The Apache HTTP Server Project is an effort to develop and maintain an
open-source HTTP server for various modern desktop and server operating
systems, such as UNIX and Windows NT. The goal of this project is to
provide a secure, efficient and extensible server which provides HTTP
services in sync with the current HTTP standards.
The 2.x branch of Apache Web Server includes several improvements like
threading, use of APR, native IPv6 and SSL support, and many more.
===> The following configuration options are available for apache24-2.4.69:
ACCESS_COMPAT=on: mod_access compatibility
ACTIONS=on: Action triggering on requests
ALIAS=on: Mapping of requests to different filesystem parts
ALLOWMETHODS=on: Restrict allowed HTTP methods
ASIS=on: Sends files that contain their own HTTP headers
AUTHNZ_FCGI=on: FastCGI authorizer-based authentication and authorization
AUTHNZ_LDAP=off: LDAP based authentication
AUTHN_ANON=on: Anonymous user authentication control
AUTHN_CORE=on: Core authentication module
AUTHN_DBD=on: SQL-based authentication control
AUTHN_DBM=on: DBM-based authentication control
AUTHN_FILE=on: File-based authentication control
AUTHN_SOCACHE=on: Cached authentication control
AUTHZ_CORE=on: Core authorization provider vector module
AUTHZ_DBD=on: SQL based authorization and Login/Session support
AUTHZ_DBM=on: DBM-based authorization control
AUTHZ_GROUPFILE=on: "require group" authorization control
AUTHZ_HOST=on: Host-based authorization control
AUTHZ_OWNER=on: "require file-owner" authorization control
AUTHZ_USER=on: "require user" authorization control
AUTH_BASIC=on: Basic authentication
AUTH_DIGEST=on: RFC2617 Digest authentication
AUTH_FORM=on: Form authentication
AUTOINDEX=on: Directory listing
BROTLI=on: Brotli compression support
BUFFER=on: Filter Buffering
CACHE=on: Dynamic file caching
CACHE_DISK=on: Disk caching module
CACHE_SOCACHE=on: Shared object cacheing module
CERN_META=on: CERN-type meta files
CGI=on: CGI scripts (non-threaded MPMs)
CGID=on: CGI scripts (threaded MPMs)
CHARSET_LITE=on: Character set translation. Enabled by default only on EBCDIC systems
DATA=on: RFC2397 data encoder
DAV=on: WebDAV protocol handling. --enable-dav also enables mod_dav_fs
DAV_FS=on: DAV provider for the filesystem. --enable-dav also enables mod_dav_fs
DAV_LOCK=on: DAV provider for generic locking
DBD=on: Apache DBD Framework
DEFLATE=on: Deflate transfer encoding support
DIALUP=on: Rate limits static files to dialup modem speeds
DIR=on: Directory request handling
DOCS=on: Build and/or install documentation
DUMPIO=on: I/O dump filter
ENV=on: Clearing/setting of ENV vars
EXPIRES=on: Expires header control
EXT_FILTER=on: External filter module
FILE_CACHE=on: File cache
FILTER=on: Smart Filtering
GDBM=on: GNU dbm library support
HEADERS=on: HTTP header control
HEARTBEAT=on: Generates Heartbeats
HEARTMONITOR=on: Collects Heartbeats
HTTP2=on: HTTP/2 (RFC 7540) support
IDENT=off: RFC 1413 ident lookups
IMAGEMAP=on: Server-side imagemaps
INCLUDE=on: Server-side includes
INFO=on: Server information
IPV4_MAPPED=off: Allow IPv6 sockets to handle IPv4 connections
LBMETHOD_BYBUSYNESS=on: Apache proxy Load balancing by busyness
LBMETHOD_BYREQUESTS=on: Apache proxy Load balancing by request counting
LBMETHOD_BYTRAFFIC=on: Apache proxy Load balancing by traffic counting
LBMETHOD_HEARTBEAT=on: Apache proxy Load balancing from Heartbeats
LDAP=off: LDAP caching and connection pooling services
LOGIO=on: Input and output logging
LOG_DEBUG=on: Configurable debug logging
LOG_FORENSIC=on: Forensic logging
LUA=off: Apache Lua Framework
LUAJIT=off: LuaJit Support
MACRO=on: Define and use macros in configuration files
MD=on: Managing domains across virtual hosts, certificate provisioning via the ACME protocol
MIME=on: Mapp file-ext. to MIME (recommended)
MIME_MAGIC=on: Automagically determining MIME type
NEGOTIATION=on: Content negotiation
PROXY=on: Build enabled PROXY modules
RATELIMIT=on: Output Bandwidth Limiting
REFLECTOR=on: Reflect request through the output filter stack
REMOTEIP=on: Translate header contents to an apparent client remote_ip
REQTIMEOUT=on: Limit time waiting for request from client
REQUEST=on: Request Body Filtering
REWRITE=on: Rule based URL manipulation
SED=on: Filter request and/or response bodies through sed
SESSION=on: Build enabled SESSION modules
SETENVIF=on: Modify ENV vars based on characteristics of the request
SLOTMEM_PLAIN=on: Slotmem provider that uses plain memory
SLOTMEM_SHM=on: Slotmem provider that uses shared memory
SOCACHE_DBM=on: dbm small object cache provider
SOCACHE_DC=off: distcache small object cache provider
SOCACHE_MEMCACHE=on: memcache small object cache provider
SOCACHE_REDIS=off: Redis based shared object cache provider
SOCACHE_SHMCB=on: shmcb small object cache provider
SPELING=on: Correct common URL misspellings
SSL=on: SSL/TLS support (mod_ssl)
STATUS=on: Process/thread monitoring
SUBSTITUTE=on: Response content rewrite-like filtering
SUEXEC=off: Set uid and gid for spawned processes
SUEXEC_SYSLOG=off: Enable syslog for suexec
UNIQUE_ID=on: Per-request unique ids
USERDIR=on: Mapping of requests to user-specific directories
USERTRACK=on: User-session tracking
VERSION=on: Determining httpd version in config files
VHOST_ALIAS=on: Mass virtual hosting
WATCHDOG=on: Watchdog module
XML2ENC=on: i18n support for markup filters
====> Build enabled PROXY modules: you have to choose at least one of them
PROXY_AJP=on: AJP support module for mod_proxy
PROXY_BALANCER=on: mod_proxy extension for load balancing
PROXY_CONNECT=on: mod_proxy extension for CONNECT request handling
PROXY_EXPRESS=on: Dynamic mass reverse proxy extension for mod_proxy
PROXY_FCGI=on: FastCGI support module for mod_proxy
PROXY_HTTP2=on: HTTP/2 support module for h2 and h2c
PROXY_FDPASS=on: fdpass external process support module for mod_proxy
PROXY_FTP=on: FTP support module for mod_proxy
PROXY_HCHECK=on: Dynamic health check of Balancer members (workers) for mod_proxy
PROXY_HTML=on: Fix HTML Links in a Reverse Proxy
PROXY_HTTP=on: HTTP support module for mod_proxy
PROXY_SCGI=on: SCGI gateway module for mod_proxy
PROXY_UWSGI=on: UWSGI gateway module for mod_proxy
PROXY_WSTUNNEL=on: Websockets Tunnel module for mod_proxy
====> Build enabled SESSION modules: you have to choose at least one of them
SESSION_COOKIE=on: Session cookie module
SESSION_CRYPTO=on: Session crypto module
SESSION_DBD=on: Session dbd module
====> Example and devel modules (do not use in prod)
BUCKETEER=off: (dev) buckets manipulation filter
CASE_FILTER=off: (dev) example uppercase conversion filter
CASE_FILTER_IN=off: (dev) example uppercase conversion input filter
ECHO=off: (dev) example echo server
EXAMPLE_HOOKS=off: (dev) example hook callback handler module
EXAMPLE_IPC=off: (dev) example of shared memory and mutex usage
OPTIONAL_FN_EXPORT=off: (dev) example optional function exporter
OPTIONAL_FN_IMPORT=off: (dev) example optional function importer
OPTIONAL_HOOK_EXPORT=off: (dev) example optional hook exporter
OPTIONAL_HOOK_IMPORT=off: (dev) example optional hook importer
====> The default MPM module: you have to select exactly one of them
MPM_PREFORK=on: non-threaded, pre-forking web server
MPM_WORKER=off: hybrid multi-threaded multi-process web server
MPM_EVENT=off: MPM worker variant with the goal of consuming threads only for connections with active processing
====> all MPMs as loadable module: you can only select none or one of them
MPM_SHARED=on: all MPMs as loadable module
===> Use 'make config' to modify these settings
To run apache www server from startup, add apache24_enable="yes"
in your /etc/rc.conf. Extra options can be found in startup script.
Your hostname must be resolvable using at least 1 mechanism in
/etc/nsswitch.conf typically DNS or /etc/hosts or apache might
have issues starting depending on the modules you are using.
- apache24 default build changed from static MPM to modular MPM
- more modules are now enabled per default in the port
- icons and error pages moved from WWWDIR to DATADIR
If built with modular MPM and no MPM is activated in
httpd.conf, then mpm_prefork will be activated as default
MPM in etc/apache24/modules.d to keep compatibility with
existing php/perl/python modules!
Please compare the existing httpd.conf with httpd.conf.sample
and merge missing modules/instructions into httpd.conf!
If upgrading
The default database format was changed from BerkeleyDB 5
(deprecated) from ports to BerkeleyDB 1 from base libc.
You must rebuild all your (RewriteMap) databases once after
upgrading from 2.4.62 to 2.4.62_1 or later.
Reason:
Apache 2.4.63 removed the (experimental, non-default) mod_tls module due
to rustls-ffi API instability and it was moved to a standalone module.
Users of the TLS option can use the new www/mod_tls port as a replacement.
# pkg install ap24-mod_tls
Reason:
BREAKING CHANGE: In postgres_exporter 0.16.0 and later, the log message format
has changed. From the upstream release notes:
The logging system has been replaced with log/slog from the stdlib. This
change is being made across the prometheus ecosystem. The logging output has
changed, but the messages and levels remain the same. The ts label for the
timestamp has been replaced with time, the accuracy is less, and the timezone
is not forced to UTC. The caller field has been replaced by the source field,
which now includes the full path to the source file. The level field now
exposes the log level in capital letters.
20241110
The default BerkeleyDB provider for apr-util was changed from BerkeleyDB
5 (deprecated) to BerkeleyDB 1 from base libc. The change of version
results in a non-compatible database format.
After upgrading, you must rebuild all BerkeleyDB databases used by
apr-util (example: Apache databases created with `httxt2dbm -F db`
www/apache24: Add GDBM option
This adds a GDBM option which defaults to on and makes the libgdm
dependency conditional on that option.
Clean up removed TLS module
PR: 291447
Differential Revision: https://reviews.freebsd.org/D56843
MFH: 2026Q2
www/apache24: make the start script service jails ready
The setup I've chosen is to allow ipv4/ipv6 access. It does not allow
to use sysv IPC in a jail. If you want to use this possibility, the
config would need to be changed to "net_basic sysvipc" instead.
More advanced use cases may need different service jail options.
The config can be overridden in rc.conf.
See also:
https://docs.freebsd.org/en/books/handbook/jails/#service-jailshttps://docs.freebsd.org/en/articles/rc-scripting/#rcng-service-jails
Some notes:
- There are special apache24_limits_* stuff which is different from
the name_limits stuff as part of the rc framework.
(Only the first 15 lines of the commit message are shown above )
lang/luajit: update to v2.1
Disconnect lang/luajit-devel from the build, will be removed soon.
Bump PORTREVISIONs for the consumers.
Discussed with: adamw
PR: 225342
www/apache24: Allow overriding USERS and GROUPS via make.conf
It is a welcome addition for those building their own apache24 package
with custom UID/GID.
PR: 284194
Sponsored by: Klara, Inc.
Approved By: 0mp (mentor)
Approved By: maintainer timeout
Differential Revision: https://reviews.freebsd.org/D48522
www/apache24: Update to 2.4.63
* This removes the experimental mod_tls module,
use www/mod_tls instead.
Differential Revision: https://reviews.freebsd.org/D48514
www/apache24: htcacheclean rc.d script appears too early in rcorder
Because htcacheclean has no dependencies set, it runs before the
file system is ready, even though it makes changes to the file system.
Define FILESYSTEMS as requirement to fix this race condition.
PR: 268216
Approved by: portmgr (maintainer timeout, 5+ months)
www/apache24: Update to 2.4.56
Changes with Apache 2.4.56
*) SECURITY: CVE-2023-27522: Apache HTTP Server: mod_proxy_uwsgi
HTTP response splitting (cve.mitre.org)
HTTP Response Smuggling vulnerability in Apache HTTP Server via
mod_proxy_uwsgi. This issue affects Apache HTTP Server: from
2.4.30 through 2.4.55.
Special characters in the origin response header can
truncate/split the response forwarded to the client.
Credits: Dimas Fariski Setyawan Putra (nyxsorcerer)
*) SECURITY: CVE-2023-25690: HTTP request splitting with
mod_rewrite and mod_proxy (cve.mitre.org)
(Only the first 15 lines of the commit message are shown above )
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
(Only the first 15 lines of the commit message are shown above )
textproc/libxml2: bump all LIB_DEPENDS consumers
This is a separate commit to facilitate easier cherry-picking for
quarterly.
PR: 262853, 262940, 262877, 263126
Approved by: fluffy (mentor)
Fix CONFLICTS entries of multiple ports
There have been lots of missing CONFLICTS_INSTALL entries, either
because conflicting ports were added without updating existing ports,
due to name changes of generated packages, due to mis-understanding
the format and semantics of the conflicts entries, or just due to
typoes in package names.
This patch is the result of a comparison of all files contained in
the official packages with each other. This comparison was based on
packages built with default options and may therefore have missed
further conflicts with optionally installed files.
Where possible, version numbers in conflicts entries have been
generalized, some times taking advantage of the fact that a port
(Only the first 15 lines of the commit message are shown above )
Bump PORTREVISION for ports depending on the canonical version of GCC
as defined in Mk/bsd.default-versions.mk which has moved from GCC 8.3
to GCC 9.1 under most circumstances now after revision 507371.
This includes ports
- with USE_GCC=yes or USE_GCC=any,
- with USES=fortran,
- using Mk/bsd.octave.mk which in turn features USES=fortran, and
- with USES=compiler specifying openmp, nestedfct, c11, c++0x, c++11-lang,
c++11-lib, c++14-lang, c++17-lang, or gcc-c++11-lib
plus, everything INDEX-11 shows with a dependency on lang/gcc9 now.
PR: 238330
Update to 2.4.38
Changelog:
*) SECURITY: CVE-2018-17199 (cve.mitre.org)
mod_session: mod_session_cookie does not respect expiry time allowing
sessions to be reused. [Hank Ibell]
*) SECURITY: CVE-2018-17189 (cve.mitre.org)
mod_http2: fixes a DoS attack vector. By sending slow request bodies
to resources not consuming them, httpd cleanup code occupies a server
thread unnecessarily. This was changed to an immediate stream reset
which discards all stream state and incoming data. [Stefan Eissing]
*) SECURITY: CVE-2019-0190 (cve.mitre.org)
mod_ssl: Fix infinite loop triggered by a client-initiated
(Only the first 15 lines of the commit message are shown above )
Remove compatibility code for FreeBSD < 11.2 from all ports.
Simplify some ports where DragonFlyBSD no longer needs to be special-cased.
Submitted by: rene
Reviewed by: bapt, jbeich
Differential Revision: https://reviews.freebsd.org/D17724
www/apache24: Update to 2.4.35
Changelog:
*) http: Enforce consistently no response body with both 204 and 304
statuses. [Yann Ylavic]
*) mod_status: Cumulate CPU time of exited child processes in the
"cu" and "cs" values. Add CPU time of the parent process to the
"c" and "s" values.
[Rainer Jung]
*) mod_proxy: Improve the balancer member data shown in mod_status when
"ProxyStatus" is "On": add "busy" count and show byte counts in
auto mode always in units of kilobytes. [Rainer Jung]
(Only the first 15 lines of the commit message are shown above )
www/apache24: Fix runtime failure with LibreSSL 2.7
- Fix LOG_FORENSIC in plist while here
PR: 227868
Reported by: Jens K. Loewe <mozilla tuxproject de>
Approved by: hat (apache@)
devel/apr1: Fix runtime issues of dependent port
- iconv is in base in all supported FreeBSD versions
- Fix build with MariaDB 10.2 [2]
- Bump portrevision in dependencies
PR: 226705 [1], 226026 [2]
With hat: apache
Approved by: joneum (apache)
- fix third party module build e.g. mod_mpm_itk by removing -Werror from
configure.in
- bump PORTREVISON (fix changes config_vars.mk that is used to build third party
modules)
PR: 215594
Submitted by: Marcelo Araujo
MFH: 2016Q4
Sponsored by: iXsystems
o update to 2.4.23
o disable build time stamp in favor of reproducible build
o remove obsolate scoreboard/status patch
o s/USE_OPENSSL=yes/USES=ssl/
o add OPTION for two new modules:
mod_proxy_hcheck (default=on)
mod_http2_proxy (experimental => default=off)
Changelog:
http://www.apache.org/dist/httpd/CHANGES_2.4.23
MFH: 2016Q3
- update to 2.4.20
- use ${OPTION}_IMPLIES and remove some IGNORES
- turn on proxy_html and xml2enc as default [1]
[1] Often requested by users. The modules are not enabled in
the default configuration.
Full changelog for apache version 2.4.19/2.4.20:
http://www.apache.org/dist/httpd/CHANGES_2.4.20
Note: Apache httpd 2.4.19 was not released.
MFH: 2016Q2
- update to 2.4.18
- backport r1719967
mod_ssl: fix build with openssl < 0.9.8m (missing semicolon).
This release also contains the patch for FreeBSD PR 204304
Make the fix for fully qualifying REDIRECT_URL from PR#57785 opt-in.
http://svn.apache.org/viewvc?view=revision&revision=1712268
Changes with Apache 2.4.18
*) mod_ssl: for all ssl_engine_vars.c lookups, fall back to master connection
if conn_rec itself holds no valid SSLConnRec*. Fixes PR58666.
[Stefan Eissing]
*) mod_http2: connection level window for flow control is set to protocol
(Only the first 15 lines of the commit message are shown above )
- update to 2.4.17
- add support for HTTP/2 (RFC 7540)
- remove obsolate libressl patches [1]
In this release are some exciting new features including:
*) HTTP/2 support via mod_http2 module
*) Support for SO_REUSEPORT in MPMs for significant scalability
Changes with Apache 2.4.17
*) mod_http2: added donated HTTP/2 implementation via core module. Similar
configuration options to mod_ssl. [Stefan Eissing]
*) mod_proxy: don't recyle backend announced "Connection: close" connections
(Only the first 15 lines of the commit message are shown above )
Remove UNIQUENAME and LATEST_LINK.
UNIQUENAME was never unique, it was only used by USE_LDCONFIG and now,
we won't have conflicts there.
Use PKGBASE instead of LATEST_LINK in PKGLATESTFILE, the *only* consumer
is pkg-devel, and it works just fine without LATEST_LINK as pkg-devel
has the correct PKGNAME anyway.
Now that UNIQUENAME is gone, OPTIONSFILE is too. (it's been called
OPTIONS_FILE now.)
Reviewed by: antoine, bapt
Exp-run by: antoine
Sponsored by: Absolight
Differential Revision: https://reviews.freebsd.org/D3336
By default libtool replaces -export-symbols <file> with -retain-symbols-file
<file> on ELF systems, but this doesn't really do what -export-symbols is
meant to do. On GNU ELF systems it converts <file> to a simple version
script first and then uses -version-script instead of -retain-symbols-file.
Let USES=libtool patch libtool scripts to do this on all systems with GNU
ld(1).
Bump PORTREVISION on all ports where the build log contains -export-symbols.
audio/calf: This port builds a module that now exports only one function,
but it also builds a number of executables that link to this module and
expect to see other functions. Because it's already a bit dodgy to link to
a module (libtool warns about this) let the module continue to export only
one function and instead build an ordinary library from the same source that
the executables can link to. Fix a number of other issues in the same
(Only the first 15 lines of the commit message are shown above )
MASTER_SITES cleanup.
- Replace ${MASTER_SITE_FOO} with FOO.
- Merge MASTER_SITE_SUBDIR into MASTER_SITES when possible. (This means 99.9%
of the time.)
- Remove occurrences of MASTER_SITE_LOCAL when no subdirectory was present and
no hint of what it should be was present.
- Fix some logic.
- And generally, make things more simple and easy to understand.
While there, add magic values to the FESTIVAL, GENTOO, GIMP, GNUPG, QT and
SAMBA macros.
Also, replace some EXTRACT_SUFX occurences with USES=tar:*.
Checked by: make fetch-urlall-list
With hat: portmgr
Sponsored by: Absolight
- update to 2.4.12
- change MPM backend from static to dynamic,
but keep mpm_prefork for compatiblity with e.g. php modules
- install dedicated MPM load file in case httpd was build with modular MPM
(modules.d/000_mpm_prefork_fallback.conf)
- disable SSLv3 and SSLv2 fallback in sample httpd-ssl-conf
- use @sample macro instead EXAMPLESDIR
- add some SSLCipherSuite examples for OpenSSL >= 1.0.x
- add libressl support [1]
- add pkg-install script (to handle new modular MPM build)
- build now most all modules, so users using packages don't have
to run a custom build for missing modules
- fix suexec mode
PR: 196139 [1]
MFH: 2015Q1
