mod_ssl: fix small memory leak in ssl_init_server_certs when ECDH is used.
SSL_CTX_set_tmp_ecdh increases reference count, so we have to call
EC_KEY_free, otherwise eckey will not be freed.

Backports: r1666363
Author: jkaluza
Reviewed by: rjung, ylavic, wrowe

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1682074 13f79535-47bb-0310-9956-ffa450edef68

Vote and promote

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1682059 13f79535-47bb-0310-9956-ffa450edef68

Propose.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1681765 13f79535-47bb-0310-9956-ffa450edef68

v4 for ALPN proposal adding r1670738.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1681764 13f79535-47bb-0310-9956-ffa450edef68

Vote.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1681752 13f79535-47bb-0310-9956-ffa450edef68

v3 for ALPN proposal without one remaining HAVE_TLS_NPN stuff.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1681751 13f79535-47bb-0310-9956-ffa450edef68

Propose ALPN support.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1681749 13f79535-47bb-0310-9956-ffa450edef68

Vote (fix link).

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1681691 13f79535-47bb-0310-9956-ffa450edef68

Propose.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1681690 13f79535-47bb-0310-9956-ffa450edef68

Propose

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1681688 13f79535-47bb-0310-9956-ffa450edef68

Rebuild.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1681601 13f79535-47bb-0310-9956-ffa450edef68

XML updates.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1681600 13f79535-47bb-0310-9956-ffa450edef68

Merge r1679712 from trunk:

Follow up to r1679181: fix warning (return discards qualifiers from pointer target type).

Submitted by: ylavic
Reviewed by: trawick, rjung

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1681590 13f79535-47bb-0310-9956-ffa450edef68

remove my incorrect claim that we returned 400 in the wrong case

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1681589 13f79535-47bb-0310-9956-ffa450edef68

Propose

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1681518 13f79535-47bb-0310-9956-ffa450edef68

Rebuild.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1681467 13f79535-47bb-0310-9956-ffa450edef68

XML updates.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1681466 13f79535-47bb-0310-9956-ffa450edef68

Rebuild.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1681366 13f79535-47bb-0310-9956-ffa450edef68

XML updates.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1681365 13f79535-47bb-0310-9956-ffa450edef68

Vote and express promote (since it is such
a simple change).

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1681358 13f79535-47bb-0310-9956-ffa450edef68

Note that the OCSP stapling improvement partially addressed bug 57131.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1681347 13f79535-47bb-0310-9956-ffa450edef68

Vote.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1681329 13f79535-47bb-0310-9956-ffa450edef68

warnings :(  but fix is already available from trunk :)

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1681322 13f79535-47bb-0310-9956-ffa450edef68

Merge r1679032, r1679192, and r1680276 from trunk:

r1679032:

mod_ssl OCSP Stapling: Don't block initial handshakes while refreshing
the OCSP response for a different certificate.  mod_ssl has an additional
global mutex, "ssl-stapling-refresh".

Not mentioned in CHANGES:

Stapling no longer uses a mutex when using a stapling cache
implementation which doesn't require it.  (A further, unrelated
code change to mod_ssl is required to allow the use of memcache
as a stapling cache, and I haven't tested with distcache; thus
it isn't clear if this helps in practice yet.)

r1679192:

Fix regression in check for cached response
(Essentially) Submitted by: ylavic

r1680276:

OCSP stapling: slight simplification to some internal interfaces,
add a few comments and sanity checks

Submitted by: trawick (with assist from ylavic)
Reviewed by: jim, jorton

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1681320 13f79535-47bb-0310-9956-ffa450edef68

Done.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1681312 13f79535-47bb-0310-9956-ffa450edef68

Merge r1420184 from trunk:

* modules/aaa/mod_authz_owner.h: Add header file with optional hook
  declaration for "authz_owner_get_file_group".

* modules/aaa/mod_authz_dbm.c, modules/aaa/mod_authz_groupfile.c: Use
  the header to pick up the above declaration; retrieve the optional
  function in a hook; use a static variable to store the function
  pointer.

Submitted by: jorton
Reviewed by: jkaluza, wrowe, jorton

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1681311 13f79535-47bb-0310-9956-ffa450edef68

Vote, promote.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1681309 13f79535-47bb-0310-9956-ffa450edef68

extremely slow response

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1681199 13f79535-47bb-0310-9956-ffa450edef68

minor tweaks for readability/grammar

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1681187 13f79535-47bb-0310-9956-ffa450edef68

Phases were correct, ignore me.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1681144 13f79535-47bb-0310-9956-ffa450edef68

jkaluza - need to move _retrieve calls from register to init/pre-config phase

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1681143 13f79535-47bb-0310-9956-ffa450edef68

Merge r1657881, r1665643 from trunk:

http: Make ap_die() robust against any HTTP error code and not modify
response status (finally logged) when nothing is to be done.

ap_die(): follow up to r1657881.

Use log level DEBUG for AP_FILTER_ERROR => HTTP_INTERNAL_SERVER_ERROR.
Submitted by: ylavic
Reviewed/backported by: jim

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1681114 13f79535-47bb-0310-9956-ffa450edef68

Merge r1666998 from trunk:

core: Cleanup the request soon/even if some output filter fails to
handle the EOR bucket.

Submitted by: ylavic
Reviewed/backported by: jim

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1681113 13f79535-47bb-0310-9956-ffa450edef68

promote

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1681112 13f79535-47bb-0310-9956-ffa450edef68

votes

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1681109 13f79535-47bb-0310-9956-ffa450edef68

Merge r1663647, r1679181, r1679182 from trunk:

* mod_authn_dbd: apr_pstrdup dbd_password and dbd_hash to fix use-after-free
bug with postgresql

mod_authn_dbd, mod_authz_dbd, mod_session_dbd, mod_rewrite: Fix lifetime
of DB lookup entries independently of the selected DB engine.  PR 46421.

Suggested by: Michel Stam <michel reverze net>
Proposed by: Steven whitson <steven.whitson gmail com>
Reviewed/Extended/Committed by: ylavic

Follup up to r1679181: CHANGES entry.
Submitted by: jkaluza, ylavic, ylavic
Reviewed/backported by: jim

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1681107 13f79535-47bb-0310-9956-ffa450edef68

Merge r1680895, r1680900, r1680942 from trunk:

mod_log_config: instead of using the new dedicated
pattern format "%M" for duration milliseconds,
overload the existing "%D" to choose the time precision
("%{s}D" for seconds, "%{ms}D" for milliseconds and
"%{us}D" for microseconds).

The existing %T and %D without precision are kept for
compatibility.

The previously introduced "%M" (r1677187) is removed,
it has not yet been released. Format pattern characters
are rare, so we should only use a new one if an
existing one isn't a good fit.

Fix syntax.

Follow-up to r1680895:

Let %T be the format character which accepts time resolution
arguments.

Submitted by: rjung, trawick
Reviewed/backported by: jim

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1681106 13f79535-47bb-0310-9956-ffa450edef68

Add backport revision.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1681038 13f79535-47bb-0310-9956-ffa450edef68

Be more precise.

Backport of r1681037 from trunk.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1681034 13f79535-47bb-0310-9956-ffa450edef68

Me too, me too, ...

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1681029 13f79535-47bb-0310-9956-ffa450edef68

Bumps.  Yes - this - a clean 2.2 proposal please, TIA

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1681011 13f79535-47bb-0310-9956-ffa450edef68

Concur with two proposals, drop any objection to yet a third proposal

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1681008 13f79535-47bb-0310-9956-ffa450edef68

Typo in comment

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1680998 13f79535-47bb-0310-9956-ffa450edef68

Vote.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1680949 13f79535-47bb-0310-9956-ffa450edef68

switch mod_log_config %{foo}D proposal to the %{foo}T update

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1680945 13f79535-47bb-0310-9956-ffa450edef68

Add a syntax fix for the docs.
Patch has been replaced in place, I guess noone
has yet reviewed it.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1680901 13f79535-47bb-0310-9956-ffa450edef68

Propose correction to new millisecond duration
feature in mod_log_config.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1680897 13f79535-47bb-0310-9956-ffa450edef68

Remove outdated block.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1680811 13f79535-47bb-0310-9956-ffa450edef68

propose

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1680287 13f79535-47bb-0310-9956-ffa450edef68

note release date

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1680262 13f79535-47bb-0310-9956-ffa450edef68

Vote and propose.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1680196 13f79535-47bb-0310-9956-ffa450edef68

Makes more sense to join these proposals and comments.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1680055 13f79535-47bb-0310-9956-ffa450edef68

Passes all tests, vote.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1680033 13f79535-47bb-0310-9956-ffa450edef68

Remove duplicated proposal.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1680006 13f79535-47bb-0310-9956-ffa450edef68

Vote.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1680004 13f79535-47bb-0310-9956-ffa450edef68

Question.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1680000 13f79535-47bb-0310-9956-ffa450edef68

Vote.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1679999 13f79535-47bb-0310-9956-ffa450edef68

Vote.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1679997 13f79535-47bb-0310-9956-ffa450edef68

Merge r1679620 from trunk:

revert r1675103 because it [at least] causes FallBackResource to kick
in before mod_autoindex might have kicked in.

Submitted by: covener
Reviewed/backported by: jim

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1679991 13f79535-47bb-0310-9956-ffa450edef68

Merge r1679470 from trunk:

mod_ssl: follow up to r1527291.
Always prepend "!aNULL:!eNULL:" to SSL_DEFAULT_CIPHER_LIST (default for
SSL[Proxy]CipherSuite) since we support OpenSSL versions where this was
not yet included by default.

Submitted by: ylavic
Reviewed/backported by: jim

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1679989 13f79535-47bb-0310-9956-ffa450edef68

Merge r1679428, r1679432 from trunk:

Conform to RFC 7525, with additional suggestion to drop RSA Kx ciphers

Document RFC 7525 changes
Submitted by: wrowe
Reviewed/backported by: jim

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1679987 13f79535-47bb-0310-9956-ffa450edef68

promote

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1679985 13f79535-47bb-0310-9956-ffa450edef68

votes

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1679984 13f79535-47bb-0310-9956-ffa450edef68

Rebuild.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1679874 13f79535-47bb-0310-9956-ffa450edef68

XML updates.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1679873 13f79535-47bb-0310-9956-ffa450edef68

SO_REUSEPORT with (part of) wrowe's concerns.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1679718 13f79535-47bb-0310-9956-ffa450edef68

vote on reverting FallbackResource patch.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1679639 13f79535-47bb-0310-9956-ffa450edef68

be normal

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1679628 13f79535-47bb-0310-9956-ffa450edef68

pull out half-baked fallbackresource patch

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1679622 13f79535-47bb-0310-9956-ffa450edef68

fix bld, still SSL_LIBRARY_NAME in this branch.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1679617 13f79535-47bb-0310-9956-ffa450edef68

Redundancy here is not a bad thing

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1679591 13f79535-47bb-0310-9956-ffa450edef68

Propose.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1679472 13f79535-47bb-0310-9956-ffa450edef68

Propose

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1679434 13f79535-47bb-0310-9956-ffa450edef68

Raise minor objections, easily tweaked

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1679412 13f79535-47bb-0310-9956-ffa450edef68

Merge r1674542, r1675410, r1676842 from trunk:

mod_ssl: Check for RAND_egd() at configure time and only use it if present.
Fixes the build with LibreSSL which does not provide this function.

Submitted by: Bernard Spil <pil.oss gmail com>, stsp
Committed by: stsp

mod_ssl: Make the config parser complain if SSLRandomSeed specifies
the Entropy Gathering Daemon (EGD) as source while the underlying
SSL library does not support EGD (e.g. in case of LibreSSL).

Suggested and reviewed by: kbrand

Follow up to r1674542 and r1675410: CHANGES entry.
Submitted by: stsp, ylavic
Reviewed/backported by: jim

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1679199 13f79535-47bb-0310-9956-ffa450edef68

change vote

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1679198 13f79535-47bb-0310-9956-ffa450edef68

Propose fix for PR 46421.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1679183 13f79535-47bb-0310-9956-ffa450edef68

Add CHANGES entries for backports r1677187 and r1678235 (like 2.2.30's).

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1678717 13f79535-47bb-0310-9956-ffa450edef68

Vote, promote.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1678642 13f79535-47bb-0310-9956-ffa450edef68

make docs

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1678601 13f79535-47bb-0310-9956-ffa450edef68

Rebuild.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1678582 13f79535-47bb-0310-9956-ffa450edef68

XML updates.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1678581 13f79535-47bb-0310-9956-ffa450edef68

xforms

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1678568 13f79535-47bb-0310-9956-ffa450edef68

sync note with trunk

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1678567 13f79535-47bb-0310-9956-ffa450edef68

Rebuild.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1678386 13f79535-47bb-0310-9956-ffa450edef68

XML updates.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1678385 13f79535-47bb-0310-9956-ffa450edef68

Rebuild

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1678375 13f79535-47bb-0310-9956-ffa450edef68

apply change from trunk

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1678373 13f79535-47bb-0310-9956-ffa450edef68

So far, looks OK. Revised patch applies cleanly and completely to 2.4 HEAD

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1678333 13f79535-47bb-0310-9956-ffa450edef68

Merge r1585609 from trunk:

Allow Require expr to work when the expression is quoted.

For example as appears in our documentation:
Require expr "%{TIME_HOUR} -ge 9 && %{TIME_HOUR} -le 17"

PR: 56235

Submitted by: breser
Reviewed/backported by: jim

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1678236 13f79535-47bb-0310-9956-ffa450edef68

Merge r1677462 from trunk:

mod_dav: Avoid doing the walk on a COPY source for handling preconditions if
there are no preconditions provided.

* modules/dav/main/util.c:
  (dav_validate_request): avoid validating locks and ETags when there are
    no If headers providing them on a resource we aren't modifying.

Submitted by: breser
Reviewed/backported by: jim

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1678235 13f79535-47bb-0310-9956-ffa450edef68

i ProxySCGIInternalRedirect with alternate response header

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1678234 13f79535-47bb-0310-9956-ffa450edef68

Merge r1676085 from trunk:

consistently output SSLCertificateChainFile deprecation warnings
Submitted by: kbrand
Reviewed/backported by: jim

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1678233 13f79535-47bb-0310-9956-ffa450edef68

Merge r1664133, r1643284, r1621417 from trunk:

* Fix typo in error message

mpm_event(opt): zero is immutable.

Fix printf format spotted by cppcheck.
Untested.
Submitted by: rpluem, ylavic, jailletc36
Reviewed/backported by: jim

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1678232 13f79535-47bb-0310-9956-ffa450edef68

Propose real HEAD responses with zero C-L fix.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1678228 13f79535-47bb-0310-9956-ffa450edef68

Vote hence promote.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1678191 13f79535-47bb-0310-9956-ffa450edef68

a few votes

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1678172 13f79535-47bb-0310-9956-ffa450edef68

easy vote

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1678161 13f79535-47bb-0310-9956-ffa450edef68

Easy proposals (synch with trunk)

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1678132 13f79535-47bb-0310-9956-ffa450edef68

* STATUS: Nominate r1677462

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1677466 13f79535-47bb-0310-9956-ffa450edef68