for 2.4.39.