*) mod_ssl: For the "SSLStaplingReturnResponderErrors off" case, make sure
to only staple responses with certificate status "good". [Kaspar Brand]
- *) mod_http2: incoming trailers (headers after request body) are properly
- forwarded to the processing engine. [Stefan Eissing]
-
- *) mod_http2: new directive 'H2Push' to en-/disable HTTP/2 server
- pushes a server/virtual host. Pushes are initiated by the presence
- of 'Link:' headers with relation 'preload' on a response. [Stefan Eissing]
-
- *) mod_http2: write performance of http2 improved for larger resources,
- especially static files. [Stefan Eissing]
-
- *) core: if the first HTTP/1.1 request on a connection goes to a server that
- prefers different protocols, these protocols are announced in a Upgrade:
- header on the response, mentioning the preferred protocols.
- [Stefan Eissing]
-
- *) mod_http2: new directive 'H2ModernTLSOnly' to enforce security
- requirements of RFC 7540 on TLS connections. [Stefan Eissing]
-
- *) mod_http2: new directives 'H2TLSWarmUpSize' and 'H2TLSCoolDownSecs'
- to control TLS record sizes during connection lifetime.
-
- *) htpasswd/htdigest: Disable support for bcrypt on EBCDIC platforms.
- apr-util's bcrypt implementation doesn't tolerate EBCDIC.
-
- *) core: add ap_get_protocol_upgrades() to retrieve the list of protocols
- that a client could possibly upgrade to. Use in first request on a
- connection to announce protocol choices. [Stefan Eissing]
-
- *) mod_http2: reworked deallocation on connection shutdown and worker
- abort. Separate parent pool for all workers. worker threads are joined
- on planned worker shutdown.
- [Yann Ylavic, Stefan Eissing]
-
- *) mod_ssl: when receiving requests for other virtual hosts than the handshake
- server, the SSL parameters are checked for equality. With equal
- configuration, requests are passed for processing. Any change will trigger
- the old behaviour of "421 Misdirected Request".
- SSL now remembers the cipher suite that was used for the last handshake.
- This is compared against for any vhost/directory cipher specification.
- Detailed examination of renegotiation is only done when these do not
- match.
- Renegotiation is 403ed when a master connection is present. Exact reason
- is given additionally in a request note. [Stefan Eissing]
-
*) core: Limit to ten the number of tolerated empty lines between request,
and consume them before the pipelining check to avoid possible response
delay when reading the next request without flushing. [Yann Ylavic]
the SSLVerifyDepth applied with the default/handshaken vhost differs from
the one applicable with the finally selected vhost. [Yann Ylavic]
- *) mod_ssl: add ALPN support by allowing other modules to register callbacks
- for negotiation of the application layer protocol. PR 52210.
- [Matthew Steele <mdsteele google com>, Joe Orton, Jim Jagielski,
- Stefan Eissing <stefan eissing org>, Rainer Jung, Ruediger Pluem,
- Kaspar Brand]
-
*) http: Don't remove the Content-Length of zero from a HEAD response if
it comes from an origin server, module or script. [Yann Ylavic]