Month: April 2019

Apache httpd 2.4.39 with brotli compression library from Google, TLS 1.3 Final (RFC 8446), http2 (HTTP/2) support for Red Hat Enterprise Linux and CentOS added to repository. Mod_ssl is built statically against OpenSSL 1.1.1b.

Links:

• Apache httpd 2.4.39 for EL7;

Since 2.4.33 we added brotli compression library. Since 2.4.35 release we start building Apache httpd against OpenSSL 1.1.1*. Since 2.4.37 release TLS 1.3 final version (not to be confused with any draft versions) is supported and enabled by default.

Please note that TLS 1.3 final version is supported in Chrome 70+ and Mozilla Firefox 63+.

brotli support is already included in base RPM file. All you need is to add filters like

AddOutputFilterByType BROTLI_COMPRESS text/html text/plain text/xml text/css text/javascript application/javascript

Http2 Apache httpd module no longer supports prefork mpm from version 2.4.27. If you need http2 module, please disable prefork mpm and enable evemt mpm in /etc/httpd/conf.modules.d/00-mpm.conf. We already made this in 00-mpm.conf in our packages. If you are updating other vendor installation, please update this file.

For correct work with SELinux please update the following boolean:

setsebool -P httpd_execmem=1

Feel free to use our CentOS/RHEL repository. Please also note that this package depends on apr-util 1.5.0+ and libnghttp, which you can found in EPEL repository. So, the easiest way to use our builds of Apache HTTPd is to add EPEL repository, if you still do not have it: yum install -y epel-release

Changes with Apache 2.4.39:

• mod_proxy/ssl: Cleanup per-request SSL configuration anytime a backend connection is recycled/reused to avoid a possible crash with some SSLProxy configurations in or context. PR 63256. [Yann Ylavic]
• mod_ssl: Correctly restore SSL verify state after TLSv1.3 PHA failure. [Michael Kaufmann]
• mod_log_config: Support %{c}h for conn-hostname, %h for useragent_host PR 55348
• mod_socache_redis: Support for Redis as socache storage provider.
• core: new configuration option ‘MergeSlashes on|off’ that controls handling of multiple, consecutive slash (‘/’) characters in the path component of the request URL. [Eric Covener]
• mod_http2: when SSL renegotiation is inhibited and a 403 ErrorDocument is in play, the proper HTTP/2 stream reset did not trigger with H2_ERR_HTTP_1_ 1_REQUIRED. Fixed. [Michael Kaufmann]
• mod_http2: new configuration directive: `H2Padding numbits` to control padding of HTTP/2 payload frames. ‘numbits’ is a number from 0-8, controlling the range of padding bytes added to a frame. The actual number added is chosen randomly per frame. This applies to HEADERS, DATA and PUSH_PROMISE frames equally. The default continues to be 0, e.g. no padding. [Stefan Eissing]
• mod_http2: ripping out all the h2_req_engine internal features now that mod _proxy_http2 has no more need for it. Optional functions are still declared but no longer implemented. While previous mod_proxy_http2 will work with this, it is recommended to run the matching versions of both modules. [Stefan Eissing]
• mod_proxy_http2: changed mod_proxy_http2 implementation and fixed several bugs which resolve PR63170. The proxy module does now a single h2 request on the (reused) connection and returns. [Stefan Eissing]
• mod_http2/mod_proxy_http2: proxy_http2 checks correct master connection aborted status to trigger immediate shutdown of backend connections. This is now always signalled by mod_http2 when the the session is being released. proxy_http2 now only sends a PING frame to the backend when there is not already one in flight. [Stefan Eissing]
• mod_proxy_http2: fixed an issue where a proxy_http2 handler entered an infi nite loop when encountering certain errors on the backend connection. [Stefan Eissing]
• mod_http2: Configuration directives H2Push and H2Upgrade can now be specifi ed per Location/Directory, e.g. disabling PUSH for a specific set of resources. [Stefan Eissing]
• mod_http2: HEAD requests to some module such as mod_cgid caused the stream to terminate improperly and cause a HTTP/2 PROTOCOL_ERROR. [Michael Kaufmann]
• http: Fix possible empty response with mod_ratelimit for HEAD requests. PR 63192. [Yann Ylavic]
• mod_cache_socache: Avoid reallocations and be safe with outgoing data lifetime. [Yann Ylavic]
• MPMs unix: bind the bucket number of each child to its slot number, for a more efficient per bucket maintenance. [Yann Ylavic]
• mod_auth_digest: Fix a race condition. Authentication with valid credentials could be refused in case of concurrent accesses from different users. PR 63124. [Simon Kappel]
• mod_http2: enable re-use of slave connections again. Fixed slave connection keepalives counter. [Stefan Eissing]
• mod_reqtimeout: Allow to configure (TLS-)handshake timeouts. PR 61310. [Yann Ylavic]
• mod_proxy_wstunnel: Fix websocket proxy over UDS. PR 62932
• mod_ssl: Don’t unset FIPS mode on restart unless it’s forced by configuration (SSLFIPS on) and not active by default in OpenSSL. PR 63136. [Yann Ylavic]