Apache httpd 2.4.48-1, собранный с Brotli, TLS 1.3 final (RFC 8446), OpenSSL 1.1.1k, ALPN и поддержкой http2 для Red Hat Enterprise Linux и CentOS

В репозиторий добавлен Apache httpd 2.4.48-1 с поддержкой сжатия brotli от Google, mod_http2 1.15.19 для Red Hat Enterprise Linux и CentOS. Mod_ssl собран динамически с OpenSSL 1.1.1k.
Также по просьбам пользователей добавлен mod_fcgid 2.3.9.
Ссылки:

• Apache httpd 2.4.48 для EL7;

Заметим, что httpd 2.4.48 поддерживает TLS 1.3 при сборке с OpenSSL 1.1.1. Все новые шифры включены и работают.
C версии 2.4.43-4 мы собираем OpenSSL отдельно, он устанавливается в /opt/codeit/openssl111 и никак не затрагивает системные библиотеки.

TLS 1.3 final на сегодня работает в Google Chrome 70+ и Mozilla Firefox 63+.

Для работы с SELinux в rpm включена соответствующая минимальная политика.

Модуль brotli уже включён в базовый RPM. Всё, что нужно — настроить фильтр

AddOutputFilterByType BROTLI_COMPRESS text/html text/plain text/xml text/css text/javascript application/javascript

Changes with Apache 2.4.48

  *) mod_proxy_wstunnel: Add ProxyWebsocketFallbackToProxyHttp to opt-out the
     fallback to mod_proxy_http for WebSocket upgrade and tunneling.
     [Yann Ylavic]

  *) mod_proxy: Fix flushing of THRESHOLD_MIN_WRITE data while tunneling.
     BZ 65294.  [Yann Ylavic]

  *) core: Fix a regression that stripped the ETag header from 304 responses.
     PR 61820 [Ruediger Pluem, Roy T. Fielding]

  *) core: Adding SSL related inquiry functions to the server API.
     These function are always available, even when no module providing
     SSL is loaded. They provide their own "shadowing" implementation for
     the optional functions of similar name that mod_ssl and impersonators
     of mod_ssl provide.
     This enables loading of several SSL providing modules when all but
     one of them registers itself into the new hooks. Two old-style SSL
     modules will not work, as they replace the others optional functions
     with their own.
     Modules using the old-style optional functions will continue to work
     as core supplies its own versions of those.
     The following has been added so far:
     - ap_ssl_conn_is_ssl() to query if a connection is using SSL.
     - ap_ssl_var_lookup() to query SSL related variables for a
       server/connection/request.
     - Hooks for 'ssl_conn_is_ssl' and 'ssl_var_lookup' where modules
       providing SSL can install their own value supplying functions.
     - ap_ssl_add_cert_files() to enable other modules like mod_md to provide
       certificate and keys for an SSL module like mod_ssl.
     - ap_ssl_add_fallback_cert_files() to enable other modules like mod_md to
       provide a fallback certificate in case no 'proper' certificate is
       available for an SSL module like mod_ssl.
     - ap_ssl_answer_challenge() to enable other modules like mod_md to
       provide a certificate as used in the RFC 8555 'tls-alpn-01' challenge
       for the ACME protocol for an SSL module like mod_ssl. The function
       and its hook provide PEM encoded data instead of file names.
     - Hooks for 'ssl_add_cert_files', 'ssl_add_fallback_cert_files' and
       'ssl_answer_challenge' where modules like mod_md can provide providers
       to the above mentioned functions.
     - These functions reside in the new 'http_ssl.h' header file.
     [Stefan Eissing]

  *) core/mod_ssl/mod_md: adding OCSP response provisioning as core feature. This
     allows modules to access and provide OCSP response data without being tied
     of each other. The data is exchanged in standard, portable formats (PEM encoded
     certificates and DER encoded responses), so that the actual SSL/crypto
     implementations used by the modules are independant of each other.
     Registration and retrieval happen in the context of a server (server_rec)
     which modules may use to decide if they are configured for this or not.
     The area of changes:
     1. core: defines 2 functions in include/http_ssl.h, so that modules may
        register a certificate, together with its issuer certificate for OCSP
        response provisioning and ask for current response data (DER bytes) later.
        Also, 2 hooks are defined that allow modules to implement this OCSP
        provisioning.
     2. mod_ssl uses the new functions, in addition to what it did already, to
        register its certificates this way. If no one is interested in providing
        OCSP, it falls back to its own (if configured) stapling implementation.
     3. mod_md registers itself at the core hooks for OCSP provisioning. Depending
        on configuration, it will accept registrations of its own certificates only,
        all certificates or none.
     [Stefan Eissing]

 *) mod_md: v2.4.0 with improvements and bugfixes
     - MDPrivateKeys allows the specification of several types. Beside "RSA" plus
     optional key lengths elliptic curves can be configured. This means you can
     have multiple certificates for a Managed Domain with different key types.
     With ```MDPrivateKeys secp384r1 rsa2048``` you get one ECDSA  and one RSA
     certificate and all modern client will use the shorter ECDSA, while older
     client will get the RSA certificate.
     Many thanks to @tlhackque who pushed and helped on this.
     - Support added for MDomains consisting of a wildcard. Configuring
     ```MDomain *.host.net``` will match all virtual hosts matching that pattern
     and obtain one certificate for it (assuming you have 'dns-01' challenge
     support configured). Addresses #239.
     - Removed support for ACMEv1 servers. The only known installation used to
     be Let's Encrypt which has disabled that version more than a year ago for
     new accounts.
     - Andreas Ulm (<https://github.com/root360-AndreasUlm>) implemented the
     ```renewing``` call to ```MDMessageCmd``` that can deny a certificate
     renewal attempt. This is useful in clustered installations, as
     discussed in #233).
     - New event ```challenge-setup::```, triggered when the
     challenge data for a domain has been created. This is invoked before the
     ACME server is told to check for it. The type is one of the ACME challenge
     types. This is invoked for every DNS name in a MDomain.
     - The max delay for retries has been raised to daily (this is like all
     retries jittered somewhat to avoid repeats at fixed time of day).
     - Certain error codes reported by the ACME server that indicate a problem
     with the configured data now immediately switch to daily retries. For
     example: if the ACME server rejects a contact email or a domain name,
     frequent retries will most likely not solve the problem. But daily retries
     still make sense as there might be an error at the server and un-supervised
     certificate renewal is the goal. Refs #222.
     - Test case and work around for domain names > 64 octets. Fixes #227.
     When the first DNS name of an MD is longer than 63 octets, the certificate
     request will not contain a CN field, but leave it up to the CA to choose one.
     Currently, Lets Encrypt looks for a shorter name in the SAN list given and
     fails the request if none is found. But it is really up to the CA (and what
     browsers/libs accept here) and may change over the years. That is why
     the decision is best made at the CA.
     - Retry delays now have a random +/-[0-50]% modification applied to let
     retries from several servers spread out more, should they have been
     restarted at the same time of day.
     - Fixed several places where the 'badNonce' return code from an ACME server
     was not handled correctly. The test server 'pebble' simulates this behaviour
     by default and helps nicely in verifying this behaviour. Thanks, pebble!
     - Set the default `MDActivationDelay` to 0. This was confusing to users that
     new certificates were deemed not usably before a day of delay. When clocks are
     correct, using a new certificate right away should not pose a problem.
     - When handling ACME authorization resources, the module no longer requires
     the server to return a "Location" header, as was necessary in ACMEv1.
     Fixes #216.
     - Fixed a theoretical uninitialized read when testing for JSON error responses
     from the ACME CA. Reported at <https://bz.apache.org/bugzilla/show_bug.cgi?id=64297>.
     - ACME problem reports from CAs that include parameters in the Content-Type
     header are handled correctly. (Previously, the problem text would not be
     reported and retries could exceed CA limits.)
     - Account Update transactions to V2 CAs now use the correct POST-AS-GET method.
     Previously, an empty JSON object was sent - which apparently LE accepted,
     but others reject.
     [Stefan Eissing, @tlhackque, Andreas Ulm]

Changes with Apache 2.4.47

  *) mod_dav_fs: Improve logging output when failing to open files for
     writing.  PR 64413.  [Bingyu Shen ]

  *) mod_http2: Fixed a race condition that could lead to streams being
     aborted (RST to the client), although a response had been produced.
     [Stefan Eissing]

  *) mod_lua: Add support to Lua 5.4  [Joe Orton, Giovanni Bechis, Ruediger Pluem]

  *) MPM event/worker: Fix possible crash in child process on early signal
     delivery.  PR 64533.  [Ruediger Pluem]

  *) mod_http2: sync with github standalone version 1.15.17
     - Log requests and sent the configured error response in case of early detected
       errors like too many or too long headers. [Ruediger Pluem]
     - new option 'H2OutputBuffering on/off' which controls the buffering of stream output.
       The default is on, which is the behaviour of older mod-h2 versions. When off, all
       bytes are made available immediately to the main connection for sending them
       out to the client. This fixes interop issues with certain flavours of gRPC, see
       also <https://github.com/icing/mod_h2/issues/207>.
       [Stefan Eissing]

  *) mod_unique_id: Fix potential duplicated ID generation under heavy load.
     PR 65159
     [Jonas Müntener , Christophe Jaillet]

  *) "[mod_dav_fs etag handling] should really honor the FileETag setting".
     - It now does.
     - Add "Digest" to FileETag directive, allowing a strong ETag to be
       generated using a file digest.
     - Add ap_make_etag_ex() and ap_set_etag_fd() to allow full control over
       ETag generation.
     - Add concept of "binary notes" to request_rec, allowing packed bit flags
       to be added to a request.
     - First binary note - AP_REQUEST_STRONG_ETAG - allows modules to force
       the ETag to a strong ETag to comply with RFC requirements, such as those
       mandated by various WebDAV extensions.
     [Graham Leggett]

  *) mod_proxy_http: Fix a possibly crash when the origin connection gets
     interrupted before completion.  PR 64234.
     [Barnim Dzwillo , Ruediger Pluem]

  *) mod_ssl: Do not keep connections to OCSP responders alive when doing
     OCSP requests.  PR 64135.  [Ruediger Pluem]

  *) mod_ssl: Improve the coalescing filter to buffer into larger TLS
     records, and avoid revealing the HTTP header size via TLS record
     boundaries (for common response generators).
     [Joe Orton, Ruediger Pluem]

  *) mod_proxy_hcheck: Don't pile up health checks if the previous one did
     not finish before hcinterval.  PR 63010.  [Yann Ylavic]

  *) mod_session: Improve session parsing.  [Yann Yalvic]

  *) mod_authnz_ldap: Prevent authentications with empty passwords for the
     initial bind to fail with status 500. [Ruediger Pluem]

  *) mod_auth_digest: Fast validation of the nonce's base64 to fail early if
     the format can't match anyway.  [Yann Ylavic]

  *) mod_proxy_fcgi: Honor "SetEnv proxy-sendcl" to forward a chunked
     Transfer-Encoding from the client, spooling the request body when needed
     to provide a Content-Length to the backend.  PR 57087.  [Yann Ylavic]

  *) mod_proxy: Put mod_proxy_{connect,wstunnel} tunneling code in common in
     proxy_util.  [Yann Ylavic]

  *) mod_proxy: Improve tunneling loop to support half closed connections and
     pending data draining (for protocols like rsync). PR 61616. [Yann Ylavic]

  *) mod_proxy_http: handle Upgrade request, 101 (Switching Protocol) response
     and switched protocol forwarding.  [Yann Ylavic]

  *) mod_proxy_wstunnel: Leave Upgrade requests handling to mod_proxy_http,
     allowing for (non-)Upgrade negotiation with the origin server.
     [Yann Ylavic]

  *) mod_proxy: Allow ProxyErrorOverride to be restricted to specific status
     codes.  PR63628. [Martin Drößler ]

  *) core: Add ReadBufferSize, FlushMaxThreshold and FlushMaxPipelined
     directives.  [Yann Ylavic]

  *) core: Ensure that aborted connections are logged as such. PR 62823
     [Arnaud Grandville <[email protected]>]

  *) http: Allow unknown response status' lines returned in the form of
     "HTTP/x.x xxx Status xxx".  [Yann Ylavic]

  *) mod_proxy_http: Fix 100-continue deadlock for spooled request bodies,
     leading to Request Timeout (408).  PR 63855.  [Yann Ylavic]

  *) core: Remove headers on 304 Not Modified as specified by RFC7234, as
     opposed to passing an explicit subset of headers. PR 61820.
     [Giovanni Bechis]

  *) mpm_event: Don't reset connections after lingering close, restoring prior
     to 2.4.28 behaviour.  [Yann Ylavic]

  *) mpm_event: Kill connections in keepalive state only when there is no more
     workers available, not when the maximum number of connections is reached,
     restoring prior to 2.4.30 behaviour.  [Yann Ylavic]

  *) mod_unique_id: Use base64url encoding for UNIQUE_ID variable,
     avoiding the use of '@'.  PR 57044.
     [Michael Kaufmann ]

  *) mod_rewrite: Extend the [CO] (cookie) flag of RewriteRule to accept a
     SameSite attribute. [Eric Covener]

  *) mod_proxy: Add proxy check_trans hook.  This allows proxy
     modules to decline request handling at early stage.

  *) mod_proxy_wstunnel: Decline requests without an Upgrade
     header so ws/wss can be enabled overlapping with later
     http/https.

  *) mod_http2: Log requests and sent the configured error response in case of
     early detected errors like too many or too long headers.
     [Ruediger Pluem, Stefan Eissing]

  *) mod_md: Lowered the required minimal libcurl version from 7.50 to 7.29
     as proposed by . [Stefan Eissing]

  *) mod_ssl: Fix request body buffering with PHA in TLSv1.3.  [Joe Orton]

  *) mod_proxy_uwsgi: Fix a crash when sending environment variables with no
     value. PR 64598 [Ruediger Pluem]

  *) mod_proxy: Recognize parameters from ProxyPassMatch workers with dollar
     substitution, such that they apply to the backend connection.  Note that
     connection reuse is disabled by default to avoid compatibility issues.
     [Takashi Sato, Jan Kaluza, Eric Covener, Yann Ylavic, Jean-Frederic Clere]