Kolab Groupware OBS

We truncated the diff of some files because they were too big. If you want to see the full diff for every file, click here.

Changes of Revision 10

httpd.spec Changed

@@ -12,17 +12,19 @@
 
 Summary: Apache HTTP Server
 Name: httpd
-Version: 2.4.29
-Release: 1%{?dist}
+Version: 2.4.39
+Release: 2%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
 Source2: httpd.logrotate
+Source3: instance.conf
 Source4: httpd-ssl-pass-dialog
 Source5: httpd.tmpfiles
 Source6: httpd.service
 Source7: action-graceful.sh
 Source8: action-configtest.sh
+Source9: server-status.conf
 Source10: httpd.conf
 Source11: 00-base.conf
 Source12: 00-mpm.conf
@@ -42,79 +44,72 @@
 Source26: 10-listen443.conf
 Source27: httpd.socket
 Source28: 00-optional.conf
-# Documentation
+Source29: 01-md.conf
 Source30: README.confd
 Source31: README.confmod
 Source32: httpd.service.xml
+Source33: htcacheclean.service.xml
+Source34: httpd.conf.xml
 Source40: htcacheclean.service
 Source41: htcacheclean.sysconf
 Source42: httpd-init.service
 Source43: httpd-ssl-gencerts
+Source44: httpd@.service
+Source45: config.layout
+Source46: apachectl.sh
 # build/scripts patches
-Patch1: httpd-2.4.1-apctl.patch
 Patch2: httpd-2.4.9-apxs.patch
 Patch3: httpd-2.4.1-deplibs.patch
-Patch5: httpd-2.4.3-layout.patch
-Patch6: httpd-2.4.3-apctl-systemd.patch
 # Needed for socket activation and mod_systemd patch
 Patch19: httpd-2.4.25-detect-systemd.patch
 # Features/functional changes
-Patch23: httpd-2.4.4-export.patch
+Patch21: httpd-2.4.37-r1842929+.patch
+Patch23: httpd-2.4.33-export.patch
 Patch24: httpd-2.4.1-corelimit.patch
 Patch25: httpd-2.4.25-selinux.patch
 Patch26: httpd-2.4.4-r1337344+.patch
 Patch27: httpd-2.4.2-icons.patch
-Patch29: httpd-2.4.27-systemd.patch
+Patch29: httpd-2.4.33-systemd.patch
 Patch30: httpd-2.4.4-cachehardmax.patch
-Patch31: httpd-2.4.18-sslmultiproxy.patch
+Patch31: httpd-2.4.33-sslmultiproxy.patch
 Patch34: httpd-2.4.17-socket-activation.patch
-Patch35: httpd-2.4.17-sslciphdefault.patch
+Patch36: httpd-2.4.38-r1830819+.patch
+Patch38: httpd-2.4.34-sslciphdefault.patch
+Patch39: httpd-2.4.37-sslprotdefault.patch
 
 # Bug fixes
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
-Patch58: httpd-2.4.25-r1738878.patch
+Patch58: httpd-2.4.34-r1738878.patch
+Patch60: httpd-2.4.34-enable-sslv3.patch
 
 # Security fixes
 
 License: ASL 2.0
-Group: System Environment/Daemons
-BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root
-BuildRequires: autoconf, perl-generators, pkgconfig, findutils, xmlto
-%if 0%{?fedora}
-BuildRequires: perl-interpreter
-%else
-BuildRequires: perl
-%endif
-BuildRequires: zlib-devel, libselinux-devel, lua-devel
+BuildRequires: gcc, autoconf, pkgconfig, findutils, xmlto
+BuildRequires: perl-interpreter, perl-generators, systemd-devel
+BuildRequires: zlib-devel, libselinux-devel, lua-devel, brotli-devel
 BuildRequires: apr-devel >= 1.5.0, apr-util-devel >= 1.5.0, pcre-devel >= 5.0
-BuildRequires: systemd-devel
-Requires: /etc/mime.types
-%if 0%{?fedora} || 0%{?rhel} > 7
-Requires: system-logos-httpd
-%else
-Requires: system-logos
-%endif
+Requires: /etc/mime.types, system-logos-httpd
 Obsoletes: httpd-suexec
 Provides: webserver
 Provides: mod_dav = %{version}-%{release}, httpd-suexec = %{version}-%{release}
 Provides: httpd-mmn = %{mmn}, httpd-mmn = %{mmnisa}
 Requires: httpd-tools = %{version}-%{release}
 Requires: httpd-filesystem = %{version}-%{release}
-%if 0%{?fedora} || 0%{?rhel} > 7
 Requires: mod_http2
-%endif
 Requires(pre): httpd-filesystem
 Requires(preun): systemd-units
 Requires(postun): systemd-units
 Requires(post): systemd-units
 Conflicts: apr < 1.5.0-1
+Provides: mod_proxy_uwsgi = %{version}-%{release}
+Obsoletes: mod_proxy_uwsgi < 2.0.17.1-2
 
 %description
 The Apache HTTP Server is a powerful, efficient, and extensible
 web server.
 
 %package devel
-Group: Development/Libraries
 Summary: Development interfaces for the Apache HTTP Server
 Requires: apr-devel, apr-util-devel, pkgconfig
 Requires: httpd = %{version}-%{release}
@@ -129,7 +124,6 @@
 to install this package.
 
 %package manual
-Group: Documentation
 Summary: Documentation for the Apache HTTP Server
 Requires: httpd = %{version}-%{release}
 BuildArch: noarch
@@ -140,7 +134,6 @@
 also be found at https://httpd.apache.org/docs/2.4/.
 
 %package filesystem
-Group: System Environment/Daemons
 Summary: The basic directory layout for the Apache HTTP Server
 BuildArch: noarch
 Requires(pre): /usr/sbin/useradd
@@ -151,7 +144,6 @@
 for the directories.
 
 %package tools
-Group: System Environment/Daemons
 Summary: Tools for use with the Apache HTTP Server
 
 %description tools
@@ -159,7 +151,6 @@
 the Apache HTTP Server.
 
 %package -n mod_ssl
-Group: System Environment/Daemons
 Summary: SSL/TLS module for the Apache HTTP Server
 Epoch: 1
 BuildRequires: openssl-devel
@@ -174,8 +165,19 @@
 server via the Secure Sockets Layer (SSL) and Transport Layer
 Security (TLS) protocols.
 
+%package -n mod_md
+Summary: Certificate provisioning using ACME for the Apache HTTP Server
+Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa}
+BuildRequires: jansson-devel, libcurl-devel
+
+%description -n mod_md
+This module manages common properties of domains for one or more
+virtual hosts. Specifically it can use the ACME protocol (RFC Draft)
+to automate certificate provisioning. These will be configured for
+managed domains and their virtual hosts automatically. This includes
+renewal of certificates before they expire.
+
 %package -n mod_proxy_html
-Group: System Environment/Daemons
 Summary: HTML and XML content filters for the Apache HTTP Server
 Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa}
 BuildRequires: libxml2-devel
@@ -187,7 +189,6 @@
 transform and modify HTML and XML content.
 
 %package -n mod_ldap
-Group: System Environment/Daemons
 Summary: LDAP authentication modules for the Apache HTTP Server
 Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa}
 Requires: apr-util-ldap
@@ -197,7 +198,6 @@
 authentication to the Apache HTTP Server.
 
 %package -n mod_session
-Group: System Environment/Daemons
 Summary: Session interface for the Apache HTTP Server
 Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa}
 
@@ -207,25 +207,27 @@
 
 %prep
 %setup -q
-%patch1 -p1 -b .apctl
 %patch2 -p1 -b .apxs
 %patch3 -p1 -b .deplibs
-%patch5 -p1 -b .layout

httpd-2.4.1-apctl.patch Deleted

@@ -1,94 +0,0 @@
-
-- fail gracefully if links is not installed on target system
-- source sysconfig/httpd for custom env. vars etc.
-- make httpd -t work even in SELinux
-- pass $OPTIONS to all $HTTPD invocation
-
-Upstream-HEAD: vendor
-Upstream-2.0: vendor
-Upstream-Status: Vendor-specific changes for better initscript integration
-
---- httpd-2.4.1/support/apachectl.in.apctl
-+++ httpd-2.4.1/support/apachectl.in
-@@ -44,19 +44,25 @@ ARGV="$@"
- # the path to your httpd binary, including options if necessary
- HTTPD='@exp_sbindir@/@progname@'
- #
--# pick up any necessary environment variables
--if test -f @exp_sbindir@/envvars; then
--  . @exp_sbindir@/envvars
--fi
- #
- # a command that outputs a formatted text version of the HTML at the
- # url given on the command line.  Designed for lynx, however other
- # programs may work.  
--LYNX="@LYNX_PATH@ -dump"
-+if [ -x "@LYNX_PATH@" ]; then
-+  LYNX="@LYNX_PATH@ -dump"
-+else
-+  LYNX=none
-+fi
- #
- # the URL to your server's mod_status status page.  If you do not
- # have one, then status and fullstatus will not work.
- STATUSURL="http://localhost:@PORT@/server-status"
-+
-+# Source /etc/sysconfig/httpd for $HTTPD setting, etc.
-+if [ -r /etc/sysconfig/httpd ]; then
-+   . /etc/sysconfig/httpd
-+fi
-+
- #
- # Set this variable to a command that increases the maximum
- # number of file descriptors allowed per child process. This is
-@@ -76,9 +82,27 @@ if [ "x$ARGV" = "x" ] ; then 
-     ARGV="-h"
- fi
- 
-+function checklynx() {
-+if [ "$LYNX" = "none" ]; then
-+   echo "The 'links' package is required for this functionality."
-+   exit 8
-+fi
-+}
-+
-+function testconfig() {
-+# httpd is denied terminal access in SELinux, so run in the
-+# current context to get stdout from $HTTPD -t.
-+if test -x /usr/sbin/selinuxenabled && /usr/sbin/selinuxenabled; then
-+  runcon -- `id -Z` $HTTPD $OPTIONS -t
-+else
-+  $HTTPD $OPTIONS -t
-+fi
-+ERROR=$?
-+}
-+
- case $ACMD in
- start|stop|restart|graceful|graceful-stop)
--    $HTTPD -k $ARGV
-+    $HTTPD $OPTIONS -k $ARGV
-     ERROR=$?
-     ;;
- startssl|sslstart|start-SSL)
-@@ -88,17 +112,18 @@ startssl|sslstart|start-SSL)
-     ERROR=2
-     ;;
- configtest)
--    $HTTPD -t
--    ERROR=$?
-+    testconfig
-     ;;
- status)
-+    checklynx
-     $LYNX $STATUSURL | awk ' /process$/ { print; exit } { print } '
-     ;;
- fullstatus)
-+    checklynx
-     $LYNX $STATUSURL
-     ;;
- *)
--    $HTTPD "$@"
-+    $HTTPD $OPTIONS "$@"
-     ERROR=$?
- esac
-

httpd-2.4.1-selinux.patch Deleted

@@ -1,61 +0,0 @@
-
-Log the SELinux context at startup.
-
-Upstream-Status: unlikely to be any interest in this upstream
-
---- httpd-2.4.1/configure.in.selinux
-+++ httpd-2.4.1/configure.in
-@@ -458,6 +458,11 @@ fopen64
- dnl confirm that a void pointer is large enough to store a long integer
- APACHE_CHECK_VOID_PTR_LEN
- 
-+AC_CHECK_LIB(selinux, is_selinux_enabled, [
-+   AC_DEFINE(HAVE_SELINUX, 1, [Defined if SELinux is supported])
-+   APR_ADDTO(AP_LIBS, [-lselinux])
-+])
-+
- AC_CACHE_CHECK([for gettid()], ac_cv_gettid,
- [AC_TRY_RUN(#define _GNU_SOURCE
- #include <unistd.h>
---- httpd-2.4.1/server/core.c.selinux
-+++ httpd-2.4.1/server/core.c
-@@ -58,6 +58,10 @@
- #include <unistd.h>
- #endif
- 
-+#ifdef HAVE_SELINUX
-+#include <selinux/selinux.h>
-+#endif
-+
- /* LimitRequestBody handling */
- #define AP_LIMIT_REQ_BODY_UNSET         ((apr_off_t) -1)
- #define AP_DEFAULT_LIMIT_REQ_BODY       ((apr_off_t) 0)
-@@ -4452,6 +4456,28 @@ static int core_post_config(apr_pool_t *
-     }
- #endif
- 
-+#ifdef HAVE_SELINUX
-+    {
-+        static int already_warned = 0;
-+        int is_enabled = is_selinux_enabled() > 0;
-+        
-+        if (is_enabled && !already_warned) {
-+            security_context_t con;
-+            
-+            if (getcon(&con) == 0) {
-+                
-+                ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, NULL,
-+                             "SELinux policy enabled; "
-+                             "httpd running as context %s", con);
-+                
-+                already_warned = 1;
-+                
-+                freecon(con);
-+            }
-+        }
-+    }
-+#endif
-+
-     return OK;
- }
-

httpd-2.4.10-detect-systemd.patch Deleted

@@ -1,48 +0,0 @@
-diff --git a/acinclude.m4 b/acinclude.m4
-index 580eb4a..bd7e2c9 100644
---- a/acinclude.m4
-+++ b/acinclude.m4
-@@ -594,6 +594,30 @@ AC_DEFUN(APACHE_CHECK_OPENSSL,[
-   fi
- ])
- 
-+AC_DEFUN(APACHE_CHECK_SYSTEMD, [                                                                        
-+dnl Check for systemd support for listen.c's socket activation.
-+case $host in
-+*-linux-*)
-+   if test -n "$PKGCONFIG" && $PKGCONFIG --exists libsystemd; then
-+      SYSTEMD_LIBS=`$PKGCONFIG --libs libsystemd`
-+   elif test -n "$PKGCONFIG" && $PKGCONFIG --exists libsystemd-daemon; then
-+      SYSTEMD_LIBS=`$PKGCONFIG --libs libsystemd-daemon`
-+   else
-+      AC_CHECK_LIB(systemd-daemon, sd_notify, SYSTEMD_LIBS="-lsystemd-daemon")
-+   fi
-+   if test -n "$SYSTEMD_LIBS"; then
-+      AC_CHECK_HEADERS(systemd/sd-daemon.h)
-+      if test "${ac_cv_header_systemd_sd_daemon_h}" = "no" || test -z "${SYSTEMD_LIBS}"; then
-+        AC_MSG_WARN([Your system does not support systemd.])
-+      else
-+        APR_ADDTO(LIBS, [$SYSTEMD_LIBS])
-+        AC_DEFINE(HAVE_SYSTEMD, 1, [Define if systemd is supported])
-+      fi
-+   fi
-+   ;;
-+esac
-+])
-+
- dnl
- dnl APACHE_EXPORT_ARGUMENTS
- dnl Export (via APACHE_SUBST) the various path-related variables that
-diff --git a/configure.in b/configure.in
-index 19a5f88..f096de3 100644
---- a/configure.in
-+++ b/configure.in
-@@ -509,6 +509,8 @@ if test "$ac_cv_struct_tm_gmtoff" = "yes"; then
-     AC_DEFINE(HAVE_GMTOFF, 1, [Define if struct tm has a tm_gmtoff field])
- fi
- 
-+APACHE_CHECK_SYSTEMD
-+
- dnl ## Set up any appropriate OS-specific environment variables for apachectl
- 
- case $host in

httpd-2.4.10-mod_systemd.patch Deleted

@@ -1,172 +0,0 @@
-diff --git a/modules/arch/unix/config5.m4 b/modules/arch/unix/config5.m4
-index 77027a8..7a13d5a 100644
---- a/modules/arch/unix/config5.m4
-+++ b/modules/arch/unix/config5.m4
-@@ -18,6 +18,16 @@ APACHE_MODULE(privileges, Per-virtualhost Unix UserIDs and enhanced security for
-   fi
- ])
- 
-+APACHE_MODULE(systemd, Systemd support, , , all, [
-+  if test "${ac_cv_header_systemd_sd_daemon_h}" = "no" || test -z "${SYSTEMD_LIBS}"; then
-+    AC_MSG_WARN([Your system does not support systemd.])
-+    enable_systemd="no"
-+  else
-+    APR_ADDTO(MOD_SYSTEMD_LDADD, [$SYSTEMD_LIBS])
-+    enable_systemd="yes"
-+  fi
-+])
-+
- APR_ADDTO(INCLUDES, [-I\$(top_srcdir)/$modpath_current])
- 
- APACHE_MODPATH_FINISH
-diff --git a/modules/arch/unix/mod_systemd.c b/modules/arch/unix/mod_systemd.c
-new file mode 100644
-index 0000000..5381c98
---- /dev/null
-+++ b/modules/arch/unix/mod_systemd.c
-@@ -0,0 +1,145 @@
-+/* Licensed to the Apache Software Foundation (ASF) under one or more
-+ * contributor license agreements.  See the NOTICE file distributed with
-+ * this work for additional information regarding copyright ownership.
-+ * The ASF licenses this file to You under the Apache License, Version 2.0
-+ * (the "License"); you may not use this file except in compliance with
-+ * the License.  You may obtain a copy of the License at
-+ *
-+ *     http://www.apache.org/licenses/LICENSE-2.0
-+ *
-+ * Unless required by applicable law or agreed to in writing, software
-+ * distributed under the License is distributed on an "AS IS" BASIS,
-+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-+ * See the License for the specific language governing permissions and
-+ * limitations under the License.
-+ * 
-+ */
-+
-+#include <stdint.h>
-+#include <ap_config.h>
-+#include "ap_mpm.h"
-+#include <http_core.h>
-+#include <httpd.h>
-+#include <http_log.h>
-+#include <apr_version.h>
-+#include <apr_pools.h>
-+#include <apr_strings.h>
-+#include "unixd.h"
-+#include "scoreboard.h"
-+#include "mpm_common.h"
-+
-+#include "systemd/sd-daemon.h"
-+
-+#if APR_HAVE_UNISTD_H
-+#include <unistd.h>
-+#endif
-+
-+static int shutdown_timer = 0;
-+static int shutdown_counter = 0;
-+static unsigned long bytes_served;
-+static pid_t mainpid;
-+
-+static int systemd_pre_mpm(apr_pool_t *p, ap_scoreboard_e sb_type)
-+{
-+    int rv;
-+
-+    ap_extended_status = 1;
-+    mainpid = getpid();
-+
-+    rv = sd_notifyf(0, "READY=1\n"
-+                    "STATUS=Processing requests...\n"
-+                    "MAINPID=%" APR_PID_T_FMT, mainpid);
-+    if (rv < 0) {
-+        ap_log_perror(APLOG_MARK, APLOG_ERR, 0, p, APLOGNO(02395)
-+                     "sd_notifyf returned an error %d", rv);
-+    }
-+
-+    return OK;
-+}
-+
-+static int systemd_monitor(apr_pool_t *p, server_rec *s)
-+{
-+    ap_sload_t sload;
-+    apr_interval_time_t up_time;
-+    char bps[5];
-+    int rv;
-+
-+    ap_get_sload(&sload);
-+    /* up_time in seconds */
-+    up_time = (apr_uint32_t) apr_time_sec(apr_time_now() -
-+                               ap_scoreboard_image->global->restart_time);
-+
-+    apr_strfsize((unsigned long)((float) (sload.bytes_served)
-+                                 / (float) up_time), bps);
-+
-+    rv = sd_notifyf(0, "READY=1\n"
-+                    "STATUS=Total requests: %lu; Idle/Busy workers %d/%d;"
-+                    "Requests/sec: %.3g; Bytes served/sec: %sB/sec\n",
-+                    sload.access_count, sload.idle, sload.busy,
-+                    ((float) sload.access_count) / (float) up_time, bps);
-+
-+    if (rv < 0) {
-+        ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(02396)
-+                     "sd_notifyf returned an error %d", rv);
-+    }
-+
-+    /* Shutdown httpd when nothing is sent for shutdown_timer seconds. */
-+    if (sload.bytes_served == bytes_served) {
-+        /* mpm_common.c: INTERVAL_OF_WRITABLE_PROBES is 10 */
-+        shutdown_counter += 10;
-+        if (shutdown_timer > 0 && shutdown_counter >= shutdown_timer) {
-+            rv = sd_notifyf(0, "READY=1\n"
-+                            "STATUS=Stopped as result of IdleShutdown "
-+                            "timeout.");
-+            if (rv < 0) {
-+                ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(02804)
-+                            "sd_notifyf returned an error %d", rv);
-+            }
-+            kill(mainpid, AP_SIG_GRACEFUL);
-+        }
-+    }
-+    else {
-+        shutdown_counter = 0;
-+    }
-+
-+    bytes_served = sload.bytes_served;
-+
-+    return DECLINED;
-+}
-+
-+static void systemd_register_hooks(apr_pool_t *p)
-+{
-+    /* We know the PID in this hook ... */
-+    ap_hook_pre_mpm(systemd_pre_mpm, NULL, NULL, APR_HOOK_LAST);
-+    /* Used to update httpd's status line using sd_notifyf */
-+    ap_hook_monitor(systemd_monitor, NULL, NULL, APR_HOOK_MIDDLE);
-+}
-+
-+static const char *set_shutdown_timer(cmd_parms *cmd, void *dummy,
-+                                      const char *arg)
-+{
-+    const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
-+    if (err != NULL) {
-+        return err;
-+    }
-+
-+    shutdown_timer = atoi(arg);
-+    return NULL;
-+}
-+
-+static const command_rec systemd_cmds[] =
-+{
-+AP_INIT_TAKE1("IdleShutdown", set_shutdown_timer, NULL, RSRC_CONF,
-+     "Number of seconds in idle-state after which httpd is shutdown"),
-+    {NULL}
-+};
-+
-+AP_DECLARE_MODULE(systemd) = {
-+    STANDARD20_MODULE_STUFF,
-+    NULL,
-+    NULL,
-+    NULL,
-+    NULL,
-+    systemd_cmds,
-+    systemd_register_hooks,
-+};

httpd-2.4.10-sigint.patch Deleted

@@ -1,28 +0,0 @@
-diff --git a/server/mpm/prefork/prefork.c b/server/mpm/prefork/prefork.c
-index 559f90a..a386a75 100644
---- a/server/mpm/prefork/prefork.c
-+++ b/server/mpm/prefork/prefork.c
-@@ -220,6 +220,9 @@ static void clean_child_exit(int code)
- {
-     retained->mpm->mpm_state = AP_MPMQ_STOPPING;
- 
-+    apr_signal(SIGHUP, SIG_IGN);
-+    apr_signal(SIGTERM, SIG_IGN);
-+
-     if (pchild) {
-         apr_pool_destroy(pchild);
-     }
-@@ -699,6 +702,13 @@ static int make_child(server_rec *s, int slot, int bucket)
-          */
-         apr_signal(SIGHUP, just_die);
-         apr_signal(SIGTERM, just_die);
-+        /* Ignore SIGINT in child. This fixes race-condition in signals
-+         * handling when httpd is runnning on foreground and user hits ctrl+c.
-+         * In this case, SIGINT is sent to all children followed by SIGTERM
-+         * from the main process, which interrupts the SIGINT handler and
-+         * leads to inconsistency.
-+         */
-+        apr_signal(SIGINT, SIG_IGN);
-         /* The child process just closes listeners on AP_SIG_GRACEFUL.
-          * The pod is used for signalling the graceful restart.
-          */

httpd-2.4.10-sslciphdefault.patch Deleted

httpd-2.4.17-debug-crash.patch Deleted

@@ -1,28 +0,0 @@
-diff -ur httpd-2.4.20-057-sigint/server/mpm/event/event.c httpd-2.4.20/server/mpm/event/event.c
---- httpd-2.4.20-057-sigint/server/mpm/event/event.c	2016-04-01 14:26:05.000000000 +0200
-+++ httpd-2.4.20/server/mpm/event/event.c	2016-07-04 19:24:51.189736104 +0200
-@@ -3094,8 +3094,7 @@
- 
-     all_buckets = apr_pcalloc(pconf, num_buckets * sizeof(*all_buckets));
-     for (i = 0; i < num_buckets; i++) {
--        if (!one_process && /* no POD in one_process mode */
--                (rv = ap_mpm_podx_open(pconf, &all_buckets[i].pod))) {
-+        if (rv = ap_mpm_podx_open(pconf, &all_buckets[i].pod)) {
-             ap_log_error(APLOG_MARK, APLOG_CRIT | level_flags, rv,
-                          (startup ? NULL : s),
-                          "could not open pipe-of-death");
-Only in httpd-2.4.20/server/mpm/event: event.c.orig
-Only in httpd-2.4.20-057-sigint/server/mpm/prefork: prefork.c.orig
-diff -ur httpd-2.4.20-057-sigint/server/mpm/worker/worker.c httpd-2.4.20/server/mpm/worker/worker.c
---- httpd-2.4.20-057-sigint/server/mpm/worker/worker.c	2016-04-01 14:26:05.000000000 +0200
-+++ httpd-2.4.20/server/mpm/worker/worker.c	2016-07-04 19:24:51.190736117 +0200
-@@ -2051,8 +2051,7 @@
- 
-     all_buckets = apr_pcalloc(pconf, num_buckets * sizeof(*all_buckets));
-     for (i = 0; i < num_buckets; i++) {
--        if (!one_process && /* no POD in one_process mode */
--                (rv = ap_mpm_podx_open(pconf, &all_buckets[i].pod))) {
-+        if (rv = ap_mpm_podx_open(pconf, &all_buckets[i].pod)) {
-             ap_log_error(APLOG_MARK, APLOG_CRIT | level_flags, rv,
-                          (startup ? NULL : s),
-                          "could not open pipe-of-death");

httpd-2.4.17-sslciphdefault.patch Deleted

@@ -1,33 +0,0 @@
-
-https://bugzilla.redhat.com/show_bug.cgi?id=1109119
-
-Don't prepend !aNULL etc if PROFILE= is used with SSLCipherSuite.
-
---- httpd-2.4.17/modules/ssl/ssl_engine_config.c.sslciphdefault
-+++ httpd-2.4.17/modules/ssl/ssl_engine_config.c
-@@ -708,8 +708,10 @@ const char *ssl_cmd_SSLCipherSuite(cmd_p
-     SSLSrvConfigRec *sc = mySrvConfig(cmd->server);
-     SSLDirConfigRec *dc = (SSLDirConfigRec *)dcfg;
- 
--    /* always disable null and export ciphers */
--    arg = apr_pstrcat(cmd->pool, arg, ":!aNULL:!eNULL:!EXP", NULL);
-+    /* Disable null and export ciphers by default, except for PROFILE=
-+     * configs where the parser doesn't cope. */
-+    if (strncmp(arg, "PROFILE=", 8) != 0)
-+        arg = apr_pstrcat(cmd->pool, arg, ":!aNULL:!eNULL:!EXP", NULL);
- 
-     if (cmd->path) {
-         dc->szCipherSuite = arg;
-@@ -1428,8 +1430,10 @@ const char *ssl_cmd_SSLProxyCipherSuite(
- {
-     SSLSrvConfigRec *sc = mySrvConfig(cmd->server);
- 
--    /* always disable null and export ciphers */
--    arg = apr_pstrcat(cmd->pool, arg, ":!aNULL:!eNULL:!EXP", NULL);
-+    /* Disable null and export ciphers by default, except for PROFILE=
-+     * configs where the parser doesn't cope. */
-+    if (strncmp(arg, "PROFILE=", 8) != 0)
-+        arg = apr_pstrcat(cmd->pool, arg, ":!aNULL:!eNULL:!EXP", NULL);
- 
-     sc->proxy->auth.cipher_suite = arg;
-

httpd-2.4.18-sslmultiproxy.patch Deleted

@@ -1,98 +0,0 @@
-diff --git a/modules/ssl/mod_ssl.c b/modules/ssl/mod_ssl.c
-index 717a694..a3ce718 100644
---- a/modules/ssl/mod_ssl.c
-+++ b/modules/ssl/mod_ssl.c
-@@ -395,6 +395,9 @@ static SSLConnRec *ssl_init_connection_ctx(conn_rec *c)
-     return sslconn;
- }
- 
-+static typeof(ssl_proxy_enable) *othermod_proxy_enable;
-+static typeof(ssl_engine_disable) *othermod_engine_disable;
-+
- int ssl_proxy_enable(conn_rec *c)
- {
-     SSLSrvConfigRec *sc;
-@@ -403,6 +406,12 @@ int ssl_proxy_enable(conn_rec *c)
-     sc = mySrvConfig(sslconn->server);
- 
-     if (!sc->proxy_enabled) {
-+        if (othermod_proxy_enable) {
-+            ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, c,
-+                          "mod_ssl proxy not configured, passing through to other module.");
-+            return othermod_proxy_enable(c);
-+        }
-+
-         ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, c, APLOGNO(01961)
-                       "SSL Proxy requested for %s but not enabled "
-                       "[Hint: SSLProxyEngine]", sc->vhost_id);
-@@ -422,6 +431,10 @@ int ssl_engine_disable(conn_rec *c)
- 
-     SSLConnRec *sslconn = myConnConfig(c);
- 
-+    if (othermod_engine_disable) {
-+        othermod_engine_disable(c);
-+    }
-+
-     if (sslconn) {
-         sc = mySrvConfig(sslconn->server);
-     }
-@@ -621,6 +634,9 @@ static void ssl_register_hooks(apr_pool_t *p)
-     ap_hook_post_read_request(ssl_hook_ReadReq, pre_prr,NULL, APR_HOOK_MIDDLE);
- 
-     ssl_var_register(p);
-+    
-+    othermod_proxy_enable = APR_RETRIEVE_OPTIONAL_FN(ssl_proxy_enable);
-+    othermod_engine_disable = APR_RETRIEVE_OPTIONAL_FN(ssl_engine_disable);
- 
-     APR_REGISTER_OPTIONAL_FN(ssl_proxy_enable);
-     APR_REGISTER_OPTIONAL_FN(ssl_engine_disable);
-diff --git a/modules/ssl/ssl_engine_vars.c b/modules/ssl/ssl_engine_vars.c
-index a6b0d0d..24fd8c7 100644
---- a/modules/ssl/ssl_engine_vars.c
-+++ b/modules/ssl/ssl_engine_vars.c
-@@ -54,6 +54,8 @@ static char *ssl_var_lookup_ssl_cipher(apr_pool_t *p, SSLConnRec *sslconn, char
- static void  ssl_var_lookup_ssl_cipher_bits(SSL *ssl, int *usekeysize, int *algkeysize);
- static char *ssl_var_lookup_ssl_version(apr_pool_t *p, char *var);
- static char *ssl_var_lookup_ssl_compress_meth(SSL *ssl);
-+static APR_OPTIONAL_FN_TYPE(ssl_is_https) *othermod_is_https;
-+static APR_OPTIONAL_FN_TYPE(ssl_var_lookup) *othermod_var_lookup;
- 
- static SSLConnRec *ssl_get_effective_config(conn_rec *c)
- {
-@@ -68,7 +70,9 @@ static SSLConnRec *ssl_get_effective_config(conn_rec *c)
- static int ssl_is_https(conn_rec *c)
- {
-     SSLConnRec *sslconn = ssl_get_effective_config(c);
--    return sslconn && sslconn->ssl;
-+
-+    return (sslconn && sslconn->ssl)
-+        || (othermod_is_https && othermod_is_https(c));
- }
- 
- static const char var_interface[] = "mod_ssl/" AP_SERVER_BASEREVISION;
-@@ -137,6 +141,9 @@ void ssl_var_register(apr_pool_t *p)
- {
-     char *cp, *cp2;
- 
-+    othermod_is_https = APR_RETRIEVE_OPTIONAL_FN(ssl_is_https);
-+    othermod_var_lookup = APR_RETRIEVE_OPTIONAL_FN(ssl_var_lookup);
-+
-     APR_REGISTER_OPTIONAL_FN(ssl_is_https);
-     APR_REGISTER_OPTIONAL_FN(ssl_var_lookup);
-     APR_REGISTER_OPTIONAL_FN(ssl_ext_list);
-@@ -272,6 +279,15 @@ char *ssl_var_lookup(apr_pool_t *p, server_rec *s, conn_rec *c, request_rec *r,
-      */
-     if (result == NULL && c != NULL) {
-         SSLConnRec *sslconn = ssl_get_effective_config(c);
-+
-+        if (strlen(var) > 4 && strcEQn(var, "SSL_", 4)
-+            && (!sslconn || !sslconn->ssl) && othermod_var_lookup) {
-+            /* For an SSL_* variable, if mod_ssl is not enabled for
-+             * this connection and another SSL module is present, pass
-+             * through to that module. */
-+            return othermod_var_lookup(p, s, c, r, var);
-+        }
-+
-         if (strlen(var) > 4 && strcEQn(var, "SSL_", 4)
-             && sslconn && sslconn->ssl)
-             result = ssl_var_lookup_ssl(p, sslconn, r, var+4);

httpd-2.4.27-CVE-2017-9798.patch Deleted

httpd-2.4.27-r1808230.patch Deleted

@@ -1,131 +0,0 @@
-# ./pullrev.sh 1808230
-http://svn.apache.org/viewvc?view=revision&revision=1808230
-
---- httpd-2.4.27/server/protocol.c
-+++ httpd-2.4.27/server/protocol.c
-@@ -1708,62 +1708,88 @@
-         ctx->tmpbb = apr_brigade_create(r->pool, r->connection->bucket_alloc);
-     }
- 
--    /* Loop through this set of buckets to compute their length
--     */
-+    /* Loop through the brigade to count the length. To avoid
-+     * arbitrary memory consumption with morphing bucket types, this
-+     * loop will stop and pass on the brigade when necessary. */
-     e = APR_BRIGADE_FIRST(b);
-     while (e != APR_BRIGADE_SENTINEL(b)) {
-+        apr_status_t rv;
-+
-         if (APR_BUCKET_IS_EOS(e)) {
-             eos = 1;
-             break;
-         }
--        if (e->length == (apr_size_t)-1) {
-+        /* For a flush bucket, fall through to pass the brigade and
-+         * flush now. */
-+        else if (APR_BUCKET_IS_FLUSH(e)) {
-+            e = APR_BUCKET_NEXT(e);
-+        }
-+        /* For metadata bucket types other than FLUSH, loop. */
-+        else if (APR_BUCKET_IS_METADATA(e)) {
-+            e = APR_BUCKET_NEXT(e);
-+            continue;
-+        }
-+        /* For determinate length data buckets, count the length and
-+         * continue. */
-+        else if (e->length != (apr_size_t)-1) {
-+            r->bytes_sent += e->length;
-+            e = APR_BUCKET_NEXT(e);
-+            continue;
-+        }
-+        /* For indeterminate length data buckets, perform one read. */
-+        else /* e->length == (apr_size_t)-1 */ {
-             apr_size_t len;
-             const char *ignored;
--            apr_status_t rv;
--
--            /* This is probably a pipe bucket.  Send everything
--             * prior to this, and then read the data for this bucket.
--             */
-+        
-             rv = apr_bucket_read(e, &ignored, &len, eblock);
-+            if ((rv != APR_SUCCESS) && !APR_STATUS_IS_EAGAIN(rv)) {
-+                ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(00574)
-+                              "ap_content_length_filter: "
-+                              "apr_bucket_read() failed");
-+                return rv;
-+            }
-             if (rv == APR_SUCCESS) {
--                /* Attempt a nonblocking read next time through */
-                 eblock = APR_NONBLOCK_READ;
-+                e = APR_BUCKET_NEXT(e);
-                 r->bytes_sent += len;
-             }
-             else if (APR_STATUS_IS_EAGAIN(rv)) {
--                /* Output everything prior to this bucket, and then
--                 * do a blocking read on the next batch.
--                 */
--                if (e != APR_BRIGADE_FIRST(b)) {
--                    apr_bucket *flush;
--                    apr_brigade_split_ex(b, e, ctx->tmpbb);
--                    flush = apr_bucket_flush_create(r->connection->bucket_alloc);
-+                apr_bucket *flush;
- 
--                    APR_BRIGADE_INSERT_TAIL(b, flush);
--                    rv = ap_pass_brigade(f->next, b);
--                    if (rv != APR_SUCCESS || f->c->aborted) {
--                        return rv;
--                    }
--                    apr_brigade_cleanup(b);
--                    APR_BRIGADE_CONCAT(b, ctx->tmpbb);
--                    e = APR_BRIGADE_FIRST(b);
-+                /* Next read must block. */
-+                eblock = APR_BLOCK_READ;
- 
--                    ctx->data_sent = 1;
--                }
--                eblock = APR_BLOCK_READ;
--                continue;
-+                /* Ensure the last bucket to pass down is a flush if
-+                 * the next read will block. */
-+                flush = apr_bucket_flush_create(f->c->bucket_alloc);
-+                APR_BUCKET_INSERT_BEFORE(e, flush);
-             }
--            else {
--                ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(00574)
--                              "ap_content_length_filter: "
--                              "apr_bucket_read() failed");
--                return rv;
--            }
-         }
--        else {
--            r->bytes_sent += e->length;
-+
-+        /* Optimization: if the next bucket is EOS (directly after a
-+         * bucket morphed to the heap, or a flush), short-cut to
-+         * handle EOS straight away - allowing C-L to be determined
-+         * for content which is already entirely in memory. */
-+        if (e != APR_BRIGADE_SENTINEL(b) && APR_BUCKET_IS_EOS(e)) {
-+            continue;
-         }
--        e = APR_BUCKET_NEXT(e);
-+
-+        /* On reaching here, pass on everything in the brigade up to
-+         * this point. */
-+        apr_brigade_split_ex(b, e, ctx->tmpbb);
-+        
-+        rv = ap_pass_brigade(f->next, b);
-+        if (rv != APR_SUCCESS) {
-+            return rv;
-+        }
-+        else if (f->c->aborted) {
-+            return APR_ECONNABORTED;
-+        }
-+        apr_brigade_cleanup(b);
-+        APR_BRIGADE_CONCAT(b, ctx->tmpbb);
-+        e = APR_BRIGADE_FIRST(b);
-+        
-+        ctx->data_sent = 1;
-     }
- 
-     /* If we've now seen the entire response and it's otherwise

httpd-2.4.27-systemd.patch Deleted

@@ -1,188 +0,0 @@
-diff -uap httpd-2.4.27/modules/arch/unix/config5.m4.systemd httpd-2.4.27/modules/arch/unix/config5.m4
-diff -uap httpd-2.4.27/modules/arch/unix/config5.m4.systemd httpd-2.4.27/modules/arch/unix/config5.m4
-diff -uap httpd-2.4.27/modules/arch/unix/config5.m4.systemd httpd-2.4.27/modules/arch/unix/config5.m4
-diff -uap httpd-2.4.27/modules/arch/unix/config5.m4.systemd httpd-2.4.27/modules/arch/unix/config5.m4
---- httpd-2.4.27/modules/arch/unix/config5.m4.systemd
-+++ httpd-2.4.27/modules/arch/unix/config5.m4
-@@ -18,6 +18,16 @@
-   fi
- ])
- 
-+APACHE_MODULE(systemd, Systemd support, , , all, [
-+  if test "${ac_cv_header_systemd_sd_daemon_h}" = "no" || test -z "${SYSTEMD_LIBS}"; then
-+    AC_MSG_WARN([Your system does not support systemd.])
-+    enable_systemd="no"
-+  else
-+    APR_ADDTO(MOD_SYSTEMD_LDADD, [$SYSTEMD_LIBS])
-+    enable_systemd="yes"
-+  fi
-+])
-+
- APR_ADDTO(INCLUDES, [-I\$(top_srcdir)/$modpath_current])
- 
- APACHE_MODPATH_FINISH
-diff -uap httpd-2.4.27/modules/arch/unix/mod_systemd.c.systemd httpd-2.4.27/modules/arch/unix/mod_systemd.c
---- httpd-2.4.27/modules/arch/unix/mod_systemd.c.systemd
-+++ httpd-2.4.27/modules/arch/unix/mod_systemd.c
-@@ -0,0 +1,161 @@
-+/* Licensed to the Apache Software Foundation (ASF) under one or more
-+ * contributor license agreements.  See the NOTICE file distributed with
-+ * this work for additional information regarding copyright ownership.
-+ * The ASF licenses this file to You under the Apache License, Version 2.0
-+ * (the "License"); you may not use this file except in compliance with
-+ * the License.  You may obtain a copy of the License at
-+ *
-+ *     http://www.apache.org/licenses/LICENSE-2.0
-+ *
-+ * Unless required by applicable law or agreed to in writing, software
-+ * distributed under the License is distributed on an "AS IS" BASIS,
-+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-+ * See the License for the specific language governing permissions and
-+ * limitations under the License.
-+ * 
-+ */
-+
-+#include <stdint.h>
-+#include <ap_config.h>
-+#include "ap_mpm.h"
-+#include <http_core.h>
-+#include <httpd.h>
-+#include <http_log.h>
-+#include <apr_version.h>
-+#include <apr_pools.h>
-+#include <apr_strings.h>
-+#include "unixd.h"
-+#include "scoreboard.h"
-+#include "mpm_common.h"
-+
-+#include "systemd/sd-daemon.h"
-+
-+#if APR_HAVE_UNISTD_H
-+#include <unistd.h>
-+#endif
-+
-+static int shutdown_timer = 0;
-+static int shutdown_counter = 0;
-+static unsigned long bytes_served;
-+static pid_t mainpid;
-+
-+static int systemd_pre_config(apr_pool_t *pconf, apr_pool_t *plog,
-+                              apr_pool_t *ptemp)
-+{
-+    sd_notify(0,
-+              "RELOADING=1\n"
-+              "STATUS=Reading configuration...\n");
-+    ap_extended_status = 1;
-+    return OK;
-+}
-+
-+static int systemd_pre_mpm(apr_pool_t *p, ap_scoreboard_e sb_type)
-+{
-+    int rv;
-+
-+    mainpid = getpid();
-+
-+    rv = sd_notifyf(0, "READY=1\n"
-+                    "STATUS=Processing requests...\n"
-+                    "MAINPID=%" APR_PID_T_FMT, mainpid);
-+    if (rv < 0) {
-+        ap_log_perror(APLOG_MARK, APLOG_ERR, 0, p, APLOGNO(02395)
-+                     "sd_notifyf returned an error %d", rv);
-+    }
-+
-+    return OK;
-+}
-+
-+static int systemd_monitor(apr_pool_t *p, server_rec *s)
-+{
-+    ap_sload_t sload;
-+    apr_interval_time_t up_time;
-+    char bps[5];
-+    int rv;
-+
-+    if (!ap_extended_status) {
-+        /* Nothing useful to report if ExtendedStatus disabled. */
-+        return DECLINED;
-+    }
-+    
-+    ap_get_sload(&sload);
-+    /* up_time in seconds */
-+    up_time = (apr_uint32_t) apr_time_sec(apr_time_now() -
-+                               ap_scoreboard_image->global->restart_time);
-+
-+    apr_strfsize((unsigned long)((float) (sload.bytes_served)
-+                                 / (float) up_time), bps);
-+
-+    rv = sd_notifyf(0, "READY=1\n"
-+                    "STATUS=Total requests: %lu; Idle/Busy workers %d/%d;"
-+                    "Requests/sec: %.3g; Bytes served/sec: %sB/sec\n",
-+                    sload.access_count, sload.idle, sload.busy,
-+                    ((float) sload.access_count) / (float) up_time, bps);
-+
-+    if (rv < 0) {
-+        ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(02396)
-+                     "sd_notifyf returned an error %d", rv);
-+    }
-+
-+    /* Shutdown httpd when nothing is sent for shutdown_timer seconds. */
-+    if (sload.bytes_served == bytes_served) {
-+        /* mpm_common.c: INTERVAL_OF_WRITABLE_PROBES is 10 */
-+        shutdown_counter += 10;
-+        if (shutdown_timer > 0 && shutdown_counter >= shutdown_timer) {
-+            rv = sd_notifyf(0, "READY=1\n"
-+                            "STATUS=Stopped as result of IdleShutdown "
-+                            "timeout.");
-+            if (rv < 0) {
-+                ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(02804)
-+                            "sd_notifyf returned an error %d", rv);
-+            }
-+            kill(mainpid, AP_SIG_GRACEFUL);
-+        }
-+    }
-+    else {
-+        shutdown_counter = 0;
-+    }
-+
-+    bytes_served = sload.bytes_served;
-+
-+    return DECLINED;
-+}
-+
-+static void systemd_register_hooks(apr_pool_t *p)
-+{
-+    /* Enable ap_extended_status. */
-+    ap_hook_pre_config(systemd_pre_config, NULL, NULL, APR_HOOK_LAST);
-+    /* We know the PID in this hook ... */
-+    ap_hook_pre_mpm(systemd_pre_mpm, NULL, NULL, APR_HOOK_LAST);
-+    /* Used to update httpd's status line using sd_notifyf */
-+    ap_hook_monitor(systemd_monitor, NULL, NULL, APR_HOOK_MIDDLE);
-+}
-+
-+static const char *set_shutdown_timer(cmd_parms *cmd, void *dummy,
-+                                      const char *arg)
-+{
-+    const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
-+    if (err != NULL) {
-+        return err;
-+    }
-+
-+    shutdown_timer = atoi(arg);
-+    return NULL;
-+}
-+
-+static const command_rec systemd_cmds[] =
-+{
-+AP_INIT_TAKE1("IdleShutdown", set_shutdown_timer, NULL, RSRC_CONF,
-+     "Number of seconds in idle-state after which httpd is shutdown"),
-+    {NULL}
-+};
-+
-+AP_DECLARE_MODULE(systemd) = {
-+    STANDARD20_MODULE_STUFF,
-+    NULL,
-+    NULL,
-+    NULL,
-+    NULL,
-+    systemd_cmds,
-+    systemd_register_hooks,
-+};

httpd-2.4.3-apctl-systemd.patch Deleted

@@ -1,51 +0,0 @@
-
-Make apachectl run via systemctl.
-
-Note: "apachectl graceful" is documented to start httpd if not running.
-
-Upstream-Status: vendor specific patch
-
---- httpd-2.4.18/support/apachectl.in.apctlsystemd
-+++ httpd-2.4.18/support/apachectl.in
-@@ -100,9 +100,28 @@ fi
- ERROR=$?
- }
- 
-+if [ "x$2" != "x" ] ; then
-+    echo Passing arguments to httpd using apachectl is no longer supported.
-+    echo You can only start/stop/restart httpd using this script.
-+    echo If you want to pass extra arguments to httpd, edit the
-+    echo /etc/sysconfig/httpd config file.
-+fi
-+
- case $ACMD in
--start|stop|restart|graceful|graceful-stop)
--    $HTTPD $OPTIONS -k $ARGV
-+start|stop|restart|status)
-+    /usr/bin/systemctl $ACMD httpd.service
-+    ERROR=$?
-+    ;;
-+graceful)
-+    if /usr/bin/systemctl -q is-active httpd.service; then
-+        /usr/bin/systemctl reload httpd.service
-+    else
-+        /usr/bin/systemctl start httpd.service
-+    fi
-+    ERROR=$?
-+    ;;
-+graceful-stop)
-+    /usr/bin/systemctl stop httpd.service
-     ERROR=$?
-     ;;
- startssl|sslstart|start-SSL)
-@@ -114,10 +133,6 @@ startssl|sslstart|start-SSL)
- configtest)
-     testconfig
-     ;;
--status)
--    checklynx
--    $LYNX $STATUSURL | awk ' /process$/ { print; exit } { print } '
--    ;;
- fullstatus)
-     checklynx
-     $LYNX $STATUSURL

httpd-2.4.3-layout.patch Deleted

@@ -1,33 +0,0 @@
-
-Add layout for Fedora.
-
---- httpd-2.4.3/config.layout.layout
-+++ httpd-2.4.3/config.layout
-@@ -370,3 +370,27 @@
-     logfiledir:      ${localstatedir}/log/httpd
-     proxycachedir:   ${localstatedir}/cache/httpd
- </Layout>
-+
-+# Fedora/RHEL layout
-+<Layout Fedora>
-+    prefix:        /usr
-+    exec_prefix:   ${prefix}
-+    bindir:        ${prefix}/bin
-+    sbindir:       ${prefix}/sbin
-+    libdir:        ${prefix}/lib
-+    libexecdir:    ${prefix}/libexec
-+    mandir:        ${prefix}/man
-+    sysconfdir:    /etc/httpd/conf
-+    datadir:       ${prefix}/share/httpd
-+    installbuilddir: ${libdir}/httpd/build
-+    errordir:      ${datadir}/error
-+    iconsdir:      ${datadir}/icons
-+    htdocsdir:     /var/www/html
-+    manualdir:     ${datadir}/manual
-+    cgidir:        /var/www/cgi-bin
-+    includedir:    ${prefix}/include/httpd
-+    localstatedir: /var
-+    runtimedir:    /run/httpd
-+    logfiledir:    ${localstatedir}/log/httpd
-+    proxycachedir: ${localstatedir}/cache/httpd/proxy
-+</Layout>

httpd-2.4.3-mod_systemd.patch Deleted

@@ -1,163 +0,0 @@
---- httpd-2.4.3/modules/arch/unix/config5.m4.systemd
-+++ httpd-2.4.3/modules/arch/unix/config5.m4
-@@ -18,6 +18,19 @@ APACHE_MODULE(privileges, Per-virtualhos
-   fi
- ])
- 
-+
-+APACHE_MODULE(systemd, Systemd support, , , $unixd_mods_enabled, [
-+  AC_CHECK_LIB(systemd-daemon, sd_notify, SYSTEMD_LIBS="-lsystemd-daemon")
-+  AC_CHECK_HEADERS(systemd/sd-daemon.h, [ap_HAVE_SD_DAEMON_H="yes"], [ap_HAVE_SD_DAEMON_H="no"])
-+  if test $ap_HAVE_SD_DAEMON_H = "no" || test -z "${SYSTEMD_LIBS}"; then
-+    AC_MSG_WARN([Your system does not support systemd.])
-+    enable_systemd="no"
-+  else
-+    APR_ADDTO(MOD_SYSTEMD_LDADD, [$SYSTEMD_LIBS])
-+    enable_systemd="yes"
-+  fi
-+])
-+
- APR_ADDTO(INCLUDES, [-I\$(top_srcdir)/$modpath_current])
- 
- APACHE_MODPATH_FINISH
---- httpd-2.4.3/modules/arch/unix/mod_systemd.c.systemd
-+++ httpd-2.4.3/modules/arch/unix/mod_systemd.c
-@@ -0,0 +1,138 @@
-+/* Licensed to the Apache Software Foundation (ASF) under one or more
-+ * contributor license agreements.  See the NOTICE file distributed with
-+ * this work for additional information regarding copyright ownership.
-+ * The ASF licenses this file to You under the Apache License, Version 2.0
-+ * (the "License"); you may not use this file except in compliance with
-+ * the License.  You may obtain a copy of the License at
-+ *
-+ *     http://www.apache.org/licenses/LICENSE-2.0
-+ *
-+ * Unless required by applicable law or agreed to in writing, software
-+ * distributed under the License is distributed on an "AS IS" BASIS,
-+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-+ * See the License for the specific language governing permissions and
-+ * limitations under the License.
-+ * 
-+ */
-+
-+#include <stdint.h>
-+#include <ap_config.h>
-+#include "ap_mpm.h"
-+#include <http_core.h>
-+#include <http_log.h>
-+#include <apr_version.h>
-+#include <apr_pools.h>
-+#include <apr_strings.h>
-+#include "unixd.h"
-+#include "scoreboard.h"
-+#include "mpm_common.h"
-+
-+#include "systemd/sd-daemon.h"
-+
-+#if APR_HAVE_UNISTD_H
-+#include <unistd.h>
-+#endif
-+
-+#define KBYTE 1024
-+
-+static pid_t pid;	/* PID of the main httpd instance */
-+static int server_limit, thread_limit, threads_per_child, max_servers;
-+static time_t last_update_time;
-+static unsigned long last_update_access;
-+static unsigned long last_update_kbytes;
-+
-+static int systemd_pre_mpm(apr_pool_t *p, ap_scoreboard_e sb_type)
-+{
-+    int rv;
-+    last_update_time = time(0);
-+
-+    ap_mpm_query(AP_MPMQ_HARD_LIMIT_THREADS, &thread_limit);
-+    ap_mpm_query(AP_MPMQ_HARD_LIMIT_DAEMONS, &server_limit);
-+    ap_mpm_query(AP_MPMQ_MAX_THREADS, &threads_per_child);
-+    /* work around buggy MPMs */
-+    if (threads_per_child == 0)
-+        threads_per_child = 1;
-+    ap_mpm_query(AP_MPMQ_MAX_DAEMONS, &max_servers);
-+
-+    pid = getpid();
-+    
-+    rv = sd_notifyf(0, "READY=1\n"
-+                    "STATUS=Processing requests...\n"
-+                    "MAINPID=%lu",
-+                    (unsigned long) pid);
-+    if (rv < 0) {
-+        ap_log_perror(APLOG_MARK, APLOG_ERR, 0, p, 
-+                     "sd_notifyf returned an error %d", rv);
-+    }
-+
-+    return OK;
-+}
-+
-+static int systemd_monitor(apr_pool_t *p, server_rec *s)
-+{
-+    int i, j, res, rv;
-+    process_score *ps_record;
-+    worker_score *ws_record;
-+    unsigned long access = 0;
-+    unsigned long bytes = 0;
-+    unsigned long kbytes = 0;
-+    char bps[5];
-+    time_t now = time(0);
-+    time_t elapsed = now - last_update_time;
-+
-+    for (i = 0; i < server_limit; ++i) {
-+        ps_record = ap_get_scoreboard_process(i);
-+        for (j = 0; j < thread_limit; ++j) {
-+            ws_record = ap_get_scoreboard_worker_from_indexes(i, j);
-+            if (ap_extended_status && !ps_record->quiescing && ps_record->pid) {
-+                res = ws_record->status;
-+                if (ws_record->access_count != 0 || 
-+                    (res != SERVER_READY && res != SERVER_DEAD)) {
-+                    access += ws_record->access_count;
-+                    bytes += ws_record->bytes_served;
-+                    if (bytes >= KBYTE) {
-+                        kbytes += (bytes >> 10);
-+                        bytes = bytes & 0x3ff;
-+                    }
-+                }
-+            }
-+        }
-+    }
-+
-+    apr_strfsize((unsigned long)(KBYTE *(float) (kbytes - last_update_kbytes)
-+                                 / (float) elapsed), bps);
-+
-+    rv = sd_notifyf(0, "READY=1\n"
-+                    "STATUS=Total requests: %lu; Current requests/sec: %.3g; "
-+                    "Current traffic: %sB/sec\n", access,
-+                    ((float)access - last_update_access) / (float) elapsed, bps);
-+    if (rv < 0) {
-+        ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(00000)
-+                     "sd_notifyf returned an error %d", rv);
-+    }
-+
-+    last_update_access = access;
-+    last_update_kbytes = kbytes;
-+    last_update_time = now;
-+
-+    return DECLINED;
-+}
-+
-+static void systemd_register_hooks(apr_pool_t *p)
-+{
-+    /* We know the PID in this hook ... */
-+    ap_hook_pre_mpm(systemd_pre_mpm, NULL, NULL, APR_HOOK_LAST);
-+    /* Used to update httpd's status line using sd_notifyf */
-+    ap_hook_monitor(systemd_monitor, NULL, NULL, APR_HOOK_MIDDLE);
-+}
-+
-+module AP_MODULE_DECLARE_DATA systemd_module =
-+{
-+    STANDARD20_MODULE_STUFF,
-+    NULL,
-+    NULL,
-+    NULL,
-+    NULL,
-+    NULL,
-+    systemd_register_hooks,
-+};

httpd-2.4.33-export.patch Added

httpd-2.4.33-sslmultiproxy.patch Added

@@ -0,0 +1,126 @@
+From ce2d1d7d4b2bebe34cf37fdeb30d35050092c5b5 Mon Sep 17 00:00:00 2001
+From: Rob Crittenden <rcrit@cow.greyoak.com>
+Date: Thu, 12 Apr 2018 14:36:28 -0400
+Subject: [PATCH] httpd-2.4.18-sslmultiproxy.patch
+
+---
+ modules/ssl/mod_ssl.c         | 24 ++++++++++++++++++++++--
+ modules/ssl/ssl_engine_vars.c | 18 +++++++++++++++++-
+ 2 files changed, 39 insertions(+), 3 deletions(-)
+
+diff --git a/modules/ssl/mod_ssl.c b/modules/ssl/mod_ssl.c
+index 48d64cb..42e85a3 100644
+diff -uap httpd-2.4.33/modules/ssl/mod_ssl.c.sslmultiproxy httpd-2.4.33/modules/ssl/mod_ssl.c
+--- httpd-2.4.33/modules/ssl/mod_ssl.c.sslmultiproxy
++++ httpd-2.4.33/modules/ssl/mod_ssl.c
+@@ -444,12 +444,19 @@
+     return OK;
+ }
+ 
++static APR_OPTIONAL_FN_TYPE(ssl_engine_disable) *othermod_engine_disable;
++static APR_OPTIONAL_FN_TYPE(ssl_engine_set) *othermod_engine_set;
++
+ static SSLConnRec *ssl_init_connection_ctx(conn_rec *c,
+                                            ap_conf_vector_t *per_dir_config)
+ {
+     SSLConnRec *sslconn = myConnConfig(c);
+     SSLSrvConfigRec *sc;
+ 
++    if (othermod_engine_disable) {
++        othermod_engine_disable(c);
++    }
++
+     if (sslconn) {
+         return sslconn;
+     }
+@@ -508,6 +515,10 @@
+ {
+     SSLConnRec *sslconn;
+     int status;
++
++    if (othermod_engine_set) {
++        return othermod_engine_set(c, per_dir_config, proxy, enable);
++    }
+     
+     if (proxy) {
+         sslconn = ssl_init_connection_ctx(c, per_dir_config);
+@@ -537,12 +548,18 @@
+ 
+ static int ssl_proxy_enable(conn_rec *c)
+ {
+-    return ssl_engine_set(c, NULL, 1, 1);
++    if (othermod_engine_set)
++        return othermod_engine_set(c, NULL, 1, 1);
++    else
++        return ssl_engine_set(c, NULL, 1, 1);
+ }
+ 
+ static int ssl_engine_disable(conn_rec *c)
+ {
+-    return ssl_engine_set(c, NULL, 0, 0);
++    if (othermod_engine_set)
++        return othermod_engine_set(c, NULL, 0, 0);
++    else
++        return ssl_engine_set(c, NULL, 0, 0);
+ }
+ 
+ int ssl_init_ssl_connection(conn_rec *c, request_rec *r)
+@@ -730,6 +747,9 @@
+                       APR_HOOK_MIDDLE);
+ 
+     ssl_var_register(p);
++    
++    othermod_engine_disable = APR_RETRIEVE_OPTIONAL_FN(ssl_engine_disable);
++    othermod_engine_set = APR_RETRIEVE_OPTIONAL_FN(ssl_engine_set);
+ 
+     APR_REGISTER_OPTIONAL_FN(ssl_proxy_enable);
+     APR_REGISTER_OPTIONAL_FN(ssl_engine_disable);
+diff -uap httpd-2.4.33/modules/ssl/ssl_engine_vars.c.sslmultiproxy httpd-2.4.33/modules/ssl/ssl_engine_vars.c
+--- httpd-2.4.33/modules/ssl/ssl_engine_vars.c.sslmultiproxy
++++ httpd-2.4.33/modules/ssl/ssl_engine_vars.c
+@@ -54,6 +54,8 @@
+ static void  ssl_var_lookup_ssl_cipher_bits(SSL *ssl, int *usekeysize, int *algkeysize);
+ static char *ssl_var_lookup_ssl_version(apr_pool_t *p, char *var);
+ static char *ssl_var_lookup_ssl_compress_meth(SSL *ssl);
++static APR_OPTIONAL_FN_TYPE(ssl_is_https) *othermod_is_https;
++static APR_OPTIONAL_FN_TYPE(ssl_var_lookup) *othermod_var_lookup;
+ 
+ static SSLConnRec *ssl_get_effective_config(conn_rec *c)
+ {
+@@ -68,7 +70,9 @@
+ static int ssl_is_https(conn_rec *c)
+ {
+     SSLConnRec *sslconn = ssl_get_effective_config(c);
+-    return sslconn && sslconn->ssl;
++
++    return (sslconn && sslconn->ssl)
++        || (othermod_is_https && othermod_is_https(c));
+ }
+ 
+ static const char var_interface[] = "mod_ssl/" AP_SERVER_BASEREVISION;
+@@ -137,6 +141,9 @@
+ {
+     char *cp, *cp2;
+ 
++    othermod_is_https = APR_RETRIEVE_OPTIONAL_FN(ssl_is_https);
++    othermod_var_lookup = APR_RETRIEVE_OPTIONAL_FN(ssl_var_lookup);
++
+     APR_REGISTER_OPTIONAL_FN(ssl_is_https);
+     APR_REGISTER_OPTIONAL_FN(ssl_var_lookup);
+     APR_REGISTER_OPTIONAL_FN(ssl_ext_list);
+@@ -271,6 +278,15 @@
+      */
+     if (result == NULL && c != NULL) {
+         SSLConnRec *sslconn = ssl_get_effective_config(c);
++
++        if (strlen(var) > 4 && strcEQn(var, "SSL_", 4)
++            && (!sslconn || !sslconn->ssl) && othermod_var_lookup) {
++            /* For an SSL_* variable, if mod_ssl is not enabled for
++             * this connection and another SSL module is present, pass
++             * through to that module. */
++            return othermod_var_lookup(p, s, c, r, var);
++        }
++
+         if (strlen(var) > 4 && strcEQn(var, "SSL_", 4)
+             && sslconn && sslconn->ssl)
+             result = ssl_var_lookup_ssl(p, sslconn, r, var+4);

httpd-2.4.33-systemd.patch Added

@@ -0,0 +1,245 @@
+--- httpd-2.4.33/modules/arch/unix/config5.m4.systemd
++++ httpd-2.4.33/modules/arch/unix/config5.m4
+@@ -18,6 +18,16 @@
+   fi
+ ])
+ 
++APACHE_MODULE(systemd, Systemd support, , , all, [
++  if test "${ac_cv_header_systemd_sd_daemon_h}" = "no" || test -z "${SYSTEMD_LIBS}"; then
++    AC_MSG_WARN([Your system does not support systemd.])
++    enable_systemd="no"
++  else
++    APR_ADDTO(MOD_SYSTEMD_LDADD, [$SYSTEMD_LIBS])
++    enable_systemd="yes"
++  fi
++])
++
+ APR_ADDTO(INCLUDES, [-I\$(top_srcdir)/$modpath_current])
+ 
+ APACHE_MODPATH_FINISH
+--- httpd-2.4.33/modules/arch/unix/mod_systemd.c.systemd
++++ httpd-2.4.33/modules/arch/unix/mod_systemd.c
+@@ -0,0 +1,223 @@
++/* Licensed to the Apache Software Foundation (ASF) under one or more
++ * contributor license agreements.  See the NOTICE file distributed with
++ * this work for additional information regarding copyright ownership.
++ * The ASF licenses this file to You under the Apache License, Version 2.0
++ * (the "License"); you may not use this file except in compliance with
++ * the License.  You may obtain a copy of the License at
++ *
++ *     http://www.apache.org/licenses/LICENSE-2.0
++ *
++ * Unless required by applicable law or agreed to in writing, software
++ * distributed under the License is distributed on an "AS IS" BASIS,
++ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
++ * See the License for the specific language governing permissions and
++ * limitations under the License.
++ * 
++ */
++
++#include <stdint.h>
++#include <ap_config.h>
++#include "ap_mpm.h"
++#include <http_core.h>
++#include <httpd.h>
++#include <http_log.h>
++#include <apr_version.h>
++#include <apr_pools.h>
++#include <apr_strings.h>
++#include "unixd.h"
++#include "scoreboard.h"
++#include "mpm_common.h"
++
++#include "systemd/sd-daemon.h"
++#include "systemd/sd-journal.h"
++
++#if APR_HAVE_UNISTD_H
++#include <unistd.h>
++#endif
++
++static int shutdown_timer = 0;
++static int shutdown_counter = 0;
++static unsigned long bytes_served;
++static pid_t mainpid;
++static char describe_listeners[50];
++
++static int systemd_pre_config(apr_pool_t *pconf, apr_pool_t *plog,
++                              apr_pool_t *ptemp)
++{
++    sd_notify(0,
++              "RELOADING=1\n"
++              "STATUS=Reading configuration...\n");
++    ap_extended_status = 1;
++    return OK;
++}
++
++static char *dump_listener(ap_listen_rec *lr, apr_pool_t *p)
++{
++    apr_sockaddr_t *sa = lr->bind_addr;
++    char addr[128];
++
++    if (apr_sockaddr_is_wildcard(sa)) {
++        return apr_pstrcat(p, "port ", apr_itoa(p, sa->port), NULL);
++    }
++
++    apr_sockaddr_ip_getbuf(addr, sizeof addr, sa);
++
++    return apr_psprintf(p, "%s port %u", addr, sa->port);
++}
++
++static int systemd_post_config(apr_pool_t *pconf, apr_pool_t *plog,
++                               apr_pool_t *ptemp, server_rec *s)
++{
++    ap_listen_rec *lr;
++    apr_size_t plen = sizeof describe_listeners;
++    char *p = describe_listeners;
++
++    if (ap_state_query(AP_SQ_MAIN_STATE) == AP_SQ_MS_CREATE_PRE_CONFIG)
++        return OK;
++
++    for (lr = ap_listeners; lr; lr = lr->next) {
++        char *s = dump_listener(lr, ptemp);
++
++        if (strlen(s) + 3 < plen) {
++            char *newp = apr_cpystrn(p, s, plen);
++            if (lr->next)
++                newp = apr_cpystrn(newp, ", ", 3);
++            plen -= newp - p;
++            p = newp;
++        }
++        else {
++            if (plen < 4) {
++                p = describe_listeners + sizeof describe_listeners - 4;
++                plen = 4;
++            }
++            apr_cpystrn(p, "...", plen);
++            break;
++        }
++    }
++
++    sd_journal_print(LOG_INFO, "Server configured, listening on: %s", describe_listeners);
++
++    return OK;
++}
++
++static int systemd_pre_mpm(apr_pool_t *p, ap_scoreboard_e sb_type)
++{
++    int rv;
++
++    mainpid = getpid();
++
++    rv = sd_notifyf(0, "READY=1\n"
++                    "STATUS=Started, listening on: %s\n"
++                    "MAINPID=%" APR_PID_T_FMT,
++                    describe_listeners, mainpid);
++    if (rv < 0) {
++        ap_log_perror(APLOG_MARK, APLOG_ERR, 0, p, APLOGNO(02395)
++                     "sd_notifyf returned an error %d", rv);
++    }
++
++    return OK;
++}
++
++static int systemd_monitor(apr_pool_t *p, server_rec *s)
++{
++    ap_sload_t sload;
++    apr_interval_time_t up_time;
++    char bps[5];
++    int rv;
++
++    if (!ap_extended_status) {
++        /* Nothing useful to report if ExtendedStatus disabled. */
++        return DECLINED;
++    }
++    
++    ap_get_sload(&sload);
++
++    if (sload.access_count == 0) {
++        rv = sd_notifyf(0, "READY=1\n"
++                        "STATUS=Running, listening on: %s\n",
++                        describe_listeners);
++    }
++    else {
++        /* up_time in seconds */
++        up_time = (apr_uint32_t) apr_time_sec(apr_time_now() -
++                                              ap_scoreboard_image->global->restart_time);
++
++        apr_strfsize((unsigned long)((float) (sload.bytes_served)
++                                     / (float) up_time), bps);
++
++        rv = sd_notifyf(0, "READY=1\n"
++                        "STATUS=Total requests: %lu; Idle/Busy workers %d/%d;"
++                        "Requests/sec: %.3g; Bytes served/sec: %sB/sec\n",
++                        sload.access_count, sload.idle, sload.busy,
++                        ((float) sload.access_count) / (float) up_time, bps);
++    }
++
++    if (rv < 0) {
++        ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(02396)
++                     "sd_notifyf returned an error %d", rv);
++    }
++
++    /* Shutdown httpd when nothing is sent for shutdown_timer seconds. */
++    if (sload.bytes_served == bytes_served) {
++        /* mpm_common.c: INTERVAL_OF_WRITABLE_PROBES is 10 */
++        shutdown_counter += 10;
++        if (shutdown_timer > 0 && shutdown_counter >= shutdown_timer) {
++            rv = sd_notifyf(0, "READY=1\n"
++                            "STATUS=Stopped as result of IdleShutdown "
++                            "timeout.");
++            if (rv < 0) {
++                ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(02804)
++                            "sd_notifyf returned an error %d", rv);
++            }
++            kill(mainpid, AP_SIG_GRACEFUL);
++        }
++    }
++    else {
++        shutdown_counter = 0;
++    }

httpd-2.4.34-enable-sslv3.patch Added

@@ -0,0 +1,61 @@
+
+https://bugzilla.redhat.com/show_bug.cgi?id=1623165
+
+--- httpd-2.4.34/modules/ssl/ssl_engine_config.c.enable-sslv3
++++ httpd-2.4.34/modules/ssl/ssl_engine_config.c
+@@ -1474,6 +1474,10 @@
+ #endif
+         else if (strcEQ(w, "all")) {
+             thisopt = SSL_PROTOCOL_ALL;
++#ifndef OPENSSL_NO_SSL3
++            /* by default, ALL kw doesn't turn on SSLv3 */
++            thisopt &= ~SSL_PROTOCOL_SSLV3;
++#endif
+         }
+         else {
+             return apr_pstrcat(parms->temp_pool,
+--- httpd-2.4.34/modules/ssl/ssl_engine_init.c.enable-sslv3
++++ httpd-2.4.34/modules/ssl/ssl_engine_init.c
+@@ -537,6 +537,28 @@
+ }
+ #endif
+ 
++/*
++ * Enable/disable SSLProtocol. If the mod_ssl enables protocol
++ * which is disabled by default by OpenSSL, show a warning.
++ * "option" is for example SSL_OP_NO_SSLv3.
++ */
++static void ssl_set_ctx_protocol_option(server_rec *s,
++                                        SSL_CTX *ctx,
++                                        long option,
++                                        int enabled,
++                                        const char *name)
++{
++      if (!enabled) {
++                SSL_CTX_set_options(ctx, option);
++      }
++      else if (SSL_CTX_get_options(ctx) & option) {
++                    SSL_CTX_clear_options(ctx, option);
++                    ap_log_error(APLOG_MARK, APLOG_WARNING, 0, s, APLOGNO(02904)
++                                 "Allowing SSLProtocol %s even though it is disabled "
++                                 "by OpenSSL by default on this system", name);
++      }
++}
++
+ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
+                                           apr_pool_t *p,
+                                           apr_pool_t *ptemp,
+@@ -687,9 +709,13 @@
+     }
+     if (prot == TLS1_1_VERSION && protocol & SSL_PROTOCOL_TLSV1) {
+         prot = TLS1_VERSION;
++        ssl_set_ctx_protocol_option(s, ctx, SSL_OP_NO_TLSv1,
++                                    protocol & SSL_PROTOCOL_TLSV1, "TLSv1");
+     }
+ #ifndef OPENSSL_NO_SSL3
+     if (prot == TLS1_VERSION && protocol & SSL_PROTOCOL_SSLV3) {
++        ssl_set_ctx_protocol_option(s, ctx, SSL_OP_NO_SSLv3,
++                                    protocol & SSL_PROTOCOL_SSLV3, "SSLv3");
+         prot = SSL3_VERSION;
+     }
+ #endif

httpd-2.4.25-r1738878.patch -> httpd-2.4.34-r1738878.patch Changed

@@ -1,28 +1,6 @@
-diff --git a/modules/proxy/ajp.h b/modules/proxy/ajp.h
-index c119a7e..267150a 100644
---- a/modules/proxy/ajp.h
-+++ b/modules/proxy/ajp.h
-@@ -413,12 +413,14 @@ apr_status_t ajp_ilink_receive(apr_socket_t *sock, ajp_msg_t *msg);
-  * @param sock      backend socket
-  * @param r         current request
-  * @param buffsize  max size of the AJP packet.
-+ * @param secret    authentication secret
-  * @param uri       requested uri
-  * @return          APR_SUCCESS or error
-  */
- apr_status_t ajp_send_header(apr_socket_t *sock, request_rec *r,
-                              apr_size_t buffsize,
--                             apr_uri_t *uri);
-+                             apr_uri_t *uri,
-+                             const char *secret);
- 
- /**
-  * Read the ajp message and return the type of the message.
-diff --git a/modules/proxy/ajp_header.c b/modules/proxy/ajp_header.c
-index 67353a7..680a8f3 100644
---- a/modules/proxy/ajp_header.c
-+++ b/modules/proxy/ajp_header.c
-@@ -213,7 +213,8 @@ AJPV13_REQUEST/AJPV14_REQUEST=
+--- httpd-2.4.34/modules/proxy/ajp_header.c.r1738878
++++ httpd-2.4.34/modules/proxy/ajp_header.c
+@@ -213,7 +213,8 @@
  
  static apr_status_t ajp_marshal_into_msgb(ajp_msg_t *msg,
                                            request_rec *r,
@@ -32,7 +10,7 @@
  {
      int method;
      apr_uint32_t i, num_headers = 0;
-@@ -293,17 +294,15 @@ static apr_status_t ajp_marshal_into_msgb(ajp_msg_t *msg,
+@@ -293,17 +294,15 @@
                     i, elts[i].key, elts[i].val);
      }
  
@@ -53,7 +31,7 @@
  
      if (r->user) {
          if (ajp_msg_append_uint8(msg, SC_A_REMOTE_USER) ||
-@@ -671,7 +670,8 @@ static apr_status_t ajp_unmarshal_response(ajp_msg_t *msg,
+@@ -671,7 +670,8 @@
  apr_status_t ajp_send_header(apr_socket_t *sock,
                               request_rec *r,
                               apr_size_t buffsize,
@@ -63,7 +41,7 @@
  {
      ajp_msg_t *msg;
      apr_status_t rc;
-@@ -683,7 +683,7 @@ apr_status_t ajp_send_header(apr_socket_t *sock,
+@@ -683,7 +683,7 @@
          return rc;
      }
  
@@ -72,48 +50,27 @@
      if (rc != APR_SUCCESS) {
          ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(00988)
                 "ajp_send_header: ajp_marshal_into_msgb failed");
-diff --git a/modules/proxy/mod_proxy.c b/modules/proxy/mod_proxy.c
-index f6fb473..f693f63 100644
---- a/modules/proxy/mod_proxy.c
-+++ b/modules/proxy/mod_proxy.c
-@@ -314,6 +314,12 @@ static const char *set_worker_param(apr_pool_t *p,
-                                 (int)sizeof(worker->s->upgrade));
-         }
-     }
-+    else if (!strcasecmp(key, "secret")) {
-+        if (PROXY_STRNCPY(worker->s->secret, val) != APR_SUCCESS) {
-+            return apr_psprintf(p, "Secret length must be < %d characters",
-+                                (int)sizeof(worker->s->secret));
-+        }
-+    }
-     else {
-         if (set_worker_hc_param_f) {
-             return set_worker_hc_param_f(p, s, worker, key, val, NULL);
-diff --git a/modules/proxy/mod_proxy.h b/modules/proxy/mod_proxy.h
-index 8a0ad10..f92c185 100644
---- a/modules/proxy/mod_proxy.h
-+++ b/modules/proxy/mod_proxy.h
-@@ -352,6 +352,7 @@ PROXY_WORKER_HC_FAIL )
- #define PROXY_WORKER_MAX_HOSTNAME_SIZE  64
- #define PROXY_BALANCER_MAX_HOSTNAME_SIZE PROXY_WORKER_MAX_HOSTNAME_SIZE
- #define PROXY_BALANCER_MAX_STICKY_SIZE  64
-+#define PROXY_WORKER_MAX_SECRET_SIZE    64
- 
- /* RFC-1035 mentions limits of 255 for host-names and 253 for domain-names,
-  * dotted together(?) this would fit the below size (+ trailing NUL).
-@@ -443,6 +444,7 @@ typedef struct {
-     hcmethod_t      method;     /* method to use for health check */
-     apr_interval_time_t interval;
-     char      upgrade[PROXY_WORKER_MAX_SCHEME_SIZE];/* upgrade protocol used by mod_proxy_wstunnel */
-+    char      secret[PROXY_WORKER_MAX_SECRET_SIZE]; /* authentication secret (e.g. AJP13) */
- } proxy_worker_shared;
+--- httpd-2.4.34/modules/proxy/ajp.h.r1738878
++++ httpd-2.4.34/modules/proxy/ajp.h
+@@ -413,12 +413,14 @@
+  * @param sock      backend socket
+  * @param r         current request
+  * @param buffsize  max size of the AJP packet.
++ * @param secret    authentication secret
+  * @param uri       requested uri
+  * @return          APR_SUCCESS or error
+  */
+ apr_status_t ajp_send_header(apr_socket_t *sock, request_rec *r,
+                              apr_size_t buffsize,
+-                             apr_uri_t *uri);
++                             apr_uri_t *uri,
++                             const char *secret);
  
- #define ALIGNED_PROXY_WORKER_SHARED_SIZE (APR_ALIGN_DEFAULT(sizeof(proxy_worker_shared)))
-diff --git a/modules/proxy/mod_proxy_ajp.c b/modules/proxy/mod_proxy_ajp.c
-index 051724e..e706518 100644
---- a/modules/proxy/mod_proxy_ajp.c
-+++ b/modules/proxy/mod_proxy_ajp.c
-@@ -193,6 +193,7 @@ static int ap_proxy_ajp_request(apr_pool_t *p, request_rec *r,
+ /**
+  * Read the ajp message and return the type of the message.
+--- httpd-2.4.34/modules/proxy/mod_proxy_ajp.c.r1738878
++++ httpd-2.4.34/modules/proxy/mod_proxy_ajp.c
+@@ -193,6 +193,7 @@
      apr_off_t content_length = 0;
      int original_status = r->status;
      const char *original_status_line = r->status_line;
@@ -121,7 +78,7 @@
  
      if (psf->io_buffer_size_set)
         maxsize = psf->io_buffer_size;
-@@ -202,12 +203,15 @@ static int ap_proxy_ajp_request(apr_pool_t *p, request_rec *r,
+@@ -202,12 +203,15 @@
         maxsize = AJP_MSG_BUFFER_SZ;
      maxsize = APR_ALIGN(maxsize, 1024);
  
@@ -138,3 +95,36 @@
      if (status != APR_SUCCESS) {
          conn->close = 1;
          ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(00868)
+--- httpd-2.4.34/modules/proxy/mod_proxy.c.r1738878
++++ httpd-2.4.34/modules/proxy/mod_proxy.c
+@@ -319,6 +319,12 @@
+                                 (int)sizeof(worker->s->upgrade));
+         }
+     }
++    else if (!strcasecmp(key, "secret")) {
++        if (PROXY_STRNCPY(worker->s->secret, val) != APR_SUCCESS) {
++            return apr_psprintf(p, "Secret length must be < %d characters",
++                                (int)sizeof(worker->s->secret));
++        }
++    }
+     else if (!strcasecmp(key, "responsefieldsize")) {
+         long s = atol(val);
+         if (s < 0) {
+--- httpd-2.4.34/modules/proxy/mod_proxy.h.r1738878
++++ httpd-2.4.34/modules/proxy/mod_proxy.h
+@@ -357,6 +357,7 @@
+ #define PROXY_WORKER_MAX_HOSTNAME_SIZE  64
+ #define PROXY_BALANCER_MAX_HOSTNAME_SIZE PROXY_WORKER_MAX_HOSTNAME_SIZE
+ #define PROXY_BALANCER_MAX_STICKY_SIZE  64
++#define PROXY_WORKER_MAX_SECRET_SIZE    64
+ 
+ #define PROXY_RFC1035_HOSTNAME_SIZE	256
+ 
+@@ -453,6 +454,7 @@
+     char      hostname_ex[PROXY_RFC1035_HOSTNAME_SIZE];  /* RFC1035 compliant version of the remote backend address */
+     apr_size_t   response_field_size; /* Size of proxy response buffer in bytes. */
+     unsigned int response_field_size_set:1;
++    char      secret[PROXY_WORKER_MAX_SECRET_SIZE]; /* authentication secret (e.g. AJP13) */
+ } proxy_worker_shared;
+ 
+ #define ALIGNED_PROXY_WORKER_SHARED_SIZE (APR_ALIGN_DEFAULT(sizeof(proxy_worker_shared)))

httpd-2.4.34-sslciphdefault.patch Added

@@ -0,0 +1,34 @@
+
+https://bugzilla.redhat.com/show_bug.cgi?id=1109119
+
+Don't prepend !aNULL etc if PROFILE= is used with SSLCipherSuite.
+
+--- httpd-2.4.34/modules/ssl/ssl_engine_config.c.sslciphdefault
++++ httpd-2.4.34/modules/ssl/ssl_engine_config.c
+@@ -774,9 +774,11 @@
+     }
+     
+     if (!strcmp("SSL", arg1)) {
+-        /* always disable null and export ciphers */
+-        arg2 = apr_pstrcat(cmd->pool, arg2, ":!aNULL:!eNULL:!EXP", NULL);
+         if (cmd->path) {
++            /* Disable null and export ciphers by default, except for PROFILE=
++             * configs where the parser doesn't cope. */
++            if (strncmp(arg2, "PROFILE=", 8) != 0)
++                arg2 = apr_pstrcat(cmd->pool, arg2, ":!aNULL:!eNULL:!EXP", NULL);
+             dc->szCipherSuite = arg2;
+         }
+         else {
+@@ -1540,8 +1542,10 @@
+     }
+     
+     if (!strcmp("SSL", arg1)) {
+-        /* always disable null and export ciphers */
+-        arg2 = apr_pstrcat(cmd->pool, arg2, ":!aNULL:!eNULL:!EXP", NULL);
++        /* Disable null and export ciphers by default, except for PROFILE=
++         * configs where the parser doesn't cope. */
++        if (strncmp(arg2, "PROFILE=", 8) != 0)
++            arg2 = apr_pstrcat(cmd->pool, arg2, ":!aNULL:!eNULL:!EXP", NULL);
+         dc->proxy->auth.cipher_suite = arg2;
+         return NULL;
+     }

httpd-2.4.37-r1842929+.patch Added

@@ -0,0 +1,326 @@
+# ./pullrev.sh 1842929 1842931
+http://svn.apache.org/viewvc?view=revision&revision=1842929
+http://svn.apache.org/viewvc?view=revision&revision=1842931
+http://svn.apache.org/viewvc?view=revision&revision=1852982
+
+--- httpd-2.4.38/acinclude.m4.r1842929+
++++ httpd-2.4.38/acinclude.m4
+@@ -45,6 +45,7 @@
+   APACHE_SUBST(installbuilddir)
+   APACHE_SUBST(runtimedir)
+   APACHE_SUBST(proxycachedir)
++  APACHE_SUBST(statedir)
+   APACHE_SUBST(other_targets)
+   APACHE_SUBST(progname)
+   APACHE_SUBST(prefix)
+@@ -663,6 +664,7 @@
+   APACHE_SUBST_EXPANDED_ARG(runtimedir)
+   APACHE_SUBST_EXPANDED_ARG(logfiledir)
+   APACHE_SUBST_EXPANDED_ARG(proxycachedir)
++  APACHE_SUBST_EXPANDED_ARG(statedir)
+ ])
+ 
+ dnl 
+--- httpd-2.4.38/config.layout.r1842929+
++++ httpd-2.4.38/config.layout
+@@ -29,6 +29,7 @@
+     includedir:    ${prefix}/include
+     localstatedir: ${prefix}
+     runtimedir:    ${localstatedir}/logs
++    statedir:      ${localstatedir}/state
+     logfiledir:    ${localstatedir}/logs
+     proxycachedir: ${localstatedir}/proxy
+ </Layout>
+@@ -54,6 +55,7 @@
+     includedir:    ${prefix}/include+
+     localstatedir: ${prefix}/var+
+     runtimedir:    ${localstatedir}/run
++    statedir:      ${localstatedir}/state
+     logfiledir:    ${localstatedir}/log
+     proxycachedir: ${localstatedir}/proxy
+ </Layout>
+@@ -78,6 +80,7 @@
+     includedir:    /System/Library/Frameworks/Apache.framework/Versions/2.0/Headers
+     localstatedir: /var
+     runtimedir:    ${prefix}/Logs
++    statedir:      ${prefix}/State
+     logfiledir:    ${prefix}/Logs
+     proxycachedir: ${prefix}/ProxyCache
+ </Layout>
+@@ -102,6 +105,7 @@
+     includedir:    ${prefix}/include+
+     localstatedir: /var
+     runtimedir:    ${localstatedir}/run
++    statedir:      ${localstatedir}/state
+     logfiledir:    ${localstatedir}/log+
+     proxycachedir: ${runtimedir}/proxy
+ </Layout>
+@@ -126,6 +130,7 @@
+     includedir:    ${prefix}/include/apache
+     localstatedir: /var
+     runtimedir:    ${localstatedir}/run
++    statedir:      ${localstatedir}/lib/httpd
+     logfiledir:    ${localstatedir}/log/httpd
+     proxycachedir: ${localstatedir}/cache/httpd
+ </Layout>     
+@@ -151,6 +156,7 @@
+     includedir:    ${prefix}/include/httpd
+     runtimedir:    /run/httpd
+     logfiledir:    ${localstatedir}/log/httpd
++    statedir:      ${localstatedir}/lib/httpd
+     proxycachedir: ${localstatedir}/cache/httpd/proxy
+ </Layout>     
+ 
+@@ -175,6 +181,7 @@
+     localstatedir: /var${prefix}
+     runtimedir:    ${localstatedir}/run
+     logfiledir:    ${localstatedir}/logs
++    statedir:      ${localstatedir}/state
+     proxycachedir: ${localstatedir}/proxy
+ </Layout>
+ 
+@@ -197,6 +204,7 @@
+     cgidir:        ${datadir}/cgi-bin
+     includedir:    ${prefix}/include/apache
+     localstatedir: /var/lib/httpd
++    statedir:      ${localstatedir}
+     runtimedir:    /var/run
+     logfiledir:    /var/log/httpd
+     proxycachedir: /var/cache/httpd
+@@ -223,6 +231,7 @@
+     localstatedir: /var
+     runtimedir:    ${localstatedir}/run
+     logfiledir:    ${localstatedir}/log/httpd
++    statedir:      ${prefix}/state
+     proxycachedir: ${localstatedir}/proxy
+ </Layout>
+ 
+@@ -246,6 +255,7 @@
+     includedir:    ${exec_prefix}/include
+     localstatedir: ${prefix}
+     runtimedir:    /var/run
++    statedir:      ${datadir}/state
+     logfiledir:    ${datadir}/logs
+     proxycachedir: ${datadir}/proxy
+ </Layout>
+@@ -271,6 +281,7 @@
+     localstatedir: ${prefix}
+     runtimedir:    ${prefix}/logs
+     logfiledir:    ${prefix}/logs
++    statedir:      ${prefix}/state
+     proxycachedir: ${prefix}/proxy
+ </Layout>
+ 
+@@ -315,6 +326,7 @@
+     cgidir:        ${prefix}/usr/lib/cgi-bin
+     includedir:    ${exec_prefix}/include/apache2
+     localstatedir: ${prefix}/var/lock/apache2
++    statedir:      ${prefix}/var/lib/apache2
+     runtimedir:    ${prefix}/var/run/apache2
+     logfiledir:    ${prefix}/var/log/apache2
+     proxycachedir: ${prefix}/var/cache/apache2/proxy
+@@ -343,6 +355,7 @@
+     manualdir:     ${datadir}/manual
+     cgidir:        ${datadir}/cgi-bin
+     runtimedir:    ${localstatedir}/run
++    runtimedir:    ${localstatedir}/lib/httpd
+     logfiledir:    ${localstatedir}/log/httpd
+     proxycachedir: ${localstatedir}/cache/httpd/cache-root
+ </Layout>
+@@ -366,6 +379,7 @@
+     manualdir:     ${prefix}/manual
+     includedir:    ${prefix}/include
+     localstatedir: /var/httpd
++    statedir:      ${localstatedir}/state
+     runtimedir:    ${localstatedir}/run
+     logfiledir:    ${localstatedir}/logs
+     proxycachedir: ${localstatedir}/proxy
+@@ -391,6 +405,7 @@
+     includedir:      ${prefix}/include/httpd
+     localstatedir:   /var
+     runtimedir:      ${localstatedir}/run/httpd
++    statedir:        ${localstatedir}/lib/httpd
+     logfiledir:      ${localstatedir}/log/httpd
+     proxycachedir:   ${localstatedir}/cache/httpd
+ </Layout>
+--- httpd-2.4.38/configure.in.r1842929+
++++ httpd-2.4.38/configure.in
+@@ -41,7 +41,7 @@
+ AC_PREFIX_DEFAULT(/usr/local/apache2)
+ 
+ dnl Get the layout here, so we can pass the required variables to apr
+-APR_ENABLE_LAYOUT(Apache, [errordir iconsdir htdocsdir cgidir])
++APR_ENABLE_LAYOUT(Apache, [errordir iconsdir htdocsdir cgidir statedir])
+ 
+ dnl reparse the configure arguments.
+ APR_PARSE_ARGUMENTS
+--- httpd-2.4.38/include/ap_config_layout.h.in.r1842929+
++++ httpd-2.4.38/include/ap_config_layout.h.in
+@@ -60,5 +60,7 @@
+ #define DEFAULT_REL_LOGFILEDIR "@rel_logfiledir@"
+ #define DEFAULT_EXP_PROXYCACHEDIR "@exp_proxycachedir@"
+ #define DEFAULT_REL_PROXYCACHEDIR "@rel_proxycachedir@"
++#define DEFAULT_EXP_STATEDIR "@exp_statedir@"
++#define DEFAULT_REL_STATEDIR "@rel_statedir@"
+ 
+ #endif /* AP_CONFIG_LAYOUT_H */
+--- httpd-2.4.38/include/http_config.h.r1842929+
++++ httpd-2.4.38/include/http_config.h
+@@ -757,6 +757,14 @@
+  */
+ AP_DECLARE(char *) ap_runtime_dir_relative(apr_pool_t *p, const char *fname);
+ 
++/**
++ * Compute the name of a persistent state file (e.g. a database or
++ * long-lived cache) relative to the appropriate state directory.
++ * Absolute paths are returned as-is.  The state directory is
++ * configured via the DefaultStateDir directive or at build time.
++ */
++AP_DECLARE(char *) ap_state_dir_relative(apr_pool_t *p, const char *fname);
++
+ /* Finally, the hook for dynamically loading modules in... */
+ 
+ /**
+--- httpd-2.4.38/Makefile.in.r1842929+
++++ httpd-2.4.38/Makefile.in
+@@ -213,6 +213,7 @@
+ install-other:
+ 	@test -d $(DESTDIR)$(logfiledir) || $(MKINSTALLDIRS) $(DESTDIR)$(logfiledir)
+ 	@test -d $(DESTDIR)$(runtimedir) || $(MKINSTALLDIRS) $(DESTDIR)$(runtimedir)
++	@test -d $(DESTDIR)$(statedir) || $(MKINSTALLDIRS) $(DESTDIR)$(statedir)
+ 	@for ext in dll x; do \
+ 		file=apachecore.$$ext; \
+ 		if test -f $$file; then \
+--- httpd-2.4.38/modules/dav/fs/mod_dav_fs.c.r1842929+
++++ httpd-2.4.38/modules/dav/fs/mod_dav_fs.c
+@@ -29,6 +29,10 @@
+ 
+ extern module AP_MODULE_DECLARE_DATA dav_fs_module;
+

httpd-2.4.37-sslprotdefault.patch Added

@@ -0,0 +1,98 @@
+diff --git a/modules/ssl/ssl_engine_config.c b/modules/ssl/ssl_engine_config.c
+index 55c237e..5467d23 100644
+--- a/modules/ssl/ssl_engine_config.c
++++ b/modules/ssl/ssl_engine_config.c
+@@ -119,7 +119,7 @@ static void modssl_ctx_init(modssl_ctx_t *mctx, apr_pool_t *p)
+     mctx->ticket_key          = NULL;
+ #endif
+ 
+-    mctx->protocol            = SSL_PROTOCOL_DEFAULT;
++    mctx->protocol            = SSL_PROTOCOL_NONE;
+     mctx->protocol_set        = 0;
+ 
+     mctx->pphrase_dialog_type = SSL_PPTYPE_UNSET;
+@@ -262,6 +262,7 @@ static void modssl_ctx_cfg_merge(apr_pool_t *p,
+ {
+     if (add->protocol_set) {
+         mrg->protocol = add->protocol;
++        mrg->protocol_set = 1;
+     }
+     else {
+         mrg->protocol = base->protocol;
+diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c
+index e3f62fe..31fc0e6 100644
+--- a/modules/ssl/ssl_engine_init.c
++++ b/modules/ssl/ssl_engine_init.c
+@@ -568,6 +568,7 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
+     MODSSL_SSL_METHOD_CONST SSL_METHOD *method = NULL;
+     char *cp;
+     int protocol = mctx->protocol;
++    int protocol_set = mctx->protocol_set;
+     SSLSrvConfigRec *sc = mySrvConfig(s);
+ #if OPENSSL_VERSION_NUMBER >= 0x10100000L
+     int prot;
+@@ -577,12 +578,18 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
+      *  Create the new per-server SSL context
+      */
+     if (protocol == SSL_PROTOCOL_NONE) {
+-        ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(02231)
+-                "No SSL protocols available [hint: SSLProtocol]");
+-        return ssl_die(s);
+-    }
++        if (protocol_set) {
++            ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(02231)
++                    "No SSL protocols available [hint: SSLProtocol]");
++            return ssl_die(s);
++        }
+ 
+-    cp = apr_pstrcat(p,
++        ap_log_error(APLOG_MARK, APLOG_TRACE3, 0, s, 
++                     "Using OpenSSL/system default SSL/TLS protocols");
++        cp = "default";
++    }
++    else {
++        cp = apr_pstrcat(p,
+ #ifndef OPENSSL_NO_SSL3
+                      (protocol & SSL_PROTOCOL_SSLV3 ? "SSLv3, " : ""),
+ #endif
+@@ -595,7 +602,8 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
+ #endif
+ #endif
+                      NULL);
+-    cp[strlen(cp)-2] = NUL;
++        cp[strlen(cp)-2] = NUL;
++    }
+ 
+     ap_log_error(APLOG_MARK, APLOG_TRACE3, 0, s,
+                  "Creating new SSL context (protocols: %s)", cp);
+@@ -696,13 +704,15 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
+         prot = SSL3_VERSION;
+ #endif
+     } else {
+-        SSL_CTX_free(ctx);
+-        mctx->ssl_ctx = NULL;
+-        ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(03378)
+-                "No SSL protocols available [hint: SSLProtocol]");
+-        return ssl_die(s);
++        if (protocol_set) {
++            SSL_CTX_free(ctx);
++            mctx->ssl_ctx = NULL;
++            ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(03378)
++                    "No SSL protocols available [hint: SSLProtocol]");
++            return ssl_die(s);
++        }
+     }
+-    SSL_CTX_set_max_proto_version(ctx, prot);
++    if (protocol != SSL_PROTOCOL_NONE) SSL_CTX_set_max_proto_version(ctx, prot);
+ 
+     /* Next we scan for the minimal protocol version we should provide,
+      * but we do not allow holes between max and min */
+@@ -726,7 +736,7 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
+         prot = SSL3_VERSION;
+     }
+ #endif
+-    SSL_CTX_set_min_proto_version(ctx, prot);
++    if (protocol != SSL_PROTOCOL_NONE) SSL_CTX_set_min_proto_version(ctx, prot);
+ #endif /* if OPENSSL_VERSION_NUMBER < 0x10100000L */
+ 
+ #ifdef SSL_OP_CIPHER_SERVER_PREFERENCE

httpd-2.4.38-r1830819+.patch Added

@@ -0,0 +1,677 @@
+# ./pullrev.sh 1830819 1830836 1830912 1830913 1830927 1831168 1831173
+
+http://svn.apache.org/viewvc?view=revision&revision=1830819
+http://svn.apache.org/viewvc?view=revision&revision=1830912
+http://svn.apache.org/viewvc?view=revision&revision=1830913
+http://svn.apache.org/viewvc?view=revision&revision=1830927
+http://svn.apache.org/viewvc?view=revision&revision=1831168
+http://svn.apache.org/viewvc?view=revision&revision=1831173
+http://svn.apache.org/viewvc?view=revision&revision=1835240
+http://svn.apache.org/viewvc?view=revision&revision=1835242
+
+diff --git a/modules/ssl/ssl_engine_config.c b/modules/ssl/ssl_engine_config.c
+index d276fea..5467d23 100644
+--- httpd-2.4.38/modules/ssl/ssl_engine_config.c.r1830819+
++++ httpd-2.4.38/modules/ssl/ssl_engine_config.c
+@@ -916,7 +916,9 @@
+     SSLSrvConfigRec *sc = mySrvConfig(cmd->server);
+     const char *err;
+ 
+-    if ((err = ssl_cmd_check_file(cmd, &arg))) {
++    /* Only check for non-ENGINE based certs. */
++    if (!modssl_is_engine_id(arg)
++        && (err = ssl_cmd_check_file(cmd, &arg))) {
+         return err;
+     }
+ 
+@@ -932,7 +934,9 @@
+     SSLSrvConfigRec *sc = mySrvConfig(cmd->server);
+     const char *err;
+ 
+-    if ((err = ssl_cmd_check_file(cmd, &arg))) {
++    /* Check keyfile exists for non-ENGINE keys. */
++    if (!modssl_is_engine_id(arg)
++        && (err = ssl_cmd_check_file(cmd, &arg))) {
+         return err;
+     }
+ 
+--- httpd-2.4.38/modules/ssl/ssl_engine_init.c.r1830819+
++++ httpd-2.4.38/modules/ssl/ssl_engine_init.c
+@@ -1228,12 +1228,18 @@
+                 (certfile = APR_ARRAY_IDX(mctx->pks->cert_files, i,
+                                           const char *));
+          i++) {
++        EVP_PKEY *pkey;
++        const char *engine_certfile = NULL;
++
+         key_id = apr_psprintf(ptemp, "%s:%d", vhost_id, i);
+ 
+         ERR_clear_error();
+ 
+         /* first the certificate (public key) */
+-        if (mctx->cert_chain) {
++        if (modssl_is_engine_id(certfile)) {
++            engine_certfile = certfile;
++        }
++        else if (mctx->cert_chain) {
+             if ((SSL_CTX_use_certificate_file(mctx->ssl_ctx, certfile,
+                                               SSL_FILETYPE_PEM) < 1)) {
+                 ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(02561)
+@@ -1262,12 +1268,46 @@
+ 
+         ERR_clear_error();
+ 
+-        if ((SSL_CTX_use_PrivateKey_file(mctx->ssl_ctx, keyfile,
+-                                         SSL_FILETYPE_PEM) < 1) &&
+-            (ERR_GET_FUNC(ERR_peek_last_error())
+-                != X509_F_X509_CHECK_PRIVATE_KEY)) {
++        if (modssl_is_engine_id(keyfile)) {
++            apr_status_t rv;
++
++            cert = NULL;
++            
++            if ((rv = modssl_load_engine_keypair(s, ptemp, vhost_id,
++                                                 engine_certfile, keyfile,
++                                                 &cert, &pkey))) {
++                return rv;
++            }
++
++            if (cert) {
++                if (SSL_CTX_use_certificate(mctx->ssl_ctx, cert) < 1) {
++                    ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10137)
++                                 "Failed to configure engine certificate %s, check %s",
++                                 key_id, certfile);
++                    ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s);
++                    return APR_EGENERAL;
++                }
++
++                /* SSL_CTX now owns the cert. */
++                X509_free(cert);
++            }                    
++            
++            if (SSL_CTX_use_PrivateKey(mctx->ssl_ctx, pkey) < 1) {
++                ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10130)
++                             "Failed to configure private key %s from engine",
++                             keyfile);
++                ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s);
++                return APR_EGENERAL;
++            }
++
++            /* SSL_CTX now owns the key */
++            EVP_PKEY_free(pkey);
++        }
++        else if ((SSL_CTX_use_PrivateKey_file(mctx->ssl_ctx, keyfile,
++                                              SSL_FILETYPE_PEM) < 1)
++                 && (ERR_GET_FUNC(ERR_peek_last_error())
++                     != X509_F_X509_CHECK_PRIVATE_KEY)) {
+             ssl_asn1_t *asn1;
+-            EVP_PKEY *pkey;
+             const unsigned char *ptr;
+ 
+             ERR_clear_error();
+@@ -1354,8 +1394,9 @@
+     /*
+      * Try to read DH parameters from the (first) SSLCertificateFile
+      */
+-    if ((certfile = APR_ARRAY_IDX(mctx->pks->cert_files, 0, const char *)) &&
+-        (dhparams = ssl_dh_GetParamFromFile(certfile))) {
++    certfile = APR_ARRAY_IDX(mctx->pks->cert_files, 0, const char *);
++    if (certfile && !modssl_is_engine_id(certfile)
++        && (dhparams = ssl_dh_GetParamFromFile(certfile))) {
+         SSL_CTX_set_tmp_dh(mctx->ssl_ctx, dhparams);
+         ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02540)
+                      "Custom DH parameters (%d bits) for %s loaded from %s",
+@@ -1367,10 +1408,10 @@
+     /*
+      * Similarly, try to read the ECDH curve name from SSLCertificateFile...
+      */
+-    if ((certfile != NULL) && 
+-        (ecparams = ssl_ec_GetParamFromFile(certfile)) &&
+-        (nid = EC_GROUP_get_curve_name(ecparams)) &&
+-        (eckey = EC_KEY_new_by_curve_name(nid))) {
++    if (certfile && !modssl_is_engine_id(certfile)
++        && (ecparams = ssl_ec_GetParamFromFile(certfile))
++        && (nid = EC_GROUP_get_curve_name(ecparams)) 
++        && (eckey = EC_KEY_new_by_curve_name(nid))) {
+         SSL_CTX_set_tmp_ecdh(mctx->ssl_ctx, eckey);
+         ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02541)
+                      "ECDH curve %s for %s specified in %s",
+--- httpd-2.4.38/modules/ssl/ssl_engine_pphrase.c.r1830819+
++++ httpd-2.4.38/modules/ssl/ssl_engine_pphrase.c
+@@ -143,8 +143,6 @@
+     const char *key_id = asn1_table_vhost_key(mc, p, sc->vhost_id, idx);
+     EVP_PKEY *pPrivateKey = NULL;
+     ssl_asn1_t *asn1;
+-    unsigned char *ucp;
+-    long int length;
+     int nPassPhrase = (*pphrases)->nelts;
+     int nPassPhraseRetry = 0;
+     apr_time_t pkey_mtime = 0;
+@@ -221,7 +219,7 @@
+          * is not empty. */
+         ERR_clear_error();
+ 
+-        pPrivateKey = modssl_read_privatekey(ppcb_arg.pkey_file, NULL,
++        pPrivateKey = modssl_read_privatekey(ppcb_arg.pkey_file,
+                                              ssl_pphrase_Handle_CB, &ppcb_arg);
+         /* If the private key was successfully read, nothing more to
+            do here. */
+@@ -351,19 +349,12 @@
+         nPassPhrase++;
+     }
+ 
+-    /*
+-     * Insert private key into the global module configuration
+-     * (we convert it to a stand-alone DER byte sequence
+-     * because the SSL library uses static variables inside a
+-     * RSA structure which do not survive DSO reloads!)
+-     */
+-    length = i2d_PrivateKey(pPrivateKey, NULL);
+-    ucp = ssl_asn1_table_set(mc->tPrivateKey, key_id, length);
+-    (void)i2d_PrivateKey(pPrivateKey, &ucp); /* 2nd arg increments */
++    /* Cache the private key in the global module configuration so it
++     * can be used after subsequent reloads. */
++    asn1 = ssl_asn1_table_set(mc->tPrivateKey, key_id, pPrivateKey);
+ 
+     if (ppcb_arg.nPassPhraseDialogCur != 0) {
+         /* remember mtime of encrypted keys */
+-        asn1 = ssl_asn1_table_get(mc->tPrivateKey, key_id);
+         asn1->source_mtime = pkey_mtime;
+     }
+ 
+@@ -614,3 +605,288 @@
+      */
+     return (len);
+ }
++
++
++#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT)
++
++/* OpenSSL UI implementation for passphrase entry; largely duplicated
++ * from ssl_pphrase_Handle_CB but adjusted for UI API. TODO: Might be
++ * worth trying to shift pphrase handling over to the UI API
++ * completely. */
++static int passphrase_ui_open(UI *ui)
++{
++    pphrase_cb_arg_t *ppcb = UI_get0_user_data(ui);
++    SSLSrvConfigRec *sc = mySrvConfig(ppcb->s);
++
++    ppcb->nPassPhraseDialog++;

httpd-2.4.4-export.patch Deleted

httpd-2.4.4-malformed-host.patch Deleted

httpd-2.4.4-mod_unique_id.patch Deleted

@@ -1,239 +0,0 @@
---- trunk/modules/metadata/mod_unique_id.c	2011/12/02 23:02:04	1209766
-+++ trunk/modules/metadata/mod_unique_id.c	2013/07/10 16:20:31	1501827
-@@ -31,14 +31,11 @@
- #include "http_log.h"
- #include "http_protocol.h"  /* for ap_hook_post_read_request */
- 
--#if APR_HAVE_UNISTD_H
--#include <unistd.h>         /* for getpid() */
--#endif
-+#define ROOT_SIZE 10
- 
- typedef struct {
-     unsigned int stamp;
--    unsigned int in_addr;
--    unsigned int pid;
-+    char root[ROOT_SIZE];
-     unsigned short counter;
-     unsigned int thread_index;
- } unique_id_rec;
-@@ -64,20 +61,15 @@
-  * gethostbyname (gethostname()) is unique across all the machines at the
-  * "site".
-  *
-- * We also further assume that pids fit in 32-bits.  If something uses more
-- * than 32-bits, the fix is trivial, but it requires the unrolled uuencoding
-- * loop to be extended.  * A similar fix is needed to support multithreaded
-- * servers, using a pid/tid combo.
-- *
-- * Together, the in_addr and pid are assumed to absolutely uniquely identify
-- * this one child from all other currently running children on all servers
-- * (including this physical server if it is running multiple httpds) from each
-+ * The root is assumed to absolutely uniquely identify this one child
-+ * from all other currently running children on all servers (including
-+ * this physical server if it is running multiple httpds) from each
-  * other.
-  *
-- * The stamp and counter are used to distinguish all hits for a particular
-- * (in_addr,pid) pair.  The stamp is updated using r->request_time,
-- * saving cpu cycles.  The counter is never reset, and is used to permit up to
-- * 64k requests in a single second by a single child.
-+ * The stamp and counter are used to distinguish all hits for a
-+ * particular root.  The stamp is updated using r->request_time,
-+ * saving cpu cycles.  The counter is never reset, and is used to
-+ * permit up to 64k requests in a single second by a single child.
-  *
-  * The 144-bits of unique_id_rec are encoded using the alphabet
-  * [A-Za-z0-9@-], resulting in 24 bytes of printable characters.  That is then
-@@ -92,7 +84,7 @@
-  * module change.
-  *
-  * It is highly desirable that identifiers exist for "eternity".  But future
-- * needs (such as much faster webservers, moving to 64-bit pids, or moving to a
-+ * needs (such as much faster webservers, or moving to a
-  * multithreaded server) may dictate a need to change the contents of
-  * unique_id_rec.  Such a future implementation should ensure that the first
-  * field is still a time_t stamp.  By doing that, it is possible for a site to
-@@ -100,7 +92,15 @@
-  * wait one entire second, and then start all of their new-servers.  This
-  * procedure will ensure that the new space of identifiers is completely unique
-  * from the old space.  (Since the first four unencoded bytes always differ.)
-+ *
-+ * Note: previous implementations used 32-bits of IP address plus pid
-+ * in place of the PRNG output in the "root" field.  This was
-+ * insufficient for IPv6-only hosts, required working DNS to determine
-+ * a unique IP address (fragile), and needed a [0, 1) second sleep
-+ * call at startup to avoid pid reuse.  Use of the PRNG avoids all
-+ * these issues.
-  */
-+
- /*
-  * Sun Jun  7 05:43:49 CEST 1998 -- Alvaro
-  * More comments:
-@@ -116,8 +116,6 @@
-  * htonl/ntohl. Well, this shouldn't be a problem till year 2106.
-  */
- 
--static unsigned global_in_addr;
--
- /*
-  * XXX: We should have a per-thread counter and not use cur_unique_id.counter
-  * XXX: in all threads, because this is bad for performance on multi-processor
-@@ -129,7 +127,7 @@
- /*
-  * Number of elements in the structure unique_id_rec.
-  */
--#define UNIQUE_ID_REC_MAX 5
-+#define UNIQUE_ID_REC_MAX 4
- 
- static unsigned short unique_id_rec_offset[UNIQUE_ID_REC_MAX],
-                       unique_id_rec_size[UNIQUE_ID_REC_MAX],
-@@ -138,113 +136,32 @@
- 
- static int unique_id_global_init(apr_pool_t *p, apr_pool_t *plog, apr_pool_t *ptemp, server_rec *main_server)
- {
--    char str[APRMAXHOSTLEN + 1];
--    apr_status_t rv;
--    char *ipaddrstr;
--    apr_sockaddr_t *sockaddr;
--
-     /*
-      * Calculate the sizes and offsets in cur_unique_id.
-      */
-     unique_id_rec_offset[0] = APR_OFFSETOF(unique_id_rec, stamp);
-     unique_id_rec_size[0] = sizeof(cur_unique_id.stamp);
--    unique_id_rec_offset[1] = APR_OFFSETOF(unique_id_rec, in_addr);
--    unique_id_rec_size[1] = sizeof(cur_unique_id.in_addr);
--    unique_id_rec_offset[2] = APR_OFFSETOF(unique_id_rec, pid);
--    unique_id_rec_size[2] = sizeof(cur_unique_id.pid);
--    unique_id_rec_offset[3] = APR_OFFSETOF(unique_id_rec, counter);
--    unique_id_rec_size[3] = sizeof(cur_unique_id.counter);
--    unique_id_rec_offset[4] = APR_OFFSETOF(unique_id_rec, thread_index);
--    unique_id_rec_size[4] = sizeof(cur_unique_id.thread_index);
-+    unique_id_rec_offset[1] = APR_OFFSETOF(unique_id_rec, root);
-+    unique_id_rec_size[1] = sizeof(cur_unique_id.root);
-+    unique_id_rec_offset[2] = APR_OFFSETOF(unique_id_rec, counter);
-+    unique_id_rec_size[2] = sizeof(cur_unique_id.counter);
-+    unique_id_rec_offset[3] = APR_OFFSETOF(unique_id_rec, thread_index);
-+    unique_id_rec_size[3] = sizeof(cur_unique_id.thread_index);
-     unique_id_rec_total_size = unique_id_rec_size[0] + unique_id_rec_size[1] +
--                               unique_id_rec_size[2] + unique_id_rec_size[3] +
--                               unique_id_rec_size[4];
-+                               unique_id_rec_size[2] + unique_id_rec_size[3];
- 
-     /*
-      * Calculate the size of the structure when encoded.
-      */
-     unique_id_rec_size_uu = (unique_id_rec_total_size*8+5)/6;
- 
--    /*
--     * Now get the global in_addr.  Note that it is not sufficient to use one
--     * of the addresses from the main_server, since those aren't as likely to
--     * be unique as the physical address of the machine
--     */
--    if ((rv = apr_gethostname(str, sizeof(str) - 1, p)) != APR_SUCCESS) {
--        ap_log_error(APLOG_MARK, APLOG_ALERT, rv, main_server, APLOGNO(01563)
--          "unable to find hostname of the server");
--        return HTTP_INTERNAL_SERVER_ERROR;
--    }
--
--    if ((rv = apr_sockaddr_info_get(&sockaddr, str, AF_INET, 0, 0, p)) == APR_SUCCESS) {
--        global_in_addr = sockaddr->sa.sin.sin_addr.s_addr;
--    }
--    else {
--        ap_log_error(APLOG_MARK, APLOG_ALERT, rv, main_server, APLOGNO(01564)
--                    "unable to find IPv4 address of \"%s\"", str);
--#if APR_HAVE_IPV6
--        if ((rv = apr_sockaddr_info_get(&sockaddr, str, AF_INET6, 0, 0, p)) == APR_SUCCESS) {
--            memcpy(&global_in_addr,
--                   (char *)sockaddr->ipaddr_ptr + sockaddr->ipaddr_len - sizeof(global_in_addr),
--                   sizeof(global_in_addr));
--            ap_log_error(APLOG_MARK, APLOG_ALERT, rv, main_server, APLOGNO(01565)
--                         "using low-order bits of IPv6 address "
--                         "as if they were unique");
--        }
--        else
--#endif
--        return HTTP_INTERNAL_SERVER_ERROR;
--    }
--
--    apr_sockaddr_ip_get(&ipaddrstr, sockaddr);
--    ap_log_error(APLOG_MARK, APLOG_INFO, 0, main_server, APLOGNO(01566) "using ip addr %s",
--                 ipaddrstr);
--
--    /*
--     * If the server is pummelled with restart requests we could possibly end
--     * up in a situation where we're starting again during the same second
--     * that has been used in previous identifiers.  Avoid that situation.
--     *
--     * In truth, for this to actually happen not only would it have to restart
--     * in the same second, but it would have to somehow get the same pids as
--     * one of the other servers that was running in that second. Which would
--     * mean a 64k wraparound on pids ... not very likely at all.
--     *
--     * But protecting against it is relatively cheap.  We just sleep into the
--     * next second.
--     */
--    apr_sleep(apr_time_from_sec(1) - apr_time_usec(apr_time_now()));
-     return OK;
- }
- 
- static void unique_id_child_init(apr_pool_t *p, server_rec *s)
- {
--    pid_t pid;
--
--    /*
--     * Note that we use the pid because it's possible that on the same
--     * physical machine there are multiple servers (i.e. using Listen). But
--     * it's guaranteed that none of them will share the same pids between
--     * children.
--     *
--     * XXX: for multithread this needs to use a pid/tid combo and probably
--     * needs to be expanded to 32 bits
--     */
--    pid = getpid();
--    cur_unique_id.pid = pid;
--
--    /*
--     * Test our assumption that the pid is 32-bits.  It's possible that
--     * 64-bit machines will declare pid_t to be 64 bits but only use 32

httpd-2.4.7-r1537535.patch Deleted

@@ -1,38 +0,0 @@
-# ./pullrev.sh 1537535
-
-http://svn.apache.org/viewvc?view=revision&revision=1537535
-
---- httpd-2.4.7/modules/ssl/ssl_engine_config.c.r1537535
-+++ httpd-2.4.7/modules/ssl/ssl_engine_config.c
-@@ -196,7 +196,7 @@ static SSLSrvConfigRec *ssl_config_serve
-     SSLSrvConfigRec *sc = apr_palloc(p, sizeof(*sc));
- 
-     sc->mc                     = NULL;
--    sc->enabled                = SSL_ENABLED_FALSE;
-+    sc->enabled                = SSL_ENABLED_UNSET;
-     sc->proxy_enabled          = UNSET;
-     sc->vhost_id               = NULL;  /* set during module init */
-     sc->vhost_id_len           = 0;     /* set during module init */
---- httpd-2.4.7/modules/ssl/ssl_engine_init.c.r1537535
-+++ httpd-2.4.7/modules/ssl/ssl_engine_init.c
-@@ -115,13 +115,16 @@ int ssl_init_Module(apr_pool_t *p, apr_p
-         sc->vhost_id = ssl_util_vhostid(p, s);
-         sc->vhost_id_len = strlen(sc->vhost_id);
- 
--        if (ap_get_server_protocol(s) &&
--            strcmp("https", ap_get_server_protocol(s)) == 0) {
-+        /* Default to enabled if SSLEngine is not set explicitly, and
-+         * the protocol is https. */
-+        if (ap_get_server_protocol(s) 
-+            && strcmp("https", ap_get_server_protocol(s)) == 0
-+            && sc->enabled == SSL_ENABLED_UNSET) {
-             sc->enabled = SSL_ENABLED_TRUE;
-         }
- 
--        /* If sc->enabled is UNSET, then SSL is optional on this vhost  */
--        /* Fix up stuff that may not have been set */
-+        /* Fix up stuff that may not have been set.  If sc->enabled is
-+         * UNSET, then SSL is disabled on this vhost.  */
-         if (sc->enabled == SSL_ENABLED_UNSET) {
-             sc->enabled = SSL_ENABLED_FALSE;
-         }

httpd-2.4.9-r1573626.patch Deleted

@@ -1,29 +0,0 @@
---- a/modules/proxy/mod_proxy.c	2014/03/03 17:28:10	1573625
-+++ b/modules/proxy/mod_proxy.c	2014/03/03 17:28:17	1573626
-@@ -927,8 +927,25 @@
-     struct dirconn_entry *list = (struct dirconn_entry *)conf->dirconn->elts;
- 
-     /* is this for us? */
--    if (!r->proxyreq || !r->filename || strncmp(r->filename, "proxy:", 6) != 0)
-+    if (!r->filename) {
-         return DECLINED;
-+    }
-+
-+    if (!r->proxyreq) {
-+        /* We may have forced the proxy handler via config or .htaccess */
-+        if (r->handler &&
-+            strncmp(r->handler, "proxy:", 6) == 0 &&
-+            strncmp(r->filename, "proxy:", 6) != 0) {
-+            r->proxyreq = PROXYREQ_REVERSE;
-+            r->filename = apr_pstrcat(r->pool, r->handler, r->filename, NULL);
-+            apr_table_setn(r->notes, "rewrite-proxy", "1");
-+        }
-+        else {
-+            return DECLINED;
-+        }
-+    } else if (strncmp(r->filename, "proxy:", 6) != 0) {
-+        return DECLINED;
-+    }
- 
-     /* handle max-forwards / OPTIONS / TRACE */
-     if ((str = apr_table_get(r->headers_in, "Max-Forwards"))) {

00-base.conf Changed

00-mpm.conf Changed

00-proxy.conf Changed

01-md.conf Added

README.confd Changed

README.confmod Changed

action-configtest.sh Changed

action-graceful.sh Changed

apachectl.sh Added

@@ -0,0 +1,62 @@
+#!/usr/bin/sh
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+if [ "x$1" = "x-k" ]; then
+    shift
+fi
+
+ACMD="$1"
+ARGV="$@"
+SVC='httpd.service'
+
+if [ "x$2" != "x" ] ; then
+    echo Passing arguments to httpd using apachectl is no longer supported.
+    echo You can only start/stop/restart httpd using this script.
+    echo To pass extra arguments to httpd, see the $SVC'(8)'
+    echo man page.
+    exit 1
+fi
+
+case $ACMD in
+start|stop|restart|status)
+    /usr/bin/systemctl --no-pager $ACMD $SVC
+    ERROR=$?
+    ;;
+graceful)
+    if /usr/bin/systemctl -q is-active $SVC; then
+        /usr/bin/systemctl kill --signal=SIGUSR1 $SVC
+    else
+        /usr/bin/systemctl start $SVC
+    fi
+    ERROR=$?
+    ;;
+graceful-stop)
+    /usr/bin/systemctl kill --signal=SIGWINCH $SVC
+    ERROR=$?
+    ;;
+configtest)
+    /usr/sbin/service ${SVC/.service//} $ACMD
+    ERROR=$?
+    ;;
+*)
+    echo apachectl: The \"$ACMD\" option is not supported. 1>&2
+    ERROR=2
+    ;;
+esac
+
+exit $ERROR
+

config.layout Added

debian.changelog Deleted

@@ -1,3503 +0,0 @@
-apache2 (2.4.29-1) unstable; urgency=medium
-
-  * Check in 2.4.29
-
- -- Jeroen van Meeuwen (Kolab Systems) <Vanmeeuwen@kolabsys.com>  Thu,  9 Nov 2017 14:14:14 +0200
-
-apache2 (2.4.25-1) unstable; urgency=medium
-
-  * Check in 2.4.25
-
- -- Jeroen van Meeuwen (Kolab Systems) <Vanmeeuwen@kolabsys.com>  Fri, 28 Jul 2017 14:14:14 +0200
-
-apache2 (2.4.18-1) unstable; urgency=medium
-
-  * Check in 2.4.18
-
- -- Jeroen van Meeuwen (Kolab Systems) <Vanmeeuwen@kolabsys.com>  Sat, 16 Jan 2016 14:14:14 +0200
-
-apache2 (2.4.10-1.1) unstable; urgency=medium
-
-  * Remove breaking libapache2-mod-php5, we don't ship that
-
- -- Jeroen van Meeuwen (Kolab Systems) <Vanmeeuwen@kolabsys.com>  Thu,  3 Sep 2015 14:14:14 +0200
-
-apache2 (2.4.10-1) unstable; urgency=medium
-
-  [ Arno Töll ]
-  * New upstream version
-    + Refresh debian/patches/fhs_compliance.patch
-    + Security Fixes:
-      - CVE-2014-0117 mod_proxy: Fix DoS that could cause a crash
-      - CVE-2014-0226 Fix a race condition resulting in a heap overflow in
-        scoreboard handling
-      - CVE-2014-0118 mod_deflate: The DEFLATE input filter now limits the
-        length and compression ratio of inflated request to mitigate a
-        possible DoS
-      - CVE-2014-0231 mod_cgid: Fix a denial of service against CGI scripts
-    + Fixes SNI with certificate defined in global scope. (Closes: #751361)
-  * Warn users if they try to disable modules that we consider essential for
-    operation of the Apache web server (Closes: #709461)
-  * Drop libcap from our build-dependencies. That was needed for itk which we
-    gave source out to it's own package again.
-  * Provide apache2.2-common package to avoid upgrading problems for people
-    using --purge (apt) or --purge-unused (aptitude) even though that's
-    clearly discouraged. This caused disappearing of conffiles because we move
-    them from apache2.2-common to apache2 during the upgrade. Ugh. This was
-    not a bug in our packaging, but an unfortunately people blame us
-    nonetheless even though it's not all our fault. This alternative helps
-    those people, but at the same time means that incompatible modules aren't
-    force-removed by dpkg during the upgrade. Hopefully we catch all of them
-    with the Breaks relation coming along (Closes: #716880, #752922, #711925)
-
- -- Stefan Fritsch <sf@debian.org>  Tue, 22 Jul 2014 23:16:20 +0200
-
-apache2 (2.4.9-2) unstable; urgency=medium
-
-  * Fix logic in postinst to detect existing index.* files in both
-    DocumentRoots, the old /var/www and the new /var/www/html. Also
-    change the compiled in default DocumentRoot to /var/www/html.
-    Closes: #743915
-  * Fix buffer overflows in suexec with very long (unix) usernames. Not
-    exploitable due to FORTIFY_SOURCE. And creating users usually requires
-    root privileges, anyway. Thanks to Luca Bruno for the report.
-  * Remove conflicts of mpm modules with mpm_itk, which isn't an mpm
-    anymore. Fixes a part of: #734865. libapache2-mpm-itk needs a fix, too.
-  * Remove obsolete warning in a2enmod about mpm-itk.
-  * Fix lintian warning: Remove image ref to w3.org, which is a privacy
-    breach.
-
- -- Stefan Fritsch <sf@debian.org>  Sun, 08 Jun 2014 10:38:04 +0200
-
-apache2 (2.4.9-1) unstable; urgency=medium
-
-  * New upstream version.
-    Security fixes:
-    - CVE-2013-6438: mod_dav: Fix DoS from crafted DAV WRITE requests.
-    - CVE-2014-0098: mod_log_config: Fix segfaults when logging truncated
-                     cookies.
-    Notable new features:
-    - Support named groups and backreferences within the LocationMatch,
-      DirectoryMatch, FilesMatch and ProxyMatch directives.
-    - mod_proxy: Added support for unix domain sockets as the backend server
-      endpoint.
-    - mod_ssl: Add support for OpenSSL configuration commands by introducing
-      the SSLOpenSSLConfCmd directive.
-    - mod_authz_user, mod_authz_host, mod_authz_groupfile, mod_authz_dbm,
-      mod_authz_dbd, mod_authnz_ldap: Support the expression parser within the
-      require directives.
-    - mod_rewrite: Add RewriteOptions InheritDown, InheritDownBefore,
-      and IgnoreInherit.
-    - Bugfix in the build system to avoid problems with patched config.m4
-      files as in LP #1251939.
-  * Make default cipher list in ssl.conf more secure:
-    - Remove 'MEDIUM'. This disables RC4 and SEED. Also remove '!MD5' because
-      'HIGH' does not include MD5.
-    - Remove the 'Speed-optimized SSL Cipher' configuration example because
-      it depends on RC4, which is considered insecure.
-  * Change init script short description to describe the service, not the
-    script.  Closes: #738315
-  * Bump Standards-Version (no changes).
-
- -- Stefan Fritsch <sf@debian.org>  Sat, 29 Mar 2014 22:50:32 +0100
-
-apache2 (2.4.7-1) unstable; urgency=low
-
-  New upstream version
-
-  [ Stefan Fritsch ]
-  * In logrotate and init script, don't hardcode path to htcacheclean.
-    Instead, put sbin directories in PATH. Also fix one missed reference
-    to disk_cache.load, missed in 2.4.6-3. Really closes: #718909
-  * Remove possiblity to override path to apache2 executable via envvars.
-    This is no longer necessary with MPMs as modules.
-  * Fix typo in serve-cgi-bin.conf. Closes: #723196
-  * Bump Build-Depends. 2.4.7 requires apr 1.5.
-
-  [ Arno Töll ]
-  * Fix "No default site enabled after fresh install if /etc/apache2
-    exists" by using a condition in preinst which actually works as expected.
-    Thanks to Jean-Michel Vourgère for triaging the issue and providing a
-    patch (Closes: #711493).
-  * Leave a2disconf with rc=0 when purging a configuration which does not
-    exist. (Closes: #718166)
-  * Explicitly express the dependency for mod_access_compat depending on
-    authn_core. Thanks Jean-Michel Vourgère for providing a patch (Closes:
-    #710412)
-  * Allow "apache2_invoke disconf" in postinst/preinst (Closes: #717693)
-  * Rework the default index.html file. Instead of a blank, minimalistic page
-    give a quick start guide, since nobody seems to read our docs. This site
-    is hopefully explaining the most important questions.
-  * Add a virtual provides line to the itk/worker/event/prefork transitional
-    packages so that people with an unusual (unsupported) Apache setup
-    can upgrade neatless in some corner cases (Closes: #728937)
-  * Drop the Apache ITK patches. The Apache ITK MPM is a standalone package
-    now and will be provided by libapache2-mpm-itk in future. The
-    apache2-mpm-itk package depends on this package from now on. Users of itk
-    are advised to consult the itk manual.
-    This also resolves a build-system problem that caused mod_unixd to be
-    initialized twice. (LP: #1251939)
-  * Remove Steinar H. Gunderson from uploaders, he will continue to support
-    itk in his own package in future. The remaining Apache team thanks Steinar
-    for all the work in the past.
-  * Change the Default Document root directory where files are served from
-    (Closes: #730372).
-  * Add GPG support to our watch file. Thanks to Daniel Kahn Gillmor
-    for this suggestion and for providing a patch (Closes: #732450)
-  * Refresh suexec-custom.patch.
-
- -- Arno Töll <arno@debian.org>  Thu, 02 Jan 2014 00:17:56 -1100
-
-apache2 (2.4.6-3) unstable; urgency=low
-
-  * Fix 'implicit declaration' compiler warnings.
-  * Fix module dependencies in lbmethod_*.load files. Closes: #717910
-    LP: #1205314
-  * Mark apache2-data as Multi-Arch: foreign. Closes: #718387
-  * Backport open_htaccess hook from upstream 2.4.x branch to allow
-    building mpm-itk as separate package.
-  * Improve comment for LogLevel in apache2.conf. Closes: #718677
-  * Fix comment in ports.conf. Closes: #718650
-  * Fix htcacheclean path and function name in init script. Closes: #718909
-  * Enable bindnow hardening compiler option, patch by Felix Geyer.
-    Closes: #714872
-
- -- Stefan Fritsch <sf@debian.org>  Mon, 12 Aug 2013 20:15:38 +0200
-
-apache2 (2.4.6-2) unstable; urgency=low
-
-  [ Stefan Fritsch ]
-  * Fix watch file
-  * Don't pass --silent to libtool, allowing blhc to check the compiler
-    options in the build logs.
-
-  [ Arno Töll ]
-  * Allow third party packages to use triggers if they use them in a
-    maintainer script invoking apache2-maintscript-helper (Closes: #717610)
-
- -- Arno Töll <arno@debian.org>  Tue, 23 Jul 2013 13:25:30 +0200
-
-apache2 (2.4.6-1) unstable; urgency=low
-
-  New upstream release:
-  * CVE-2013-1896: mod_dav: Fix a denial of service via MERGE request
-    (Closes: #717272)
-  * New modules mod_cache_socache, mod_proxy_wstunnel.
-  * mod_ssl: Add support for subjectAltName-based host name checking in proxy
-    mode (SSLProxyCheckPeerName).
-  * mod_lua: Many new functions.
-  * mod_auth_basic: Add a generic mechanism to fake basic authentication
-    using the ap_expr parser (AuthBasicFake).
-  * mod_proxy: New BalancerInherit and ProxyPassInherit options.
-  * mod_authnz_ldap: Allow using exec: calls to obtain LDAP bind password.
-
-  [ Arno Töll ]
-  * Document our security model in our NEWS file and highlight we do not allow
-    access to /srv. Thanks to joeyh for pointing this out.
-  * Allow the use of apache2-maintscript-helper from a sub-function. We rely
-    on dpkg's arguments supplied in $1, $2 etc. This clashes with function
-    arguments supplied to to sh sub-function. Allow manual override in such

debian.control Deleted

@@ -1,340 +0,0 @@
-Source: apache2
-Section: httpd
-Priority: optional
-Maintainer: Debian Apache Maintainers <debian-apache@lists.debian.org>
-Uploaders: Stefan Fritsch <sf@debian.org>, Arno Töll <arno@debian.org>
-Build-Depends: debhelper (>= 8.9.7~), bzip2, lsb-release, dpkg-dev (>= 1.16.1~),
- libaprutil1-dev (>= 1.5.0), libapr1-dev (>= 1.5.0), libpcre3-dev, zlib1g-dev,
- libssl-dev (>= 0.9.8m), perl,
- liblua5.1-0-dev, libxml2-dev, autotools-dev, gawk | awk
-Build-Conflicts: autoconf2.13
-Standards-Version: 3.9.5
-Vcs-Browser: http://anonscm.debian.org/gitweb/?p=pkg-apache/apache2.git
-Vcs-Git: git://anonscm.debian.org/pkg-apache/apache2.git
-Homepage: http://httpd.apache.org/
-
-Package: apache2
-Architecture: any
-Depends: ${misc:Depends}, lsb-base, procps [!hurd-i386],
- perl, mime-support, apache2-bin (= ${binary:Version}),
- apache2-data (= ${source:Version}), ${perl:Depends}
-Replaces: apache2.2-common
-Conflicts: apache2.2-common (<< 2.3~)
-Recommends: ssl-cert
-Suggests: www-browser, apache2-doc, apache2-suexec-pristine | apache2-suexec-custom,
- apache2-utils
-Description: Apache HTTP Server
- The Apache Software Foundation's goal is to build a secure, efficient and
- extensible HTTP server as standards-compliant open source software. The
- result has long been the number one web server on the Internet.
- .
- This package contains the configuration files, init scripts and support
- scripts. It does not install the actual apache2 binaries.
-
-Package: apache2-data
-Architecture: all
-Depends: ${misc:Depends}
-Replaces: apache2.2-common
-Conflicts: apache2.2-common (<< 2.3~)
-Multi-Arch: foreign
-Description: Apache HTTP Server (common files)
- The Apache Software Foundation's goal is to build a secure, efficient and
- extensible HTTP server as standards-compliant open source software. The
- result has long been the number one web server on the Internet.
- .
- This package contains architecture-independent common files such as icons,
- error pages and static index files.
-
-Package: apache2-bin
-Architecture: any
-Depends: ${shlibs:Depends}, ${misc:Depends}, ${perl:Depends}
-# MODULE_MAGIC_NUMBER_MAJOR from apache2/include/ap_mmn.h
-Provides: ${apache2:API}, httpd, httpd-cgi
-Suggests: www-browser, apache2-doc, apache2-suexec-pristine | apache2-suexec-custom
-Replaces: apache2.2-bin (<< 2.3~), apache2.2-common (<< 2.3~), apache2-mpm-prefork (<< 2.3~),
- apache2-mpm-itk (<< 2.3~), apache2-mpm-worker (<< 2.3~), apache2-mpm-event (<< 2.3~),
- libapache2-mod-proxy-html (<< 1:2.4.4-2~), libapache2-mod-macro (<< 1:2.4.6-1~)
-Conflicts: apache2.2-bin (<< 2.3~), apache2.2-common (<< 2.3~)
-Breaks: libapache2-mod-proxy-html (<< 1:2.4.4-2~), libapache2-mod-macro (<< 1:2.4.6-1~)
-Description: Apache HTTP Server (binary files and modules)
- The Apache Software Foundation's goal is to build a secure, efficient and
- extensible HTTP server as standards-compliant open source software. The
- result has long been the number one web server on the Internet.
- .
- This package contains the binaries only and does not set up a working
- web-server instance. Install the "apache2" package to get a fully working
- instance. Do not install this package unless you want to set-up the Apache
- HTTP server entirely on your own.
-
-Package: apache2-mpm-worker
-Architecture: any
-Section: oldlibs
-Priority: extra
-Provides: httpd, httpd-cgi
-Depends: ${misc:Depends}, apache2 (= ${binary:Version})
-Description: transitional worker MPM package for apache2
- This is a transitional package to apache2 for users of apache2-mpm-worker and
- can be safely removed after the installation is complete.
-
-Package: apache2-mpm-prefork
-Architecture: any
-Section: oldlibs
-Priority: extra
-Provides: httpd, httpd-cgi
-Depends: ${misc:Depends}, apache2 (= ${binary:Version})
-Description: transitional prefork MPM package for apache2
- This is a transitional package to apache2 for users of apache2-mpm-prefork and
- can be safely removed after the installation is complete.
-
-Package: apache2-mpm-event
-Architecture: any
-Section: oldlibs
-Priority: extra
-Provides: httpd, httpd-cgi
-Depends: ${misc:Depends}, apache2 (= ${binary:Version})
-Description: transitional event MPM package for apache2
- This is a transitional package to apache2 for users of apache2-mpm-event and
- can be safely removed after the  installation is complete.
-
-Package: apache2-mpm-itk
-Architecture: any
-Section: oldlibs
-Priority: extra
-Provides: httpd, httpd-cgi
-Depends: ${misc:Depends}, apache2 (= ${binary:Version}), libapache2-mpm-itk
-Description: transitional itk MPM package for apache2
- This is a transitional package to apache2 for users of apache2-mpm-itk and
- can be safely removed after the installation is complete.
-
-Package: apache2.2-bin
-Architecture: any
-Section: oldlibs
-Priority: extra
-Breaks: gnome-user-share (<< 3.8.0-2~), libapache2-mod-dnssd (<< 0.6-3.1~)
-Depends: ${misc:Depends}, apache2-bin (>= 2.3~)
-Description: Transitional package for apache2-bin
- This is a transitional package for apache2-bin, and can be safely removed
- after the installation is complete.
-
-Package: apache2.2-common
-Architecture: any
-Section: oldlibs
-Priority: extra
-Depends: ${misc:Depends}, apache2 (>= 2.3~)
-Description: Transitional package for apache2
- This is a transitional package for apache2-bin, and can be safely removed
- after the installation is complete.
-Breaks: libapache2-mod-apparmor (<< 2.8.0-1),
-  libapache2-mod-auth-pam (<< 1.1.1-9+deb8),
-  libapache2-mod-auth-sys-group (<< 1.1.1-9+deb8),
-  libapache2-mod-layout (<< 5.1-1+deb8),
-  libapache2-mod-random (<< 2.1-1+deb8),
-  libapache2-mod-speedycgi (<< 2.22-13+deb8),
-  libapache2-mod-vhost-hash-alias (<< 1.0-2+deb8),
-  libapache2-mod-spamhaus (<< 0.7-1.1),
-  libapache2-mod-auth-mysql (<< 4.3.9-13.1+deb8),
-  libapache2-mod-scgi (<< 1.13-1.1),
-  libapache2-mod-auth-pgsql (<< 2.0.3-6),
-  libapache2-mod-php5filter (<< 5.5.0~beta4-3),
-  libapache2-mod-encoding (<< 20040616-5.2),
-  libapache2-mod-perl2 (<< 2.0.8+httpd24-r1449661-2),
-  libapache2-mod-auth-ntlm-winbind (<< 0.0.0.lorikeet+svn+801-2),
-  libapache-singleton-perl (<< 0.15-2),
-  libapache2-mod-fastcgi (<< 2.4.7~0910052141-1.1),
-  libapache2-mod-authn-yubikey (<< 1.0-1.1),
-  libapache2-mod-neko (<< 2.0.0-1),
-  libapache2-mod-authz-unixgroup (<< 1.1.0-0.1),
-  libapache2-mod-auth-openid (<< 0.7-1),
-  libapache2-mod-python (<< 3.3.1-11),
-  libapache2-mod-fcgid (<< 1:2.3.6-1.3),
-  libapache2-mod-gnutls (<< 0.5.10-2),
-  libapache2-mod-auth-pubtkt (<< 0.8-2),
-  libapache2-mod-auth-plain (<< 2.0.52),
-  libapache2-mod-wsgi (<< 3.4-2),
-  libapache2-mod-wsgi-py3 (<< 3.4-2),
-  libapache2-mod-jk (<< 1:1.2.37-2),
-  libapache2-mod-uwsgi (<< 1.9.13-1),
-  libapache2-mod-ruwsgi (<< 1.9.13-1),
-  libapache2-mod-authnz-external (<< 3.3.1-0.1),
-  libapache2-svn (<< 1.7.9-1+nmu3),
-  libapache2-mod-vhost-ldap  (<< 2.4.0-1),
-  libapache2-mod-nss (<< 1.0.8-3),
-  libapache2-mod-rpaf (<< 0.6-11),
-  libapache2-mod-lisp (<< 1.3.1-1.3),
-  gridsite (<< 1.7.21-2),
-  libapache2-mod-suphp (<< 0.7.1-3.1+deb8),
-  libapache2-mod-rivet (<< 2.1.1-3),
-  libapache2-mod-authn-sasl (<< 1.2-2),
-  libapache2-mod-auth-radius (<< 1.5.8-1.2),
-  libapache2-mod-auth-memcookie (<< 1.0.2-8),
-  libapache2-reload-perl (<< 0.12-2),
-  libapache2-mod-macro (<< 1.2.1-1),
-  libapache2-mod-ruid2 (<< 0.9.8-3),
-  libapache2-mod-auth-cas (<< 1.0.9.1-3),
-  libapache2-mod-geoip (<< 1.2.8-1),
-  libapache2-mod-authn-webid (<< 0~20110301-2),
-  libapache2-modsecurity  (<< 2.6.6-7),
-  libapache2-mod-upload-progress (<< 0.2-1),
-  libapache-authenhook-perl (<< 2.00-04+pristine-5),
-  libapache2-authcookie-perl (<< 3.19-2),
-  libapache2-mod-shib2 (<< 2.5.2+dfsg-2),
-  libapache2-mod-removeip (<< 1.0b-5.1),
-  libapache2-mod-bw (<< 0.92-9),
-  libapache2-mod-log-sql (<< 1.100-15),
-  libapache2-mod-xsendfile (<< 0.12-2),
-  libapache2-mod-qos (<< 10.15-3),
-  libapache2-mod-musicindex (<< 1.4.1-1),
-  libapache2-mod-apreq2 (<< 2.13-2),
-  libapache2-request-perl (<< 2.13-2),
-  libapache2-mod-parser3 (<< 3.4.2-7),
-  libapache2-mod-evasive (<< 1.10.1-2),
-  libapache2-mod-auth-kerb (<< 5.4-2.1),
-  libapache2-mod-dacs (<< 1.4.28b-2),
-  libapache2-mod-auth-tkt (<< 2.1.0-7),
-  libapache2-webauth (<< 4.2.0-1),
-  libapache2-webkdc (<< 4.2.0-1),
-  libapache2-mod-dnssd (<< 0.6-3.1~),
-  ikiwiki-hosting-web (<< 0.20140419),
-  libapache2-mod-passenger (<< 3.0.13debian-1.1),
-  libapache2-mod-mono (<< 2.11+git20130708.6b73e85-2),

debian.rules Deleted

@@ -1,164 +0,0 @@
-#!/usr/bin/make -f
-# -*- makefile -*-
-
-DEB_BUILD_ARCH_OS    ?= $(shell dpkg-architecture -qDEB_BUILD_ARCH_OS)
-
-# Uncomment this to turn on verbose mode.
-# export DH_VERBOSE=1
-
-export DEB_BUILD_MAINT_OPTIONS=hardening=+bindnow
-include /usr/share/dpkg/buildflags.mk
-
-LSB_RELEASE := $(shell lsb_release -i -s)
-SERVER_VERSION := $(shell dpkg-parsechangelog | perl -ne 'print $$1 if m/Version:\s*([\d\.]+)/')
-DEBIAN_VERSION := $(shell dpkg-parsechangelog | perl -ne 'print $$1 if m/Version:\s*(.+)/')
-MODULE_DIR := /usr/lib/apache2/modules/
-API = $(shell perl -ne 'print $$1 if m/define\s+MODULE_MAGIC_NUMBER_MAJOR\s+?(.*)$$/' < include/ap_mmn.h)
-AP2_CFLAGS = -pipe $(CFLAGS)
-AP2_LDFLAGS = -Wl,--as-needed $(LDFLAGS)
-AP2_CPPFLAGS = -DPLATFORM='\"$(LSB_RELEASE)\"' $(CPPFLAGS)
-AP2_LTFLAGS = --no-silent
-
-
-support/suexec-custom.c: support/suexec.c debian/patches/suexec-custom.patch
-	cp support/suexec.c support/suexec-custom.c
-	patch -p1 -i debian/patches/suexec-custom.patch
-
-prebuild-checks:
-	ERRS="" ;\
-	for a in $$(find debian/config-dir/ -type f) ; do \
-		t="$$a.$$$$" ;\
-		unexpand < "$$a" > "$$t" ;\
-		cmp -s "$$a" "$$t" || ERRS="$$ERRS $$a" ;\
-		rm "$$t" ;\
-	done ;\
-	if [ -n "$$ERRS" ] ; then \
-		echo 'ERROR: The following files contain spaces instead of tabs. Run through unexpand!' ;\
-		ls -1 $$ERRS ;\
-		false ;\
-	fi
-
-clean-config-vars:
-	# Clean up config_vars.mk
-	# FIXME: Maybe someone could document here why we actually need to
-	# cleanup some stuff here
-	perl ./debian/clean_config_vars '$(AP2_CFLAGS)' '$(AP2_CPPFLAGS)' '$(AP2_LDFLAGS)'
-
-%: %.in
-	sed 's#__SERVER_VERSION__#$(SERVER_VERSION)#; s#__MODULE_DIR__#$(MODULE_DIR)#; s#__API__#$(API)#;' $< > $@
-	chmod `/usr/bin/stat -c '%a' "$<"` $@
-
-prepare-scripts: debian/a2query debian/debhelper/dh_apache2
-	(grep -s -v apache2:API debian/apache2-bin.substvars; echo apache2:API=apache2-api-$(API)) > debian/apache2-bin.substvars.new
-	mv debian/apache2-bin.substvars.new debian/apache2-bin.substvars
-
-generate-maintainer-scripts:
-	set -e ; \
-	for type in custom pristine ; do \
-		for f in postinst preinst prerm links dirs lintian-overrides postrm; do \
-			if [ -e debian/apache2-suexec.$$f.in ] ; then \
-				perl -pe "s{__TYPE__}{$$type}g" < debian/apache2-suexec.$$f.in > debian/apache2-suexec-$$type.$$f ;\
-				chmod `/usr/bin/stat -c '%a' "debian/apache2-suexec.$$f.in"` debian/apache2-suexec-$$type.$$f ;\
-			fi ;\
-		done ;\
-	done
-	set -e ; \
-	for type in worker itk prefork event ; do \
-		for f in postinst preinst prerm links dirs lintian-overrides postrm; do \
-			if [ -e debian/apache2-mpm.$$f.in ] ; then \
-				perl -pe "s{__TYPE__}{$$type}g" < debian/apache2-mpm.$$f.in > debian/apache2-mpm-$$type.$$f ;\
-				chmod `/usr/bin/stat -c '%a' "debian/apache2-mpm.$$f.in"` debian/apache2-mpm-$$type.$$f ;\
-			fi ;\
-		done ;\
-	done
-
-
-clean build build-arch build-indep binary binary-arch binary-indep: %:
-	dh $@ --parallel --with autotools_dev
-
-override_dh_auto_configure: generate-maintainer-scripts prebuild-checks support/suexec-custom.c
-	./configure --enable-layout=Debian --enable-so --with-program-name=apache2 \
-		--enable-suexec --with-suexec-caller=www-data \
-		--with-suexec-bin=/usr/lib/apache2/suexec --with-suexec-docroot=/var/www \
-		--with-suexec-userdir=public_html --with-suexec-logfile=/var/log/apache2/suexec.log \
-		--with-suexec-uidmin=100 --enable-suexec=shared --enable-log-config=static \
-		--with-apr=/usr/bin/apr-1-config --with-apr-util=/usr/bin/apu-1-config \
-		--with-pcre=yes \
-		--enable-pie \
-		--enable-mpms-shared=all \
-		--enable-mods-shared="all cgi" \
-		--enable-mods-static="unixd logio watchdog version" \
-		CFLAGS="$(AP2_CFLAGS)" CPPFLAGS="$(AP2_CPPFLAGS)" LDFLAGS="$(AP2_LDFLAGS)" \
-		LTFLAGS="$(AP2_LTFLAGS)"
-
-
-override_dh_install: clean-config-vars prepare-scripts
-	dh_install --list-missing
-
-override_dh_fixperms-arch:
-	# standard suexec
-	chmod 4754 debian/apache2-suexec-pristine/usr/lib/apache2/suexec-pristine
-	chgrp www-data debian/apache2-suexec-pristine/usr/lib/apache2/suexec-pristine
-	# configurable suexec
-	chmod 4754 debian/apache2-suexec-custom/usr/lib/apache2/suexec-custom
-	chgrp www-data debian/apache2-suexec-custom/usr/lib/apache2/suexec-custom
-	dh_fixperms -a -Xusr/lib/apache2/suexec-custom -Xusr/lib/apache2/suexec-pristine
-	chown -R www-data:www-data debian/apache2/var/cache/apache2/mod_cache_disk
-	chown root:adm debian/apache2/var/log/apache2
-	chmod o-rx debian/apache2/var/log/apache2
-
-override_dh_fixperms-indep:
-	dh_fixperms -i
-
-override_dh_installinit:
-	dh_installinit --restart-after-upgrade --error-handler=true -- defaults 91 09
-
-override_dh_installdocs-indep:
-	# TODO: So, did anyone check convert_docs needs an update? ;)
-	perl debian/convert_docs debian/apache2-doc/usr/share/doc/apache2-doc/manual
-	dh_installdocs -i
-
-override_dh_installdocs-arch:
-	dh_installdocs --link-doc=apache2 -papache2 -papache2-dbg \
-		-papache2-mpm-worker -papache2-mpm-prefork -papache2-mpm-event \
-		-papache2-mpm-itk
-	dh_installdocs --link-doc=apache2-bin -papache2.2-bin -plibapache2-mod-proxy-html \
-	    -plibapache2-mod-macro
-	dh_installdocs --link-doc=apache2-suexec-pristine -papache2-suexec
-	dh_installdocs -a
-
-override_dh_installchangelogs:
-	# Do not install changelogs for transitional packages and the -data
-	# package not to trash the disk at the installation site. Together with
-	# dh_installdocs this means that changelogs are installed in a few
-	# packages only.
-	dh_installchangelogs -Napache2-suexec -Napache2-mpm-worker \
-		-Napache2-mpm-prefork -Napache2-mpm-event -Napache2-mpm-itk \
-		-Napache2-data -Nlibapache2-mod-proxy-html -Napache2.2-bin \
-		-Nlibapache2-mod-macro
-
-override_dh_installman:
-	mv debian/tmp/usr/share/man/man8/suexec.8 debian/tmp/usr/share/man/man8/suexec-pristine.8
-	pod2man debian/debhelper/dh_apache2 > debian/manpages/dh_apache2.1
-	pod2man debian/a2query.in > debian/manpages/a2query.8
-	dh_installman
-
-override_dh_strip:
-	dh_strip --dbg-package=apache2-dbg
-
-override_dh_auto_install:
-	dh_auto_install -- -j1
-
-override_dh_builddeb:
-	dh_builddeb -- -Zxz
-
-override_dh_auto_clean:
-	dh_auto_clean
-
-override_dh_gencontrol:
-	dh_gencontrol  -p libapache2-mod-proxy-html -- -v1:$(DEBIAN_VERSION)
-	dh_gencontrol  -p libapache2-mod-macro -- -v1:$(DEBIAN_VERSION)
-	dh_gencontrol --remaining-packages
-
-.PHONY: generate-maintainer-scripts clean-config-vars prepare-scripts prebuild-checks
-.PHONY: clean build build-arch build-indep binary binary-arch binary-indep

debian.tar.gz Deleted

htcacheclean.service Changed

htcacheclean.service.xml Added

@@ -0,0 +1,123 @@
+<?xml version='1.0' encoding='utf-8'?>
+<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+  "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [
+
+]>
+
+<refentry>
+  <refentryinfo>
+    <title>htcacheclean systemd unit</title>
+    <productname>httpd</productname>
+    <author><contrib>Author</contrib><surname>Orton</surname><firstname>Joe</firstname><email>jorton@redhat.com</email></author>
+  </refentryinfo>
+
+  <refmeta>
+    <refentrytitle>htcacheclean.service</refentrytitle>
+    <manvolnum>8</manvolnum>
+  </refmeta>
+
+  <refnamediv>
+    <refname>htcacheclean.service</refname>
+    <refpurpose>htcacheclean unit file for systemd</refpurpose>
+  </refnamediv>
+
+  <refsynopsisdiv>
+    <para>
+      <filename>/usr/lib/systemd/system/htcacheclean.service</filename>
+    </para>
+  </refsynopsisdiv>
+
+  <refsect1>
+    <title>Description</title>
+
+    <para>This manual page describes the <command>systemd</command>
+    unit file for the <command>htcacheclean</command> daemon.  This
+    unit file provides a service which runs
+    <command>htcacheclean</command> in daemon mode,
+    periodically cleaning the disk cache root to ensure disk space
+    usage is within configured limits.</para>
+
+  </refsect1>
+
+  <refsect1>
+    <title>Options</title>
+
+    <para>The service is configured by configuration file
+    <filename>/etc/sysconfig/htcacheclean</filename>. The following
+    variables are used, following standard <command>systemd</command>
+    <varname>EnvironmentFile=</varname> syntax:</para>
+
+    <variablelist>
+      <varlistentry>
+        <term><varname>INTERVAL=</varname></term>
+
+        <listitem><para>Sets the interval between cache clean runs, in
+        minutes.  By default this is configured as
+        <emphasis>15</emphasis>.</para></listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><varname>CACHE_ROOT=</varname></term>
+
+        <listitem><para>Sets the directory name used for the cache
+        root.  By default this is configured as
+        <filename>/var/cache/httpd/proxy</filename>.</para></listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><varname>LIMIT=</varname></term>
+
+        <listitem><para>Sets the total disk cache space limit, in
+        bytes.  Use a <emphasis>K</emphasis> or <emphasis>M</emphasis>
+        suffix to signify kilobytes or megabytes.  By default this is
+        set to <emphasis>100M</emphasis>.</para></listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><varname>OPTIONS=</varname></term>
+
+        <listitem><para>Any other options to pass to
+        <command>htcacheclean</command>.</para></listitem>
+      </varlistentry>
+    </variablelist>
+  </refsect1>
+
+  <refsect1>
+    <title>Files</title>
+
+    <para><filename>/usr/lib/systemd/system/htcacheclean.service</filename>,
+    <filename>/etc/sysconfig/htcacheclean</filename></para>
+  </refsect1>
+
+  <refsect1>
+    <title>See also</title>
+
+    <para>
+    <citerefentry><refentrytitle>htcacheclean</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
+    <citerefentry><refentrytitle>httpd</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
+    <citerefentry><refentrytitle>httpd.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
+    <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>8</manvolnum></citerefentry>
+    </para>
+  </refsect1>
+
+</refentry>
+
+

httpd-2.4.29.tar.bz2 -> httpd-2.4.39.tar.bz2 Changed

httpd-ssl-pass-dialog Changed

httpd.conf Changed

httpd.conf.xml Added

@@ -0,0 +1,259 @@
+<?xml version='1.0' encoding='utf-8'?>
+<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+  "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [
+
+]>
+
+
+<refentry>
+  <refentryinfo>
+    <title>httpd.conf</title>
+    <productname>httpd</productname>
+    <author><contrib>Author</contrib><surname>Orton</surname><firstname>Joe</firstname><email>jorton@redhat.com</email></author>
+  </refentryinfo>
+
+  <refmeta>
+    <refentrytitle>httpd.conf</refentrytitle>
+    <manvolnum>5</manvolnum>
+  </refmeta>
+  
+  <refnamediv>
+    <refname>httpd.conf</refname>
+    <refpurpose>Configuration files for httpd</refpurpose>
+  </refnamediv>
+
+  <refsynopsisdiv>
+    <para>
+      <filename>/etc/httpd/conf/httpd.conf</filename>, 
+      <filename>/etc/httpd/conf.modules.d</filename>,
+      <filename>/etc/httpd/conf.d</filename>
+    </para>
+  </refsynopsisdiv>
+  
+  <refsect1>
+    <title>Description</title>
+
+    <para>The main configuration file for the <command>httpd</command> daemon is
+    <filename>/etc/httpd/conf/httpd.conf</filename>.  The syntax of
+    this file is described at <ulink
+    url="https://httpd.apache.org/docs/2.4/configuring.html"/>, and
+    the full set of available directives is listed at <ulink
+    url="https://httpd.apache.org/docs/2.4/mod/directives.html"/>.
+    </para>
+
+    <refsect2>
+      <title>Configuration structure</title>
+
+      <para>The main configuration file
+      (<filename>httpd.conf</filename>) sets up various defaults and
+      includes configuration files from two directories -
+      <filename>/etc/httpd/conf.modules.d</filename> and
+      <filename>/etc/httpd/conf.d</filename>.  Packages containing
+      loadable modules (like <option>mod_ssl.so</option>) place files
+      in the <filename>conf.modules.d</filename> directory with the
+      appropriate <option>LoadModule</option> directive so that module
+      is loaded by default.</para>
+
+      <para>Some notable configured defaults are:</para>
+
+      <variablelist>
+        <varlistentry>
+          <term><option>DocumentRoot @DOCROOT@/html</option></term>
+          <listitem><para>The default document root from which content
+          is served.</para></listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><option>Listen 80</option></term>
+          <listitem><para>The daemon listens on TCP port 80.</para></listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><option>ErrorLog "logs/error_log"</option></term>
+          <listitem><para>Error messages are logged to
+          <filename>@LOGDIR@/error_log</filename>.</para></listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><option>ScriptAlias /cgi-bin/ "@DOCROOT@/cgi-bin/"</option></term>
+          <listitem><para>CGI scripts are served via the URL-path <option>/cgi-bin/</option>.</para></listitem>
+        </varlistentry>
+        
+      </variablelist>
+
+      <para>To remove any of the default configuration provided in
+      separate files covered below, replace that file with an empty
+      file rather than removing it from the filesystem, otherwise it
+      may be restored to the original when the package which provides
+      it is upgraded.</para>
+      
+    </refsect2>
+
+    <refsect2>
+      <title>MPM configuration</title>
+
+      <para>The configuration file at
+      <filename>/etc/httpd/conf.modules.d/00-mpm.conf</filename> is
+      used to select the multi-processing module (MPM), which governs
+      how <command>httpd</command> divides work between processes
+      and/or threads at run-time.  Exactly one
+      <option>LoadModule</option> directive must be uncommented in
+      this file; by default the <option>@MPM@</option> MPM is enabled.
+      For more information on MPMs, see <ulink
+      url="https://httpd.apache.org/docs/2.4/mpm.html"/>.</para>
+
+      <para>If using the <emphasis>prefork</emphasis> MPM, the
+      "httpd_graceful_shutdown" SELinux boolean should also be
+      enabled, since with this MPM, httpd needs to establish TCP
+      connections to local ports to successfully complete a graceful
+      restart or shutdown. This boolean can be enabled by running the
+      command: <command>semanage boolean -m --on
+      httpd_graceful_shutdown</command></para>
+    </refsect2>
+    
+    <refsect2>
+      <title>Module configuration files</title>
+      
+      <para>Module configuration files are provided in the
+      <filename>/etc/httpd/conf.modules.d/</filename> directory.  Filenames
+      in this directory are by convention prefixed with two digit numeric
+      prefix to ensure they are processed in the desired order.  Core
+      modules provide with the <command>httpd</command> package are
+      loaded by files with a <option>0x-</option> prefix to ensure
+      these are loaded first.  Only filenames with a
+      <option>.conf</option> suffix in this directory will be
+      processed.</para>
+
+      <para>Other provided configuration files are listed below.
+      
+      <variablelist>
+        <varlistentry>
+          <term><filename>/etc/httpd/conf.modules.d/00-base.conf</filename></term>
+          <listitem><para>The set of core modules included with
+          <command>httpd</command> which are all loaded by
+          default.</para></listitem>
+        </varlistentry>
+        
+        <varlistentry>
+          <term><filename>/etc/httpd/conf.modules.d/00-optional.conf</filename></term>
+          <listitem><para>The set of non-core modules included with
+          <command>httpd</command> which are <emphasis>not</emphasis>
+          loaded by default.</para></listitem>
+        </varlistentry>
+        
+
+        <varlistentry>
+          <term><filename>/etc/httpd/conf.modules.d/00-systemd.conf</filename></term>
+          <listitem><para>This file loads <option>mod_systemd</option>
+          which is necessary for the correct operation of the
+          <command>httpd.service</command> service, and should not be
+          removed or disabled.</para></listitem>
+        </varlistentry>
+      </variablelist>
+      </para>
+    </refsect2>
+        
+    <refsect2>
+      <title>Other configuration files</title>
+
+      <para>Default module configuration files and site-specific
+      configuration files are loaded from the
+      <filename>/etc/httpd/conf.d/</filename> directory.  Only files
+      with a <option>.conf</option> suffix will be loaded.  The
+      following files are provided:
+
+      <variablelist>
+        <varlistentry>
+          <term><filename>/etc/httpd/conf.d/userdir.conf</filename></term>
+          <listitem><para>This file gives an example configuration for
+          <option>mod_userdir</option> to map URLs such as
+          <option>http://localhost/~jim/</option> to
+          <filename>/home/jim/public_html/</filename>. Userdir mapping
+          is disabled by default.</para></listitem>
+        </varlistentry>
+
+        <varlistentry>
+          <term><filename>/etc/httpd/conf.d/autoindex.conf</filename></term>
+          <listitem><para>This file provides the default configuration
+          for <option>mod_autoindex</option> which generates HTML
+          directory listings when enabled.  It also makes file icon
+          image files available at the <option>/icons/</option>
+          URL-path.</para></listitem>
+        </varlistentry>
+
+        <varlistentry>
+          <term><filename>/etc/httpd/conf.d/welcome.conf</filename></term>

httpd.dsc Deleted

@@ -1,35 +0,0 @@
-Format: 1.0
-Source: apache2
-Binary: apache2, apache2-data, apache2-bin, apache2-mpm-worker, apache2-mpm-prefork, apache2-mpm-event, apache2-mpm-itk, apache2.2-bin, apache2.2-common, libapache2-mod-proxy-html, libapache2-mod-macro, apache2-utils, apache2-suexec, apache2-suexec-pristine, apache2-suexec-custom, apache2-doc, apache2-dev, apache2-dbg
-Architecture: any all
-Version: 2.4.29-1
-Maintainer: Debian Apache Maintainers <debian-apache@lists.debian.org>
-Uploaders: Stefan Fritsch <sf@debian.org>, Arno Töll <arno@debian.org>
-Homepage: http://httpd.apache.org/
-Standards-Version: 3.9.5
-Vcs-Browser: http://anonscm.debian.org/gitweb/?p=pkg-apache/apache2.git
-Vcs-Git: git://anonscm.debian.org/pkg-apache/apache2.git
-Build-Depends: debhelper (>= 8.9.7~), bzip2, lsb-release, dpkg-dev (>= 1.16.1~), libaprutil1-dev (>= 1.5.0), libapr1-dev (>= 1.4.0), libpcre3-dev, zlib1g-dev, libssl-dev (>= 0.9.8m), perl, liblua5.1-0-dev, libxml2-dev, autotools-dev, gawk | awk
-Build-Conflicts: autoconf2.13
-Package-List:
- apache2 deb httpd optional arch=any
- apache2-bin deb httpd optional arch=any
- apache2-data deb httpd optional arch=all
- apache2-dbg deb debug extra arch=any
- apache2-dev deb httpd optional arch=any
- apache2-doc deb doc optional arch=all
- apache2-mpm-event deb oldlibs extra arch=any
- apache2-mpm-itk deb oldlibs extra arch=any
- apache2-mpm-prefork deb oldlibs extra arch=any
- apache2-mpm-worker deb oldlibs extra arch=any
- apache2-suexec deb oldlibs extra arch=any
- apache2-suexec-custom deb httpd extra arch=any
- apache2-suexec-pristine deb httpd optional arch=any
- apache2-utils deb httpd optional arch=any
- apache2.2-bin deb oldlibs extra arch=any
- apache2.2-common deb oldlibs extra arch=any
- libapache2-mod-macro deb oldlibs extra arch=any
- libapache2-mod-proxy-html deb oldlibs extra arch=any
-Files:
- 00000000000000000000000000000000 0 httpd-2.4.29.tar.bz2
- 00000000000000000000000000000000 0 debian.tar.gz

httpd.init Deleted

@@ -1,124 +0,0 @@
-#!/bin/bash
-#
-# httpd        Startup script for the Apache HTTP Server
-#
-# chkconfig: - 85 15
-# description: The Apache HTTP Server is an efficient and extensible  \
-#	       server implementing the current HTTP standards.
-# processname: httpd
-# config: /etc/httpd/conf/httpd.conf
-# config: /etc/sysconfig/httpd
-# pidfile: /var/run/httpd/httpd.pid
-#
-### BEGIN INIT INFO
-# Provides: httpd
-# Required-Start: $local_fs $remote_fs $network $named
-# Required-Stop: $local_fs $remote_fs $network
-# Should-Start: distcache
-# Short-Description: start and stop Apache HTTP Server
-# Description: The Apache HTTP Server is an extensible server 
-#  implementing the current HTTP standards.
-### END INIT INFO
-
-# Source function library.
-. /etc/rc.d/init.d/functions
-
-if [ -f /etc/sysconfig/httpd ]; then
-        . /etc/sysconfig/httpd
-fi
-
-# Start httpd in the C locale by default.
-HTTPD_LANG=${HTTPD_LANG-"C"}
-
-# This will prevent initlog from swallowing up a pass-phrase prompt if
-# mod_ssl needs a pass-phrase from the user.
-INITLOG_ARGS=""
-
-# Set HTTPD=/usr/sbin/httpd.worker in /etc/sysconfig/httpd to use a server
-# with the thread-based "worker" MPM; BE WARNED that some modules may not
-# work correctly with a thread-based MPM; notably PHP will refuse to start.
-
-# Path to the apachectl script, server binary, and short-form for messages.
-apachectl=/usr/sbin/apachectl
-httpd=${HTTPD-/usr/sbin/httpd}
-prog=httpd
-pidfile=${PIDFILE-/var/run/httpd/httpd.pid}
-lockfile=${LOCKFILE-/var/lock/subsys/httpd}
-RETVAL=0
-STOP_TIMEOUT=${STOP_TIMEOUT-10}
-
-# The semantics of these two functions differ from the way apachectl does
-# things -- attempting to start while running is a failure, and shutdown
-# when not running is also a failure.  So we just do it the way init scripts
-# are expected to behave here.
-start() {
-        echo -n $"Starting $prog: "
-        LANG=$HTTPD_LANG daemon --pidfile=${pidfile} $httpd $OPTIONS
-        RETVAL=$?
-        echo
-        [ $RETVAL = 0 ] && touch ${lockfile}
-        return $RETVAL
-}
-
-# When stopping httpd, a delay (of default 10 second) is required
-# before SIGKILLing the httpd parent; this gives enough time for the
-# httpd parent to SIGKILL any errant children.
-stop() {
-	echo -n $"Stopping $prog: "
-	killproc -p ${pidfile} -d ${STOP_TIMEOUT} $httpd
-	RETVAL=$?
-	echo
-	[ $RETVAL = 0 ] && rm -f ${lockfile} ${pidfile}
-}
-reload() {
-    echo -n $"Reloading $prog: "
-    if ! LANG=$HTTPD_LANG $httpd $OPTIONS -t >&/dev/null; then
-        RETVAL=6
-        echo $"not reloading due to configuration syntax error"
-        failure $"not reloading $httpd due to configuration syntax error"
-    else
-        # Force LSB behaviour from killproc
-        LSB=1 killproc -p ${pidfile} $httpd -HUP
-        RETVAL=$?
-        if [ $RETVAL -eq 7 ]; then
-            failure $"httpd shutdown"
-        fi
-    fi
-    echo
-}
-
-# See how we were called.
-case "$1" in
-  start)
-	start
-	;;
-  stop)
-	stop
-	;;
-  status)
-        status -p ${pidfile} $httpd
-	RETVAL=$?
-	;;
-  restart)
-	stop
-	start
-	;;
-  condrestart|try-restart)
-	if status -p ${pidfile} $httpd >&/dev/null; then
-		stop
-		start
-	fi
-	;;
-  force-reload|reload)
-        reload
-	;;
-  graceful|help|configtest|fullstatus)
-	$apachectl $@
-	RETVAL=$?
-	;;
-  *)
-	echo $"Usage: $prog {start|stop|restart|condrestart|try-restart|force-reload|reload|status|fullstatus|graceful|help|configtest}"
-	RETVAL=2
-esac
-
-exit $RETVAL

httpd.service.xml Changed

@@ -4,7 +4,7 @@
 
 ]>
 <!--
- Copyright 2017 Red Hat, Inc.
+ Copyright 2018 Red Hat, Inc.
 
  Licensed to the Apache Software Foundation (ASF) under one or more
  contributor license agreements.  See the NOTICE file distributed with
@@ -36,6 +36,7 @@
   
   <refnamediv>
     <refname>httpd.service</refname>
+    <refname>httpd@.service</refname>
     <refname>httpd.socket</refname>
     <refname>httpd-init.service</refname>
     <refpurpose>httpd unit files for systemd</refpurpose>
@@ -44,6 +45,7 @@
   <refsynopsisdiv>
     <para>
       <filename>/usr/lib/systemd/system/httpd.service</filename>, 
+      <filename>/usr/lib/systemd/system/httpd@.service</filename>,
       <filename>/usr/lib/systemd/system/httpd-init.service</filename>,
       <filename>/usr/lib/systemd/system/httpd.socket</filename>
     </para>
@@ -54,8 +56,8 @@
 
     <para>This manual page describes the <command>systemd</command>
     unit files used to integrate the <command>httpd</command> daemon
-    with <command>systemd</command>. Two unit files are available:
-    <command>httpd.service</command> allows the
+    with <command>systemd</command>. Two main unit files are
+    available: <command>httpd.service</command> allows the
     <command>httpd</command> daemon to be run as a system service, and
     <command>httpd.socket</command> allows httpd to be started via
     socket-based activation. Most systems will use
@@ -82,8 +84,9 @@
       directly, since such changes would be lost over package
       upgrades. Running <command>systemctl edit
       httpd.service</command> or <command>systemctl edit
-      httpd.socket</command> as root will create a drop-in file in
-      <filename>/etc/systemd/system/httpd.service.d</filename> which
+      httpd.socket</command> as root will create a drop-in file (in
+      the former case, in
+      <filename>/etc/systemd/system/httpd.service.d</filename>) which
       over-rides the system defaults.</para>
 
       <para>For example, to set the <option>LD_LIBRARY_PATH</option>
@@ -107,10 +110,10 @@
 
       <para>If httpd is configured to depend on any specific IP
       address (for example, with a "Listen" directive) which may only
-      become available during startup, or if httpd depends on other
+      become available during start-up, or if httpd depends on other
       services (such as a database daemon), the service
       <emphasis>must</emphasis> be configured to ensure correct
-      startup ordering.</para>
+      start-up ordering.</para>
 
       <para>For example, to ensure httpd is only running after all
       configured network interfaces are configured, create a drop-in
@@ -122,7 +125,7 @@
 
       See <ulink
       url="https://www.freedesktop.org/wiki/Software/systemd/NetworkTarget/"/>
-      for more information on startup ordering with systemd.</para>
+      for more information on start-up ordering with systemd.</para>
 
     </refsect2>
 
@@ -136,7 +139,7 @@
       httpd is started. To inhibit certificate generation, use
       <command>systemctl mask httpd-init.service</command> after
       installing mod_ssl, and adjust the mod_ssl configuration to use
-      an appropriate certicate and key.</para>
+      an appropriate certificate and key.</para>
 
     </refsect2>
 
@@ -167,21 +170,28 @@
     </refsect2>
 
     <refsect2>
+      <title>Automated service restarts</title>
+
+      <para>System packages (including the httpd package itself) may
+      restart the httpd service automatically after packages are
+      upgraded, installed, or removed. This is done using the
+      <command>systemctl reload httpd.service</command>, which
+      produces a <emphasis>graceful</emphasis> restart by default as
+      described above.</para>
+
+      <para>To suppress automatic reloads entirely, create the file
+      <filename>/etc/sysconfig/httpd-disable-posttrans</filename>.</para>
+    </refsect2>
+
+    <refsect2>
       <title>Changing the default MPM (Multi-Processing Module)</title>
 
       <para>httpd offers a choice of multi-processing modules (MPMs),
       which can be configured in
-      <filename>/etc/httpd/conf.modules.d/00-mpm.conf</filename>.  The
-      default is to use the <emphasis>@MPM@</emphasis> MPM.</para>
-
-      <para>If using the <emphasis>prefork</emphasis> MPM, the
-      "httpd_graceful_shutdown" SELinux boolean should also be
-      enabled, since with this MPM, httpd needs to establish TCP
-      connections to local ports to successfully complete a graceful
-      restart or shutdown. This boolean can be enabled by running the
-      command: <command>semanage boolean -m --on
-      httpd_graceful_shutdown</command></para>
-
+      <filename>/etc/httpd/conf.modules.d/00-mpm.conf</filename>.
+      See
+      <citerefentry><refentrytitle>httpd.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
+      for more information on changing the MPM.</para>
     </refsect2>
 
     <refsect2>
@@ -206,8 +216,9 @@
       to which httpd can bind (using the <literal>Listen</literal>
       directive), which parts of the filesystem can be accessed, and
       whether outgoing TCP connections are possible. Many of these
-      restrictions can be adjusted using <command>semanage</command>
-      to change booleans or other types. See
+      restrictions can be relaxed or adjusted by using
+      <command>semanage</command> to change booleans or other
+      types. See
       <citerefentry><refentrytitle>httpd_selinux</refentrytitle><manvolnum>8</manvolnum></citerefentry>
       for more information.</para>
 
@@ -246,6 +257,48 @@
       192.168.1.2:80</literal>" will not work.</para>
     </refsect2>
 
+    <refsect2>
+      <title>Instantiated services</title>
+
+      <para>The <command>httpd@.service</command> unit is an
+      instantiated template service. An instance of this unit will be
+      started using the configuration file
+      <filename>/etc/httpd/conf/INSTANCE.conf</filename>, where
+      <emphasis>INSTANCE</emphasis> is replaced with the instance
+      name.  For example, <command>systemctl start
+      httpd@foobar.service</command> will start httpd using the
+      configuration file
+      <filename>/etc/httpd/conf/foobar.conf</filename>.  The
+      <option>HTTPD_INSTANCE</option> environment variable is set to
+      the instance name by the unit and is available for use within
+      the configuration file.</para>
+
+      <para>To allow multiple instances of httpd to run
+      simultaneously, a number of configuration directives must be
+      changed, such as <command>PidFile</command> and
+      <command>DefaultRuntimeDir</command> to pick non-conflicting
+      paths, and <command>Listen</command> to choose different ports.
+      The example configuration file
+      <filename>/usr/share/doc/httpd/instance.conf</filename>
+      demonstrates how to make such changes using
+      <option>HTTPD_INSTANCE</option> variable.</para>
+
+      <para>It can be useful to configure instances of
+      <command>httpd@.service</command> to reload when
+      <command>httpd.service</command> is reloaded; for example,
+      <command>logrotate</command> will reload only
+      <command>httpd.service</command> when logs are rotated. If this
+      behaviour is required, create a drop-in file for the instance as
+      follows:
+
+      <programlisting>[Unit]
+ReloadPropagatedFrom=httpd.service</programlisting>
+
+      As with normal units, drop-in files for instances can be created
+      using <command>systemctl edit</command>, e.g. <command>systemctl edit
+      httpd@foobar.service</command>.</para>
+    </refsect2>
+
   </refsect1>
 
   <refsect1>
@@ -253,6 +306,7 @@
 
     <para><filename>/usr/lib/systemd/system/httpd.service</filename>,
     <filename>/usr/lib/systemd/system/httpd.socket</filename>,
+    <filename>/usr/lib/systemd/system/httpd@.service</filename>,
     <filename>/etc/systemd/systemd/httpd.service.d</filename></para>
   </refsect1>
   
@@ -261,6 +315,7 @@
 
     <para>
     <citerefentry><refentrytitle>httpd</refentrytitle><manvolnum>8</manvolnum></citerefentry>, 
+    <citerefentry><refentrytitle>httpd.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
     <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>, 
     <citerefentry><refentrytitle>systemctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>, 
     <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
@@ -272,3 +327,6 @@
   </refsect1>
 
 </refentry>

httpd.sysconf Deleted

@@ -1,30 +0,0 @@
-#
-# This file is no longer used to configure additional environment variables
-# for the httpd process.
-#
-# It has been replaced by systemd. If you want to customize, the best
-# way is to create a file "/etc/systemd/system/httpd.service",
-# containing
-#   .include /lib/systemd/system/httpd.service
-#   ...make your changes here...
-# For more info about custom unit files, see
-# http://fedoraproject.org/wiki/Systemd#How_do_I_customize_a_unit_file.2F_add_a_custom_unit_file.3F
-
-
-# To set OPTIONS environment variable which was set in this file
-# in older versions, you need to create a file named
-# "/etc/systemd/system/httpd.service" containing:
-#	.include /lib/systemd/system/httpd.service
-#	[Service]
-#	#
-#	# To pass additional options (for instance, -D definitions) to the
-#	# httpd binary at startup, set OPTIONS here.
-#	#
-#	Environment=OPTIONS=-DMY_DEFINE
-
-# Note: With previous versions of httpd, the MPM could be changed by
-# editing an "HTTPD" variable here.  With the current version, that
-# variable is now ignored.  The MPM is a loadable module, and the
-# choice of MPM can be changed by editing the configuration file
-# /etc/httpd/conf.modules.d/00-mpm.conf.
-#

httpd@.service Added

instance.conf Added

pullrev.sh Changed

server-status.conf Added

sources Deleted

ssl.conf Changed

@@ -70,11 +70,10 @@
 SSLEngine on
 
 #   List the protocol versions which clients are allowed to connect with.
-#   Disable SSLv3 by default (cf. RFC 7525 3.1.1).  TLSv1 (1.0) should be
-#   disabled as quickly as practical.  By the end of 2016, only the TLSv1.2
-#   protocol or later should remain in use.
-SSLProtocol all -SSLv3
-SSLProxyProtocol all -SSLv3
+#   The OpenSSL system profile is configured by default.  See
+#   update-crypto-policies(8) for more details.
+#SSLProtocol all -SSLv3
+#SSLProxyProtocol all -SSLv3
 
 #   User agents such as web browsers are not configured for the user's
 #   own preference of either security or performance, therefore this
@@ -83,10 +82,10 @@
 SSLHonorCipherOrder on
 
 #   SSL Cipher Suite:
-# List the ciphers that the client is permitted to negotiate.
-# See the mod_ssl documentation for a complete list.
-# The OpenSSL system profile is configured by default.  See
-# update-crypto-policies(8) for more details.
+#   List the ciphers that the client is permitted to negotiate.
+#   See the mod_ssl documentation for a complete list.
+#   The OpenSSL system profile is configured by default.  See
+#   update-crypto-policies(8) for more details.
 SSLCipherSuite PROFILE=SYSTEM
 SSLProxyCipherSuite PROFILE=SYSTEM