Done with 2.2.15, prepared to tag

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@917879 13f79535-47bb-0310-9956-ffa450edef68

SECURITY: CVE-2010-0408 (cve.mitre.org)

mod_proxy_ajp: Respond with HTTP_BAD_REQUEST when the body is not sent after
request headers indicate a request body is incoming; this is not a case of
HTTP_INTERNAL_SERVER_ERROR.

Submitted by: Niku Toivola <niku.toivola sulake.com>
Reviewed by: rpluem, jim, wrowe
Backports: r917875

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@917876 13f79535-47bb-0310-9956-ffa450edef68

SECURITY: CVE-2010-0425 (cve.mitre.org)

mod_isapi: Do not unload an isapi .dll module until the request
processing is completed, avoiding orphaned callback pointers.

Submitted by: Brett Gervasoni <brettg senseofsecurity.com>, trawick
Reviewed by: trawick, wrowe
Backports: r917870

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@917871 13f79535-47bb-0310-9956-ffa450edef68

Ensure each subrequest has a shallow copy of headers_in so that the
parent request headers are not corrupted.  Eliminates a problematic
optimization in the case of no request body.

Mitre: CVE-2010-0434
PR: 48359
Submitted by: Jake Scott, wrowe, rpluem
Backports: server/protocol.c r901578
Reviewed by: minfrin

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@917867 13f79535-47bb-0310-9956-ffa450edef68

Update proposal.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@917760 13f79535-47bb-0310-9956-ffa450edef68

Update proposal.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@917743 13f79535-47bb-0310-9956-ffa450edef68

* modules/ssl/ssl_engine_io.c: Restore code removed by
mistake in mis-merged r917343.

Reviewed by: jorton, trawick, wrowe

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@917726 13f79535-47bb-0310-9956-ffa450edef68

* Vote

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@917672 13f79535-47bb-0310-9956-ffa450edef68

Fix trivial doc flaw, this file is not name http_protocol.c

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@917617 13f79535-47bb-0310-9956-ffa450edef68

Backport http://svn.apache.org/viewvc?view=revision&revision=892260
ignored the subsequent data type correction of the patch on trunk.

Rather than veto, simply correct this allocation to eliminate a data
type mismatch/truncation of the results of apr_atoi64(), quieting the
only warnings of a win32 build of 2.2 branch.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@917613 13f79535-47bb-0310-9956-ffa450edef68

Rev the patch to address rpluem's observations.  Preserved old patch
for referrence in p.a.o/~wrowe/ space.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@917593 13f79535-47bb-0310-9956-ffa450edef68

* Comment

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@917492 13f79535-47bb-0310-9956-ffa450edef68

Comment.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@917462 13f79535-47bb-0310-9956-ffa450edef68

* Add a comment and conditional vote.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@917451 13f79535-47bb-0310-9956-ffa450edef68

* Add module names affected by the changes where missing.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@917448 13f79535-47bb-0310-9956-ffa450edef68

* This was already backported in r917343

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@917444 13f79535-47bb-0310-9956-ffa450edef68

Vote.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@917346 13f79535-47bb-0310-9956-ffa450edef68

mod_ssl: Fix potential SSL I/O filter hang if a long list of
trusted CAs is configured for client cert auth.  PR 46952
+1: jorton, wrowe [from review of svn patch], minfrin

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@917343 13f79535-47bb-0310-9956-ffa450edef68

Vote and promote.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@917342 13f79535-47bb-0310-9956-ffa450edef68

p.a.o is back, update STATUS and reinstate sf's vote on his request.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@917336 13f79535-47bb-0310-9956-ffa450edef68

update for sync with English docs.

Translated by: Nilgün Belma Bugüner <nilgun belgeler.org>
Reviewed by:  Orhan Berent <berent belgeler.org>

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@917264 13f79535-47bb-0310-9956-ffa450edef68

looking good

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@917256 13f79535-47bb-0310-9956-ffa450edef68

Asked, answered, and no reply in >1 month; this veto is no longer valid.

Votes based on the current discussion within PR 48359 are absolutely welcome,
positive or negative.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@917246 13f79535-47bb-0310-9956-ffa450edef68

Update transformation.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@917245 13f79535-47bb-0310-9956-ffa450edef68

Revert premature commit 917234

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@917244 13f79535-47bb-0310-9956-ffa450edef68

Backport r917235: Correct referenced OpenSSL
version now that 0.9.8m was released.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@917236 13f79535-47bb-0310-9956-ffa450edef68

This is an information revealing flaw under worker MPM.  discuss

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@917234 13f79535-47bb-0310-9956-ffa450edef68

Update transformations.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@917232 13f79535-47bb-0310-9956-ffa450edef68

Add LastChangedRevision svn property to new docs file.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@917230 13f79535-47bb-0310-9956-ffa450edef68

Fix the version number of the SSLInsecureRenegotiation directive to
correctly reflect the fact it was backported.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@917229 13f79535-47bb-0310-9956-ffa450edef68

Update transformations

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@917216 13f79535-47bb-0310-9956-ffa450edef68

Backport mod_reqtimeout from trunk.

Reviewed by: sf, jorton, rjung

To take trawick's comment into account, I have changed enabled=yes into
enabled=most.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@917211 13f79535-47bb-0310-9956-ffa450edef68

Vote.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@917199 13f79535-47bb-0310-9956-ffa450edef68

Fix indentation

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@917181 13f79535-47bb-0310-9956-ffa450edef68

retract vote

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@917179 13f79535-47bb-0310-9956-ffa450edef68

Backport r808723, which was applied to trunk but not added to the backport
proposal below. Fixes a compiler warning on v2.2 reported by Rainer Jung.
mod_cache: Introduce the thundering herd lock, a mechanism to keep
the flood of requests at bay that strike a backend webserver as
a cached entity goes stale.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@917177 13f79535-47bb-0310-9956-ffa450edef68

Update proposal for mod_reqtimeout Windows build

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@917153 13f79535-47bb-0310-9956-ffa450edef68

Update transformations.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@917047 13f79535-47bb-0310-9956-ffa450edef68

Backport:
mod_ssl: Add SSLInsecureRenegotiation directive.
+1: jorton, trawick, minfrin

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@917044 13f79535-47bb-0310-9956-ffa450edef68

Add comment.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@917042 13f79535-47bb-0310-9956-ffa450edef68

Backport:
mod_proxy_ajp: Really regard the operation a success, when the client
aborted the connection. In addition adjust the log message if the client
aborted the connection.
+1: rpluem, sf, minfrin

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@917038 13f79535-47bb-0310-9956-ffa450edef68

Vote and promote.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@917035 13f79535-47bb-0310-9956-ffa450edef68

Vote and promote.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@917032 13f79535-47bb-0310-9956-ffa450edef68

Update proposal.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@917023 13f79535-47bb-0310-9956-ffa450edef68

This had already been backported in r792910.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@917022 13f79535-47bb-0310-9956-ffa450edef68

mod_negotiation: Do not lose query string after content negotiation
+1: rpluem, jorton, trawick

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@917017 13f79535-47bb-0310-9956-ffa450edef68

Add a comment.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@917016 13f79535-47bb-0310-9956-ffa450edef68

mod_cache: Introduce the thundering herd lock, a mechanism to keep
the flood of requests at bay that strike a backend webserver as
a cached entity goes stale.
+1: minfrin, jim, pgollucci

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@917013 13f79535-47bb-0310-9956-ffa450edef68

Backport:
mod_proxy_http: Make sure that when an ErrorDocument is served
from a reverse proxied URL, that the subrequest respects the status
of the original request. This brings the behaviour of proxy_handler
in line with default_handler.
PR: https://issues.apache.org/bugzilla/show_bug.cgi?id=47106
+1: minfrin, jim, rpluem

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@917010 13f79535-47bb-0310-9956-ffa450edef68

Backport:
mod_log_config: Add the R option to log the handler used within the
request.
Submitted by: Christian Folini <christian.folini netnea com>
+1: minfrin, jim, rpluem

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@917009 13f79535-47bb-0310-9956-ffa450edef68

Backport:
mod_include: Allow fine control over the removal of Last-Modified and ETag
headers within the INCLUDES filter, making it possible to cache responses if
desired. Fix the default value of the SSIAccessEnable directive.
+1: minfrin, jim, rpluem

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@917008 13f79535-47bb-0310-9956-ffa450edef68

Add a backport of the Windows build support to the mod_reqtimeout proposal.
Thanks, Jeff.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@916932 13f79535-47bb-0310-9956-ffa450edef68

+1 for renegotiation flag patch

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@916842 13f79535-47bb-0310-9956-ffa450edef68

New patch with revised error string.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@916818 13f79535-47bb-0310-9956-ffa450edef68

note,vote,promote

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@916790 13f79535-47bb-0310-9956-ffa450edef68

Propose another mod_ssl fix.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@916763 13f79535-47bb-0310-9956-ffa450edef68

Votes.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@916758 13f79535-47bb-0310-9956-ffa450edef68

Add backport of SSLInsecureReneg and friends.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@916753 13f79535-47bb-0310-9956-ffa450edef68

Describe the PR 45875 fix properly.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@916657 13f79535-47bb-0310-9956-ffa450edef68

vote

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@916633 13f79535-47bb-0310-9956-ffa450edef68

vote

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@916630 13f79535-47bb-0310-9956-ffa450edef68

* Add proposal

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@916628 13f79535-47bb-0310-9956-ffa450edef68

Backport r821477 from trunk:

    Make sure to not destroy bucket brigades that have been created by earlier
    filters. Otherwise the pool cleanups would be removed causing potential
    memory leaks later on.

Submitted by: Stefan Fritsch
Reviewed by: sf, rpluem, pgollucci

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@916627 13f79535-47bb-0310-9956-ffa450edef68

update transformation

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@916480 13f79535-47bb-0310-9956-ffa450edef68

backport r881808 from trunk:

    Add AuthLDAPBindAuthoritative to allow other authentication providers a chance
    to run when mod_authnz_ldap finds a user but can't verify their password.

Submitted By: Justin Erenkrantz, Joe Schaefer, Tony Stevenson
Reviewed By: covener, pgollucci, rpluem

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@916091 13f79535-47bb-0310-9956-ffa450edef68

clarification on REQUEST_FILENAME vs per-vhost Rewrite directives.

backport of r914980 and partial backport r728399 (Bob Ionescu)

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@914981 13f79535-47bb-0310-9956-ffa450edef68

take 2, promote

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@912290 13f79535-47bb-0310-9956-ffa450edef68

well that was strange

revert r912288

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@912289 13f79535-47bb-0310-9956-ffa450edef68

Promote

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@912288 13f79535-47bb-0310-9956-ffa450edef68

Vote & add a proposal

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@912287 13f79535-47bb-0310-9956-ffa450edef68

* Add new proposal

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@912131 13f79535-47bb-0310-9956-ffa450edef68

* Promote

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@912130 13f79535-47bb-0310-9956-ffa450edef68

* Vote

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@912129 13f79535-47bb-0310-9956-ffa450edef68

* Promote

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@912124 13f79535-47bb-0310-9956-ffa450edef68

propose

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@911888 13f79535-47bb-0310-9956-ffa450edef68

Update proposal.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@910769 13f79535-47bb-0310-9956-ffa450edef68

Update the proposal.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@910737 13f79535-47bb-0310-9956-ffa450edef68

Propose.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@910708 13f79535-47bb-0310-9956-ffa450edef68

Update transformations.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@910449 13f79535-47bb-0310-9956-ffa450edef68

mod_proxy, mod_proxy_http: Support remote https proxies
by using HTTP CONNECT.
PR 19188.  [Philippe Dutrueux <lilas evidian.com>, Rainer Jung]
Backport of r909323, r910079, r910081, r910124

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@910322 13f79535-47bb-0310-9956-ffa450edef68

  *) worker: Don't report server has reached MaxClients until it has.
       Add message when server gets within MinSpareThreads of MaxClients.
            PR 46996.  [Dan Poirier]

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@910320 13f79535-47bb-0310-9956-ffa450edef68

* mod_ssl: Improve environment variable extraction to be more
  efficient and to correctly handle DNs with duplicate tags.
  PR 45875.
  Trunk Patch: http://svn.apache.org/viewvc?view=rev&revision=724717
               http://svn.apache.org/viewvc?view=rev&revision=813165
               http://svn.apache.org/viewvc?view=rev&revision=820401
  2.2.x Patch: http://people.apache.org/~minfrin/ssl-env2.diff
  +1: minfrin, fuankg, jim

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@910319 13f79535-47bb-0310-9956-ffa450edef68

upgrade

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@910259 13f79535-47bb-0310-9956-ffa450edef68

cast votes

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@910258 13f79535-47bb-0310-9956-ffa450edef68

Update backport proposal: add later bg fixes.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@910138 13f79535-47bb-0310-9956-ffa450edef68

AuthLDAPBindAuthoritative backport developed conflicts, resolve and supply patches

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@910063 13f79535-47bb-0310-9956-ffa450edef68

Propose.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@909901 13f79535-47bb-0310-9956-ffa450edef68

Comment, vote.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@909892 13f79535-47bb-0310-9956-ffa450edef68

Propose.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@909879 13f79535-47bb-0310-9956-ffa450edef68

Add proposal.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@909377 13f79535-47bb-0310-9956-ffa450edef68

Propose backport: fix Maxclients warning

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@906563 13f79535-47bb-0310-9956-ffa450edef68

Propose.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@905421 13f79535-47bb-0310-9956-ffa450edef68

Propose.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@905414 13f79535-47bb-0310-9956-ffa450edef68

Provide pointer to discussion thread

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@903785 13f79535-47bb-0310-9956-ffa450edef68

Backport r902641: change log level of ldap authn failure message.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@903518 13f79535-47bb-0310-9956-ffa450edef68

Backport (trivial) r897570

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@903517 13f79535-47bb-0310-9956-ffa450edef68

Veto, promote

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@903514 13f79535-47bb-0310-9956-ffa450edef68

Now that we have a resolution working on www.a.o, time to backport

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@903513 13f79535-47bb-0310-9956-ffa450edef68

Update backport proposal to current trunk version

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@902997 13f79535-47bb-0310-9956-ffa450edef68

Query backport proposal; looks like a conditional +1
Oops, clashed with fuankg vote.  This is not an objection, just a query.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@902669 13f79535-47bb-0310-9956-ffa450edef68