[packages/lighttpd.git] / lighttpd-branch.diff

# Revision 2692
Index: src/base.h
===================================================================
--- src/base.h	(.../tags/lighttpd-1.4.24)
+++ src/base.h	(.../branches/lighttpd-1.4.x)
@@ -280,6 +280,7 @@
 	unsigned short ssl_verifyclient_enforce;
 	unsigned short ssl_verifyclient_depth;
 	buffer *ssl_verifyclient_username;
+	unsigned short ssl_verifyclient_export_cert;
 
 	unsigned short use_ipv6;
 	unsigned short defer_accept;
Index: src/mod_rewrite.c
===================================================================
--- src/mod_rewrite.c	(.../tags/lighttpd-1.4.24)
+++ src/mod_rewrite.c	(.../branches/lighttpd-1.4.x)
@@ -9,10 +9,9 @@
 #include <stdlib.h>
 #include <string.h>
 
-typedef struct {
 #ifdef HAVE_PCRE_H
+typedef struct {
 	pcre *key;
-#endif
 
 	buffer *value;
 
@@ -70,7 +69,6 @@
 }
 
 static int rewrite_rule_buffer_append(rewrite_rule_buffer *kvb, buffer *key, buffer *value, int once) {
-#ifdef HAVE_PCRE_H
 	size_t i;
 	const char *errptr;
 	int erroff;
@@ -109,18 +107,9 @@
 	kvb->used++;
 
 	return 0;
-#else
-	UNUSED(kvb);
-	UNUSED(value);
-	UNUSED(once);
-	UNUSED(key);
-
-	return -1;
-#endif
 }
 
 static void rewrite_rule_buffer_free(rewrite_rule_buffer *kvb) {
-#ifdef HAVE_PCRE_H
 	size_t i;
 
 	for (i = 0; i < kvb->size; i++) {
@@ -130,7 +119,6 @@
 	}
 
 	if (kvb->ptr) free(kvb->ptr);
-#endif
 
 	free(kvb);
 }
@@ -201,24 +189,29 @@
 							    ((data_string *)(da->value->data[j]))->key,
 							    ((data_string *)(da->value->data[j]))->value,
 							    once)) {
-#ifdef HAVE_PCRE_H
 				log_error_write(srv, __FILE__, __LINE__, "sb",
 						"pcre-compile failed for", da->value->data[j]->key);
-#else
-				log_error_write(srv, __FILE__, __LINE__, "s",
-						"pcre support is missing, please install libpcre and the headers");
-#endif
 			}
 		}
 	}
 
 	return 0;
 }
+#else
+static int parse_config_entry(server *srv, array *ca, const char *option) {
+	static int logged_message = 0;
+	if (logged_message) return 0;
+	if (NULL != array_get_element(ca, option)) {
+		logged_message = 1;
+		log_error_write(srv, __FILE__, __LINE__, "s",
+			"pcre support is missing, please install libpcre and the headers");
+	}
+	return 0;
+}
+#endif
 
 SETDEFAULTS_FUNC(mod_rewrite_set_defaults) {
-	plugin_data *p = p_d;
 	size_t i = 0;
-
 	config_values_t cv[] = {
 		{ "url.rewrite-repeat",        NULL, T_CONFIG_LOCAL, T_CONFIG_SCOPE_CONNECTION }, /* 0 */
 		{ "url.rewrite-once",          NULL, T_CONFIG_LOCAL, T_CONFIG_SCOPE_CONNECTION }, /* 1 */
@@ -243,33 +236,37 @@
 		{ NULL,                        NULL, T_CONFIG_UNSET, T_CONFIG_SCOPE_UNSET }
 	};
 
+#ifdef HAVE_PCRE_H
+	plugin_data *p = p_d;
+
 	if (!p) return HANDLER_ERROR;
 
 	/* 0 */
 	p->config_storage = calloc(1, srv->config_context->used * sizeof(specific_config *));
+#else
+	UNUSED(p_d);
+#endif
 
 	for (i = 0; i < srv->config_context->used; i++) {
-		plugin_config *s;
 		array *ca;
+#ifdef HAVE_PCRE_H
+		plugin_config *s;
 
 		s = calloc(1, sizeof(plugin_config));
 		s->rewrite = rewrite_rule_buffer_init();
 		s->rewrite_NF = rewrite_rule_buffer_init();
-
-		cv[0].destination = s->rewrite;
-		cv[1].destination = s->rewrite;
-		cv[2].destination = s->rewrite_NF;
-		cv[3].destination = s->rewrite_NF;
-		cv[4].destination = s->rewrite;
-		cv[5].destination = s->rewrite;
-
 		p->config_storage[i] = s;
+#endif
+
 		ca = ((data_config *)srv->config_context->data[i])->value;
 
 		if (0 != config_insert_values_global(srv, ca, cv)) {
 			return HANDLER_ERROR;
 		}
 
+#ifndef HAVE_PCRE_H
+# define parse_config_entry(srv, ca, x, option, y) parse_config_entry(srv, ca, option)
+#endif
 		parse_config_entry(srv, ca, s->rewrite, "url.rewrite-once",      1);
 		parse_config_entry(srv, ca, s->rewrite, "url.rewrite-final",     1);
 		parse_config_entry(srv, ca, s->rewrite_NF, "url.rewrite-if-not-file",   1);
@@ -280,7 +277,9 @@
 
 	return HANDLER_GO_ON;
 }
+
 #ifdef HAVE_PCRE_H
+
 #define PATCH(x) \
 	p->conf.x = s->x;
 static int mod_rewrite_patch_connection(server *srv, connection *con, plugin_data *p) {
@@ -330,7 +329,7 @@
 
 	return 0;
 }
-#endif
+
 URIHANDLER_FUNC(mod_rewrite_con_reset) {
 	plugin_data *p = p_d;
 
@@ -345,7 +344,6 @@
 }
 
 static int process_rewrite_rules(server *srv, connection *con, plugin_data *p, rewrite_rule_buffer *kvb) {
-#ifdef HAVE_PCRE_H
 	size_t i;
 	handler_ctx *hctx;
 
@@ -444,19 +442,11 @@
 		}
 #undef N
 	}
-#else
-	UNUSED(srv);
-	UNUSED(con);
-	UNUSED(p);
-	UNUSED(hctx);
-	UNUSED(kvb);
-#endif
 
 	return HANDLER_GO_ON;
 }
 
 URIHANDLER_FUNC(mod_rewrite_physical) {
-#ifdef HAVE_PCRE_H
 	plugin_data *p = p_d;
 	handler_t r;
 	stat_cache_entry *sce;
@@ -480,17 +470,11 @@
 	default:
 		return r;
 	}
-#else
-	UNUSED(srv);
-	UNUSED(con);
-	UNUSED(p_d);
-#endif
 
 	return HANDLER_GO_ON;
 }
 
 URIHANDLER_FUNC(mod_rewrite_uri_handler) {
-#ifdef HAVE_PCRE_H
 	plugin_data *p = p_d;
 
 	mod_rewrite_patch_connection(srv, con, p);
@@ -498,29 +482,27 @@
 	if (!p->conf.rewrite) return HANDLER_GO_ON;
 
 	return process_rewrite_rules(srv, con, p, p->conf.rewrite);
-#else
-	UNUSED(srv);
-	UNUSED(con);
-	UNUSED(p_d);
-#endif
 
 	return HANDLER_GO_ON;
 }
+#endif
 
 int mod_rewrite_plugin_init(plugin *p);
 int mod_rewrite_plugin_init(plugin *p) {
 	p->version     = LIGHTTPD_VERSION_ID;
 	p->name        = buffer_init_string("rewrite");
 
+#ifdef HAVE_PCRE_H
 	p->init        = mod_rewrite_init;
 	/* it has to stay _raw as we are matching on uri + querystring
 	 */
 
 	p->handle_uri_raw = mod_rewrite_uri_handler;
 	p->handle_physical = mod_rewrite_physical;
-	p->set_defaults = mod_rewrite_set_defaults;
 	p->cleanup     = mod_rewrite_free;
 	p->connection_reset = mod_rewrite_con_reset;
+#endif
+	p->set_defaults = mod_rewrite_set_defaults;
 
 	p->data        = NULL;
 
Index: src/connections.c
===================================================================
--- src/connections.c	(.../tags/lighttpd-1.4.24)
+++ src/connections.c	(.../branches/lighttpd-1.4.x)
@@ -807,6 +807,9 @@
 	CLEAN(authed_user);
 	CLEAN(server_name);
 	CLEAN(error_handler);
+#if defined USE_OPENSSL && ! defined OPENSSL_NO_TLSEXT
+	CLEAN(tlsext_server_name);
+#endif
 #undef CLEAN
 
 #define CLEAN(x) \
@@ -1250,8 +1253,10 @@
 
 		if (b > 0) {
 			char buf[1024];
+#if 0
 			log_error_write(srv, __FILE__, __LINE__, "sdd",
 					"CLOSE-read()", con->fd, b);
+#endif
 
 			/* */
 			read(con->fd, buf, sizeof(buf));
@@ -1621,8 +1626,10 @@
 			}
 			if (b > 0) {
 				char buf[1024];
+#if 0
 				log_error_write(srv, __FILE__, __LINE__, "sdd",
 						"CLOSE-read()", con->fd, b);
+#endif
 
 				/* */
 				read(con->fd, buf, sizeof(buf));
Index: src/configfile.c
===================================================================
--- src/configfile.c	(.../tags/lighttpd-1.4.24)
+++ src/configfile.c	(.../branches/lighttpd-1.4.x)
@@ -99,6 +99,7 @@
 		{ "ssl.verifyclient.enforce",    NULL, T_CONFIG_BOOLEAN, T_CONFIG_SCOPE_SERVER },     /* 57 */
 		{ "ssl.verifyclient.depth",      NULL, T_CONFIG_SHORT,   T_CONFIG_SCOPE_SERVER },     /* 58 */
 		{ "ssl.verifyclient.username",   NULL, T_CONFIG_STRING,  T_CONFIG_SCOPE_SERVER },     /* 59 */
+		{ "ssl.verifyclient.exportcert", NULL, T_CONFIG_BOOLEAN, T_CONFIG_SCOPE_SERVER },     /* 60 */
 		{ "server.host",                 "use server.bind instead", T_CONFIG_DEPRECATED, T_CONFIG_SCOPE_UNSET },
 		{ "server.docroot",              "use server.document-root instead", T_CONFIG_DEPRECATED, T_CONFIG_SCOPE_UNSET },
 		{ "server.virtual-root",         "load mod_simple_vhost and use simple-vhost.server-root instead", T_CONFIG_DEPRECATED, T_CONFIG_SCOPE_UNSET },
@@ -187,6 +188,7 @@
 		s->ssl_verifyclient_enforce = 1;
 		s->ssl_verifyclient_username = buffer_init();
 		s->ssl_verifyclient_depth = 9;
+		s->ssl_verifyclient_export_cert = 0;
 
 		cv[2].destination = s->errorfile_prefix;
 
@@ -238,6 +240,7 @@
 		cv[57].destination = &(s->ssl_verifyclient_enforce);
 		cv[58].destination = &(s->ssl_verifyclient_depth);
 		cv[59].destination = s->ssl_verifyclient_username;
+		cv[60].destination = &(s->ssl_verifyclient_export_cert);
 
 		srv->config_storage[i] = s;
 
@@ -325,6 +328,7 @@
 	PATCH(ssl_verifyclient_enforce);
 	PATCH(ssl_verifyclient_depth);
 	PATCH(ssl_verifyclient_username);
+	PATCH(ssl_verifyclient_export_cert);
 
 	return 0;
 }
@@ -425,6 +429,8 @@
 				PATCH(ssl_verifyclient_depth);
 			} else if (buffer_is_equal_string(du->key, CONST_STR_LEN("ssl.verifyclient.username"))) {
 				PATCH(ssl_verifyclient_username);
+			} else if (buffer_is_equal_string(du->key, CONST_STR_LEN("ssl.verifyclient.exportcert"))) {
+				PATCH(ssl_verifyclient_export_cert);
 			}
 		}
 	}
Index: src/mod_rrdtool.c
===================================================================
--- src/mod_rrdtool.c	(.../tags/lighttpd-1.4.24)
+++ src/mod_rrdtool.c	(.../branches/lighttpd-1.4.x)
@@ -237,11 +237,11 @@
 					"not a regular file:", s->path_rrd);
 			return HANDLER_ERROR;
 		}
-	}
 
-	/* still create DB if it's empty file */
-	if (st.st_size > 0) {
-		return HANDLER_GO_ON;
+		/* still create DB if it's empty file */
+		if (st.st_size > 0) {
+			return HANDLER_GO_ON;
+		}
 	}
 
 	/* create a new one */
Index: src/response.c
===================================================================
--- src/response.c	(.../tags/lighttpd-1.4.24)
+++ src/response.c	(.../branches/lighttpd-1.4.x)
@@ -131,8 +131,77 @@
 	return 0;
 }
 
+#ifdef USE_OPENSSL
+static void https_add_ssl_entries(connection *con) {
+	X509 *xs;
+	X509_NAME *xn;
+	X509_NAME_ENTRY *xe;
+	if (
+		SSL_get_verify_result(con->ssl) != X509_V_OK
+		|| !(xs = SSL_get_peer_certificate(con->ssl))
+	) {
+		return;
+	}
 
+	xn = X509_get_subject_name(xs);
+	for (int i = 0, nentries = X509_NAME_entry_count(xn); i < nentries; ++i) {
+		int xobjnid;
+		const char * xobjsn;
+		data_string *envds;
 
+		if (!(xe = X509_NAME_get_entry(xn, i))) {
+			continue;
+		}
+		xobjnid = OBJ_obj2nid((ASN1_OBJECT*)X509_NAME_ENTRY_get_object(xe));
+		xobjsn = OBJ_nid2sn(xobjnid);
+		if (!xobjsn) {
+			continue;
+		}
+
+		if (NULL == (envds = (data_string *)array_get_unused_element(con->environment, TYPE_STRING))) {
+			envds = data_string_init();
+		}
+		buffer_copy_string_len(envds->key, CONST_STR_LEN("SSL_CLIENT_S_DN_"));
+		buffer_append_string(envds->key, xobjsn);
+		buffer_copy_string_len(
+			envds->value,
+			(const char *)xe->value->data, xe->value->length
+		);
+		/* pick one of the exported values as "authed user", for example
+		 * ssl.verifyclient.username   = "SSL_CLIENT_S_DN_UID" or "SSL_CLIENT_S_DN_emailAddress"
+		 */
+		if (buffer_is_equal(con->conf.ssl_verifyclient_username, envds->key)) {
+			buffer_copy_string_buffer(con->authed_user, envds->value);
+		}
+		array_insert_unique(con->environment, (data_unset *)envds);
+	}
+	if (con->conf.ssl_verifyclient_export_cert) {
+		BIO *bio;
+		if (NULL != (bio = BIO_new(BIO_s_mem()))) {
+			data_string *envds;
+			int n;
+
+			PEM_write_bio_X509(bio, xs);
+			n = BIO_pending(bio);
+
+			if (NULL == (envds = (data_string *)array_get_unused_element(con->environment, TYPE_STRING))) {
+				envds = data_string_init();
+			}
+
+			buffer_copy_string_len(envds->key, CONST_STR_LEN("SSL_CLIENT_CERT"));
+			buffer_prepare_copy(envds->value, n+1);
+			BIO_read(bio, envds->value->ptr, n);
+			BIO_free(bio);
+			envds->value->ptr[n] = '\0';
+			envds->value->used = n+1;
+			array_insert_unique(con->environment, (data_unset *)envds);
+		}
+	}
+	X509_free(xs);
+}
+#endif
+
+
 handler_t http_response_prepare(server *srv, connection *con) {
 	handler_t r;
 
@@ -279,6 +348,12 @@
 			log_error_write(srv, __FILE__, __LINE__,  "sb", "URI-path     : ", con->uri.path);
 		}
 
+#ifdef USE_OPENSSL
+		if (con->conf.is_ssl && con->conf.ssl_verifyclient) {
+			https_add_ssl_entries(con);
+		}
+#endif
+
 		/**
 		 *
 		 * call plugins
Index: src/mod_fastcgi.c
===================================================================
--- src/mod_fastcgi.c	(.../tags/lighttpd-1.4.24)
+++ src/mod_fastcgi.c	(.../branches/lighttpd-1.4.x)
@@ -2416,8 +2416,8 @@
 
 static int fastcgi_get_packet(server *srv, handler_ctx *hctx, fastcgi_response_packet *packet) {
 	chunk *	c;
-	size_t offset = 0;
-	size_t toread = 0;
+	size_t offset;
+	size_t toread;
 	FCGI_Header *header;
 
 	if (!hctx->rb->first) return -1;
@@ -2428,20 +2428,22 @@
 	packet->padding = 0;
 	packet->request_id = 0;
 
+	offset = 0; toread = 8;
 	/* get at least the FastCGI header */
 	for (c = hctx->rb->first; c; c = c->next) {
-		size_t weWant = sizeof(*header) - (packet->b->used - 1);
 		size_t weHave = c->mem->used - c->offset - 1;
 
-		if (weHave > weWant) weHave = weWant;
+		if (weHave > toread) weHave = toread;
 
 		if (packet->b->used == 0) {
 			buffer_copy_string_len(packet->b, c->mem->ptr + c->offset, weHave);
 		} else {
 			buffer_append_string_len(packet->b, c->mem->ptr + c->offset, weHave);
 		}
+		toread -= weHave;
+		offset = weHave; /* skip offset bytes in chunk for "real" data */
 
-		if (packet->b->used >= sizeof(*header) + 1) break;
+		if (0 == toread) break;
 	}
 
 	if ((packet->b->used == 0) ||
@@ -2449,7 +2451,9 @@
 		/* no header */
 		buffer_free(packet->b);
 
-		log_error_write(srv, __FILE__, __LINE__, "sdsds", "FastCGI: header too small:", packet->b->used, "bytes <", sizeof(FCGI_Header), "bytes");
+		if (hctx->plugin_data->conf.debug) {
+			log_error_write(srv, __FILE__, __LINE__, "sdsds", "FastCGI: header too small:", packet->b->used, "bytes <", sizeof(FCGI_Header), "bytes, waiting for more data");
+		}
 		return -1;
 	}
 
@@ -2461,9 +2465,6 @@
 	packet->type = header->type;
 	packet->padding = header->paddingLength;
 
-	/* the first bytes in packet->b are the header */
-	offset = sizeof(*header);
-
 	/* ->b should only be the content */
 	buffer_copy_string_len(packet->b, CONST_STR_LEN("")); /* used == 1 */
 
@@ -2477,7 +2478,7 @@
 
 			buffer_append_string_len(packet->b, c->mem->ptr + c->offset + offset, weHave);
 
-			/* we only skipped the first 8 bytes as they are the fcgi header */
+			/* we only skipped the first bytes as they belonged to the fcgi header */
 			offset = 0;
 		}
 
@@ -3080,34 +3081,17 @@
 
 		if (ret < 0) {
 			switch(errno) {
+			case EPIPE:
 			case ENOTCONN:
+			case ECONNRESET:
 				/* the connection got dropped after accept()
-				 *
-				 * this is most of the time a PHP which dies
-				 * after PHP_FCGI_MAX_REQUESTS
-				 *
+				 * we don't care about that - if you accept() it, you have to handle it.
 				 */
-				if (hctx->wb->bytes_out == 0 &&
-				    hctx->reconnects < 5) {
-					usleep(10000); /* take away the load of the webserver
-							* to give the php a chance to restart
-							*/
 
-					fcgi_reconnect(srv, hctx);
-
-					return HANDLER_WAIT_FOR_FD;
-				}
-
-				/* not reconnected ... why
-				 *
-				 * far@#lighttpd report this for FreeBSD
-				 *
-				 */
-
-				log_error_write(srv, __FILE__, __LINE__, "ssosd",
-						"[REPORT ME] connection was dropped after accept(). reconnect() denied:",
+				log_error_write(srv, __FILE__, __LINE__, "ssosb",
+							"connection was dropped after accept() (perhaps the fastcgi process died),",
 						"write-offset:", hctx->wb->bytes_out,
-						"reconnect attempts:", hctx->reconnects);
+						"socket:", hctx->proc->connection_name);
 
 				return HANDLER_ERROR;
 			default:
Index: src/mod_magnet.c
===================================================================
--- src/mod_magnet.c	(.../tags/lighttpd-1.4.24)
+++ src/mod_magnet.c	(.../branches/lighttpd-1.4.x)
@@ -170,6 +170,7 @@
 		return lua_gettop(L);
 	} else {
 		lua_pushvalue(L, lua_upvalueindex(1));
+		lua_insert(L, 1);
 		lua_call(L, lua_gettop(L) - 1, LUA_MULTRET);
 		return lua_gettop(L);
 	}
@@ -824,9 +825,36 @@
 	return 0;
 }
 
+static int traceback (lua_State *L) {
+	if (!lua_isstring(L, 1))  /* 'message' not a string? */
+		return 1;  /* keep it intact */
+	lua_getfield(L, LUA_GLOBALSINDEX, "debug");
+	if (!lua_istable(L, -1)) {
+		lua_pop(L, 1);
+		return 1;
+	}
+	lua_getfield(L, -1, "traceback");
+	if (!lua_isfunction(L, -1)) {
+		lua_pop(L, 2);
+		return 1;
+	}
+	lua_pushvalue(L, 1);  /* pass error message */
+	lua_pushinteger(L, 2);  /* skip this function and traceback */
+	lua_call(L, 2, 1);  /* call debug.traceback */
+	return 1;
+}
+
+static int push_traceback(lua_State *L, int narg) {
+	int base = lua_gettop(L) - narg;  /* function index */
+	lua_pushcfunction(L, traceback);
+	lua_insert(L, base);
+	return base;
+}
+
 static handler_t magnet_attract(server *srv, connection *con, plugin_data *p, buffer *name) {
 	lua_State *L;
 	int lua_return_value = -1;
+	int errfunc;
 	/* get the script-context */
 
 
@@ -955,7 +983,9 @@
 
 	lua_setfenv(L, -2); /* on the stack should be a modified env (sp -= 1) */
 
-	if (lua_pcall(L, 0, 1, 0)) {
+	errfunc = push_traceback(L, 0);
+	if (lua_pcall(L, 0, 1, errfunc)) {
+		lua_remove(L, errfunc);
 		log_error_write(srv, __FILE__, __LINE__,
 			"ss",
 			"lua_pcall():",
@@ -969,6 +999,7 @@
 
 		return HANDLER_FINISHED;
 	}
+	lua_remove(L, errfunc);
 
 	/* we should have the function-copy and the return value on the stack */
 	assert(lua_gettop(L) == 2);
Index: configure.ac
===================================================================
Index: SConstruct
===================================================================
Index: NEWS
===================================================================
--- NEWS	(.../tags/lighttpd-1.4.24)
+++ NEWS	(.../branches/lighttpd-1.4.x)
@@ -3,7 +3,18 @@
 NEWS
 ====
 
-- 1.4.24 -
+- 1.4.25 -
+  * mod_magnet: fix pairs() for normal tables and strings (fixes #1307)
+  * mod_magnet: add traceback for printing lua errors
+  * mod_rewrite: fix compile error if compiled without pcre
+  * disable warning "CLOSE-read" (fixes #2091)
+  * mod_rrdtool: fix creating file if it doesn't exist (#1788)
+  * reset tlsext_server_name in connection_reset - fixes random hostnames in the $HTTP["host"] conditional
+  * export some SSL_CLIENT_* vars for client cert validation (fixes #1288, thx presbrey)
+  * mod_fastcgi: fix mod_fastcgi packet parsing
+  * mod_fastcgi: Don't reconnect after connect() succeeded (fixes #2096)
+
+- 1.4.24 - 2009-10-25
   * Add T_CONFIG_INT for bigger integers from the config (needed for #1966)
   * Use unsigned int (and T_CONFIG_INT) for max_request_size
   * Use unsigned int for secdownload.timeout (fixes #1966)
Index: CMakeLists.txt
===================================================================
Commit	Line	Data
aaee4f7b ER	1	# Revision 2692
	2	Index: src/base.h
	3	===================================================================
	4	--- src/base.h (.../tags/lighttpd-1.4.24)
	5	+++ src/base.h (.../branches/lighttpd-1.4.x)
	6	@@ -280,6 +280,7 @@
	7	unsigned short ssl_verifyclient_enforce;
	8	unsigned short ssl_verifyclient_depth;
	9	buffer *ssl_verifyclient_username;
	10	+ unsigned short ssl_verifyclient_export_cert;
	11
	12	unsigned short use_ipv6;
	13	unsigned short defer_accept;
d896cce3 ER	14	Index: src/mod_rewrite.c
	15	===================================================================
	16	--- src/mod_rewrite.c (.../tags/lighttpd-1.4.24)
	17	+++ src/mod_rewrite.c (.../branches/lighttpd-1.4.x)
	18	@@ -9,10 +9,9 @@
	19	#include <stdlib.h>
	20	#include <string.h>
	21
	22	-typedef struct {
	23	#ifdef HAVE_PCRE_H
	24	+typedef struct {
	25	pcre *key;
	26	-#endif
	27
	28	buffer *value;
	29
	30	@@ -70,7 +69,6 @@
	31	}
	32
	33	static int rewrite_rule_buffer_append(rewrite_rule_buffer kvb, buffer key, buffer *value, int once) {
	34	-#ifdef HAVE_PCRE_H
	35	size_t i;
	36	const char *errptr;
	37	int erroff;
	38	@@ -109,18 +107,9 @@
	39	kvb->used++;
	40
	41	return 0;
	42	-#else
	43	- UNUSED(kvb);
	44	- UNUSED(value);
	45	- UNUSED(once);
	46	- UNUSED(key);
	47	-
	48	- return -1;
	49	-#endif
	50	}
	51
	52	static void rewrite_rule_buffer_free(rewrite_rule_buffer *kvb) {
	53	-#ifdef HAVE_PCRE_H
	54	size_t i;
	55
	56	for (i = 0; i < kvb->size; i++) {
	57	@@ -130,7 +119,6 @@
	58	}
	59
	60	if (kvb->ptr) free(kvb->ptr);
	61	-#endif
	62
	63	free(kvb);
	64	}
	65	@@ -201,24 +189,29 @@
	66	((data_string *)(da->value->data[j]))->key,
	67	((data_string *)(da->value->data[j]))->value,
	68	once)) {
	69	-#ifdef HAVE_PCRE_H
	70	log_error_write(srv, __FILE__, __LINE__, "sb",
	71	"pcre-compile failed for", da->value->data[j]->key);
	72	-#else
	73	- log_error_write(srv, __FILE__, __LINE__, "s",
	74	- "pcre support is missing, please install libpcre and the headers");
	75	-#endif
	76	}
	77	}
78	}
79
80	return 0;
81	}
82	+#else
83	+static int parse_config_entry(server srv, array ca, const char *option) {
84	+ static int logged_message = 0;
85	+ if (logged_message) return 0;
86	+ if (NULL != array_get_element(ca, option)) {
87	+ logged_message = 1;
88	+ log_error_write(srv, __FILE__, __LINE__, "s",
89	+ "pcre support is missing, please install libpcre and the headers");
90	+ }
91	+ return 0;
92	+}
93	+#endif
94
95	SETDEFAULTS_FUNC(mod_rewrite_set_defaults) {
96	- plugin_data *p = p_d;
97	size_t i = 0;
98	-
99	config_values_t cv[] = {
100	{ "url.rewrite-repeat", NULL, T_CONFIG_LOCAL, T_CONFIG_SCOPE_CONNECTION }, /* 0 */
101	{ "url.rewrite-once", NULL, T_CONFIG_LOCAL, T_CONFIG_SCOPE_CONNECTION }, /* 1 */
102	@@ -243,33 +236,37 @@
103	{ NULL, NULL, T_CONFIG_UNSET, T_CONFIG_SCOPE_UNSET }
104	};
105
106	+#ifdef HAVE_PCRE_H
107	+ plugin_data *p = p_d;
108	+
109	if (!p) return HANDLER_ERROR;
110
111	/* 0 */
112	p->config_storage = calloc(1, srv->config_context->used * sizeof(specific_config *));
113	+#else
114	+ UNUSED(p_d);
115	+#endif
116
117	for (i = 0; i < srv->config_context->used; i++) {
118	- plugin_config *s;
119	array *ca;
120	+#ifdef HAVE_PCRE_H
121	+ plugin_config *s;
122
123	s = calloc(1, sizeof(plugin_config));
124	s->rewrite = rewrite_rule_buffer_init();
125	s->rewrite_NF = rewrite_rule_buffer_init();
126	-
127	- cv[0].destination = s->rewrite;
128	- cv[1].destination = s->rewrite;
129	- cv[2].destination = s->rewrite_NF;
130	- cv[3].destination = s->rewrite_NF;
131	- cv[4].destination = s->rewrite;
132	- cv[5].destination = s->rewrite;
133	-
134	p->config_storage[i] = s;
135	+#endif
136	+
137	ca = ((data_config *)srv->config_context->data[i])->value;
138
139	if (0 != config_insert_values_global(srv, ca, cv)) {
140	return HANDLER_ERROR;
141	}
142
143	+#ifndef HAVE_PCRE_H
144	+# define parse_config_entry(srv, ca, x, option, y) parse_config_entry(srv, ca, option)
145	+#endif
146	parse_config_entry(srv, ca, s->rewrite, "url.rewrite-once", 1);
147	parse_config_entry(srv, ca, s->rewrite, "url.rewrite-final", 1);
148	parse_config_entry(srv, ca, s->rewrite_NF, "url.rewrite-if-not-file", 1);
149	@@ -280,7 +277,9 @@
150
151	return HANDLER_GO_ON;
152	}
153	+
154	#ifdef HAVE_PCRE_H
155	+
156	#define PATCH(x) \
157	p->conf.x = s->x;
158	static int mod_rewrite_patch_connection(server srv, connection con, plugin_data *p) {
159	@@ -330,7 +329,7 @@
160
161	return 0;
162	}
163	-#endif
164	+
165	URIHANDLER_FUNC(mod_rewrite_con_reset) {
166	plugin_data *p = p_d;
167
168	@@ -345,7 +344,6 @@
169	}
170
171	static int process_rewrite_rules(server srv, connection con, plugin_data p, rewrite_rule_buffer kvb) {
172	-#ifdef HAVE_PCRE_H
173	size_t i;
174	handler_ctx *hctx;
175
176	@@ -444,19 +442,11 @@
177	}
178	#undef N
179	}
180	-#else
181	- UNUSED(srv);
182	- UNUSED(con);
183	- UNUSED(p);
184	- UNUSED(hctx);
185	- UNUSED(kvb);
186	-#endif
187
188	return HANDLER_GO_ON;
189	}
190
191	URIHANDLER_FUNC(mod_rewrite_physical) {
192	-#ifdef HAVE_PCRE_H
193	plugin_data *p = p_d;
194	handler_t r;
195	stat_cache_entry *sce;
196	@@ -480,17 +470,11 @@
197	default:
198	return r;
199	}
200	-#else
201	- UNUSED(srv);
202	- UNUSED(con);
203	- UNUSED(p_d);
204	-#endif
205
206	return HANDLER_GO_ON;
207	}
208
209	URIHANDLER_FUNC(mod_rewrite_uri_handler) {
210	-#ifdef HAVE_PCRE_H
211	plugin_data *p = p_d;
212
213	mod_rewrite_patch_connection(srv, con, p);
214	@@ -498,29 +482,27 @@
215	if (!p->conf.rewrite) return HANDLER_GO_ON;
216
217	return process_rewrite_rules(srv, con, p, p->conf.rewrite);
218	-#else
219	- UNUSED(srv);
220	- UNUSED(con);
221	- UNUSED(p_d);
222	-#endif
223
224	return HANDLER_GO_ON;
225	}
226	+#endif
227
228	int mod_rewrite_plugin_init(plugin *p);
229	int mod_rewrite_plugin_init(plugin *p) {
230	p->version = LIGHTTPD_VERSION_ID;
231	p->name = buffer_init_string("rewrite");
232
233	+#ifdef HAVE_PCRE_H
234	p->init = mod_rewrite_init;
235	/* it has to stay _raw as we are matching on uri + querystring
236	*/
237
238	p->handle_uri_raw = mod_rewrite_uri_handler;
239	p->handle_physical = mod_rewrite_physical;
240	- p->set_defaults = mod_rewrite_set_defaults;
241	p->cleanup = mod_rewrite_free;
242	p->connection_reset = mod_rewrite_con_reset;
243	+#endif
244	+ p->set_defaults = mod_rewrite_set_defaults;
245
246	p->data = NULL;
247
248	Index: src/connections.c
249	===================================================================
250	--- src/connections.c (.../tags/lighttpd-1.4.24)
251	+++ src/connections.c (.../branches/lighttpd-1.4.x)
aaee4f7b ER	252	@@ -807,6 +807,9 @@
	253	CLEAN(authed_user);
	254	CLEAN(server_name);
	255	CLEAN(error_handler);
	256	+#if defined USE_OPENSSL && ! defined OPENSSL_NO_TLSEXT
	257	+ CLEAN(tlsext_server_name);
	258	+#endif
	259	#undef CLEAN
	260
	261	#define CLEAN(x) \
	262	@@ -1250,8 +1253,10 @@
d896cce3 ER	263
	264	if (b > 0) {
	265	char buf[1024];
	266	+#if 0
	267	log_error_write(srv, __FILE__, __LINE__, "sdd",
	268	"CLOSE-read()", con->fd, b);
	269	+#endif
	270
	271	/* */
	272	read(con->fd, buf, sizeof(buf));
aaee4f7b	273	@@ -1621,8 +1626,10 @@
d896cce3 ER	274	}
	275	if (b > 0) {
	276	char buf[1024];
	277	+#if 0
	278	log_error_write(srv, __FILE__, __LINE__, "sdd",
	279	"CLOSE-read()", con->fd, b);
	280	+#endif
	281
	282	/* */
	283	read(con->fd, buf, sizeof(buf));
aaee4f7b ER	284	Index: src/configfile.c
	285	===================================================================
	286	--- src/configfile.c (.../tags/lighttpd-1.4.24)
	287	+++ src/configfile.c (.../branches/lighttpd-1.4.x)
	288	@@ -99,6 +99,7 @@
	289	{ "ssl.verifyclient.enforce", NULL, T_CONFIG_BOOLEAN, T_CONFIG_SCOPE_SERVER }, /* 57 */
	290	{ "ssl.verifyclient.depth", NULL, T_CONFIG_SHORT, T_CONFIG_SCOPE_SERVER }, /* 58 */
	291	{ "ssl.verifyclient.username", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_SERVER }, /* 59 */
	292	+ { "ssl.verifyclient.exportcert", NULL, T_CONFIG_BOOLEAN, T_CONFIG_SCOPE_SERVER }, /* 60 */
	293	{ "server.host", "use server.bind instead", T_CONFIG_DEPRECATED, T_CONFIG_SCOPE_UNSET },
	294	{ "server.docroot", "use server.document-root instead", T_CONFIG_DEPRECATED, T_CONFIG_SCOPE_UNSET },
	295	{ "server.virtual-root", "load mod_simple_vhost and use simple-vhost.server-root instead", T_CONFIG_DEPRECATED, T_CONFIG_SCOPE_UNSET },
	296	@@ -187,6 +188,7 @@
	297	s->ssl_verifyclient_enforce = 1;
	298	s->ssl_verifyclient_username = buffer_init();
	299	s->ssl_verifyclient_depth = 9;
	300	+ s->ssl_verifyclient_export_cert = 0;
	301
	302	cv[2].destination = s->errorfile_prefix;
	303
	304	@@ -238,6 +240,7 @@
	305	cv[57].destination = &(s->ssl_verifyclient_enforce);
	306	cv[58].destination = &(s->ssl_verifyclient_depth);
	307	cv[59].destination = s->ssl_verifyclient_username;
	308	+ cv[60].destination = &(s->ssl_verifyclient_export_cert);
	309
	310	srv->config_storage[i] = s;
	311
	312	@@ -325,6 +328,7 @@
	313	PATCH(ssl_verifyclient_enforce);
	314	PATCH(ssl_verifyclient_depth);
	315	PATCH(ssl_verifyclient_username);
	316	+ PATCH(ssl_verifyclient_export_cert);
	317
	318	return 0;
	319	}
	320	@@ -425,6 +429,8 @@
	321	PATCH(ssl_verifyclient_depth);
	322	} else if (buffer_is_equal_string(du->key, CONST_STR_LEN("ssl.verifyclient.username"))) {
	323	PATCH(ssl_verifyclient_username);
	324	+ } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("ssl.verifyclient.exportcert"))) {
	325	+ PATCH(ssl_verifyclient_export_cert);
	326	}
	327	}
	328	}
d896cce3 ER	329	Index: src/mod_rrdtool.c
	330	===================================================================
	331	--- src/mod_rrdtool.c (.../tags/lighttpd-1.4.24)
	332	+++ src/mod_rrdtool.c (.../branches/lighttpd-1.4.x)
	333	@@ -237,11 +237,11 @@
	334	"not a regular file:", s->path_rrd);
	335	return HANDLER_ERROR;
	336	}
	337	- }
	338
	339	- /* still create DB if it's empty file */
	340	- if (st.st_size > 0) {
	341	- return HANDLER_GO_ON;
	342	+ /* still create DB if it's empty file */
	343	+ if (st.st_size > 0) {
	344	+ return HANDLER_GO_ON;
	345	+ }
	346	}
	347
	348	/* create a new one */
aaee4f7b ER	349	Index: src/response.c
	350	===================================================================
	351	--- src/response.c (.../tags/lighttpd-1.4.24)
	352	+++ src/response.c (.../branches/lighttpd-1.4.x)
	353	@@ -131,8 +131,77 @@
	354	return 0;
	355	}
	356
	357	+#ifdef USE_OPENSSL
	358	+static void https_add_ssl_entries(connection *con) {
	359	+ X509 *xs;
	360	+ X509_NAME *xn;
	361	+ X509_NAME_ENTRY *xe;
	362	+ if (
	363	+ SSL_get_verify_result(con->ssl) != X509_V_OK
	364	+ \|\| !(xs = SSL_get_peer_certificate(con->ssl))
	365	+ ) {
	366	+ return;
	367	+ }
	368
	369	+ xn = X509_get_subject_name(xs);
	370	+ for (int i = 0, nentries = X509_NAME_entry_count(xn); i < nentries; ++i) {
	371	+ int xobjnid;
	372	+ const char * xobjsn;
	373	+ data_string *envds;
	374
	375	+ if (!(xe = X509_NAME_get_entry(xn, i))) {
	376	+ continue;
	377	+ }
	378	+ xobjnid = OBJ_obj2nid((ASN1_OBJECT*)X509_NAME_ENTRY_get_object(xe));
	379	+ xobjsn = OBJ_nid2sn(xobjnid);
	380	+ if (!xobjsn) {
	381	+ continue;
	382	+ }
	383	+
	384	+ if (NULL == (envds = (data_string *)array_get_unused_element(con->environment, TYPE_STRING))) {
	385	+ envds = data_string_init();
	386	+ }
	387	+ buffer_copy_string_len(envds->key, CONST_STR_LEN("SSL_CLIENT_S_DN_"));
	388	+ buffer_append_string(envds->key, xobjsn);
	389	+ buffer_copy_string_len(
	390	+ envds->value,
	391	+ (const char *)xe->value->data, xe->value->length
	392	+ );
	393	+ /* pick one of the exported values as "authed user", for example
	394	+ * ssl.verifyclient.username = "SSL_CLIENT_S_DN_UID" or "SSL_CLIENT_S_DN_emailAddress"
	395	+ */
	396	+ if (buffer_is_equal(con->conf.ssl_verifyclient_username, envds->key)) {
	397	+ buffer_copy_string_buffer(con->authed_user, envds->value);
	398	+ }
	399	+ array_insert_unique(con->environment, (data_unset *)envds);
	400	+ }
	401	+ if (con->conf.ssl_verifyclient_export_cert) {
	402	+ BIO *bio;
	403	+ if (NULL != (bio = BIO_new(BIO_s_mem()))) {
	404	+ data_string *envds;
	405	+ int n;
	406	+
	407	+ PEM_write_bio_X509(bio, xs);
	408	+ n = BIO_pending(bio);
	409	+
	410	+ if (NULL == (envds = (data_string *)array_get_unused_element(con->environment, TYPE_STRING))) {
	411	+ envds = data_string_init();
	412	+ }
413	+
414	+ buffer_copy_string_len(envds->key, CONST_STR_LEN("SSL_CLIENT_CERT"));
415	+ buffer_prepare_copy(envds->value, n+1);
416	+ BIO_read(bio, envds->value->ptr, n);
417	+ BIO_free(bio);
418	+ envds->value->ptr[n] = '\0';
419	+ envds->value->used = n+1;
420	+ array_insert_unique(con->environment, (data_unset *)envds);
421	+ }
422	+ }
423	+ X509_free(xs);
424	+}
425	+#endif
426	+
427	+
428	handler_t http_response_prepare(server srv, connection con) {
429	handler_t r;
430
431	@@ -279,6 +348,12 @@
432	log_error_write(srv, __FILE__, __LINE__, "sb", "URI-path : ", con->uri.path);
433	}
434
435	+#ifdef USE_OPENSSL
436	+ if (con->conf.is_ssl && con->conf.ssl_verifyclient) {
437	+ https_add_ssl_entries(con);
438	+ }
439	+#endif
440	+
441	/**
442	*
443	* call plugins
444	Index: src/mod_fastcgi.c
445	===================================================================
446	--- src/mod_fastcgi.c (.../tags/lighttpd-1.4.24)
447	+++ src/mod_fastcgi.c (.../branches/lighttpd-1.4.x)
448	@@ -2416,8 +2416,8 @@
449
450	static int fastcgi_get_packet(server srv, handler_ctx hctx, fastcgi_response_packet *packet) {
451	chunk * c;
452	- size_t offset = 0;
453	- size_t toread = 0;
454	+ size_t offset;
455	+ size_t toread;
456	FCGI_Header *header;
457
458	if (!hctx->rb->first) return -1;
459	@@ -2428,20 +2428,22 @@
460	packet->padding = 0;
461	packet->request_id = 0;
462
463	+ offset = 0; toread = 8;
464	/* get at least the FastCGI header */
465	for (c = hctx->rb->first; c; c = c->next) {
466	- size_t weWant = sizeof(*header) - (packet->b->used - 1);
467	size_t weHave = c->mem->used - c->offset - 1;
468
469	- if (weHave > weWant) weHave = weWant;
470	+ if (weHave > toread) weHave = toread;
471
472	if (packet->b->used == 0) {
473	buffer_copy_string_len(packet->b, c->mem->ptr + c->offset, weHave);
474	} else {
475	buffer_append_string_len(packet->b, c->mem->ptr + c->offset, weHave);
476	}
477	+ toread -= weHave;
478	+ offset = weHave; /* skip offset bytes in chunk for "real" data */
479
480	- if (packet->b->used >= sizeof(*header) + 1) break;
481	+ if (0 == toread) break;
482	}
483
484	if ((packet->b->used == 0) \|\|
485	@@ -2449,7 +2451,9 @@
486	/* no header */
487	buffer_free(packet->b);
488
489	- log_error_write(srv, __FILE__, __LINE__, "sdsds", "FastCGI: header too small:", packet->b->used, "bytes <", sizeof(FCGI_Header), "bytes");
490	+ if (hctx->plugin_data->conf.debug) {
491	+ log_error_write(srv, __FILE__, __LINE__, "sdsds", "FastCGI: header too small:", packet->b->used, "bytes <", sizeof(FCGI_Header), "bytes, waiting for more data");
492	+ }
493	return -1;
494	}
495
496	@@ -2461,9 +2465,6 @@
497	packet->type = header->type;
498	packet->padding = header->paddingLength;
499
500	- /* the first bytes in packet->b are the header */
501	- offset = sizeof(*header);
502	-
503	/* ->b should only be the content */
504	buffer_copy_string_len(packet->b, CONST_STR_LEN("")); /* used == 1 */
505
506	@@ -2477,7 +2478,7 @@
507
508	buffer_append_string_len(packet->b, c->mem->ptr + c->offset + offset, weHave);
509
510	- /* we only skipped the first 8 bytes as they are the fcgi header */
511	+ /* we only skipped the first bytes as they belonged to the fcgi header */
512	offset = 0;
513	}
514
515	@@ -3080,34 +3081,17 @@
516
517	if (ret < 0) {
518	switch(errno) {
519	+ case EPIPE:
520	case ENOTCONN:
521	+ case ECONNRESET:
522	/* the connection got dropped after accept()
523	- *
524	- * this is most of the time a PHP which dies
525	- * after PHP_FCGI_MAX_REQUESTS
526	- *
527	+ * we don't care about that - if you accept() it, you have to handle it.
528	*/
529	- if (hctx->wb->bytes_out == 0 &&
530	- hctx->reconnects < 5) {
531	- usleep(10000); /* take away the load of the webserver
532	- * to give the php a chance to restart
533	- */
534
535	- fcgi_reconnect(srv, hctx);
536	-
537	- return HANDLER_WAIT_FOR_FD;
538	- }
539	-
540	- /* not reconnected ... why
541	- *
542	- * far@#lighttpd report this for FreeBSD
543	- *
544	- */
545	-
546	- log_error_write(srv, __FILE__, __LINE__, "ssosd",
547	- "[REPORT ME] connection was dropped after accept(). reconnect() denied:",
548	+ log_error_write(srv, __FILE__, __LINE__, "ssosb",
549	+ "connection was dropped after accept() (perhaps the fastcgi process died),",
550	"write-offset:", hctx->wb->bytes_out,
551	- "reconnect attempts:", hctx->reconnects);
552	+ "socket:", hctx->proc->connection_name);
553
554	return HANDLER_ERROR;
555	default:
b4c9cd45	556	Index: src/mod_magnet.c
ceb30c4b	557	===================================================================
b4c9cd45 ER	558	--- src/mod_magnet.c (.../tags/lighttpd-1.4.24)
	559	+++ src/mod_magnet.c (.../branches/lighttpd-1.4.x)
	560	@@ -170,6 +170,7 @@
	561	return lua_gettop(L);
	562	} else {
	563	lua_pushvalue(L, lua_upvalueindex(1));
	564	+ lua_insert(L, 1);
	565	lua_call(L, lua_gettop(L) - 1, LUA_MULTRET);
	566	return lua_gettop(L);
	567	}
	568	@@ -824,9 +825,36 @@
4bf6d22b	569	return 0;
4bf6d22b ER	570	}
4bf6d22b ER	571
b4c9cd45 ER	572	+static int traceback (lua_State *L) {
	573	+ if (!lua_isstring(L, 1)) /* 'message' not a string? */
	574	+ return 1; /* keep it intact */
	575	+ lua_getfield(L, LUA_GLOBALSINDEX, "debug");
	576	+ if (!lua_istable(L, -1)) {
	577	+ lua_pop(L, 1);
	578	+ return 1;
ceb30c4b	579	+ }
b4c9cd45 ER	580	+ lua_getfield(L, -1, "traceback");
	581	+ if (!lua_isfunction(L, -1)) {
	582	+ lua_pop(L, 2);
	583	+ return 1;
bb37cd34	584	+ }
b4c9cd45 ER	585	+ lua_pushvalue(L, 1); /* pass error message */
	586	+ lua_pushinteger(L, 2); /* skip this function and traceback */
	587	+ lua_call(L, 2, 1); /* call debug.traceback */
	588	+ return 1;
bb37cd34 ER	589	+}
bb37cd34 ER	590	+
b4c9cd45 ER	591	+static int push_traceback(lua_State *L, int narg) {
	592	+ int base = lua_gettop(L) - narg; /* function index */
	593	+ lua_pushcfunction(L, traceback);
	594	+ lua_insert(L, base);
	595	+ return base;
ceb30c4b ER	596	+}
ceb30c4b ER	597	+
b4c9cd45 ER	598	static handler_t magnet_attract(server srv, connection con, plugin_data p, buffer name) {
	599	lua_State *L;
	600	int lua_return_value = -1;
	601	+ int errfunc;
	602	/* get the script-context */
ceb30c4b	603
ceb30c4b	604
b4c9cd45	605	@@ -955,7 +983,9 @@
ceb30c4b	606
b4c9cd45	607	lua_setfenv(L, -2); /* on the stack should be a modified env (sp -= 1) */
ceb30c4b	608
b4c9cd45 ER	609	- if (lua_pcall(L, 0, 1, 0)) {
	610	+ errfunc = push_traceback(L, 0);
	611	+ if (lua_pcall(L, 0, 1, errfunc)) {
	612	+ lua_remove(L, errfunc);
	613	log_error_write(srv, __FILE__, __LINE__,
	614	"ss",
	615	"lua_pcall():",
	616	@@ -969,6 +999,7 @@
ceb30c4b	617
b4c9cd45	618	return HANDLER_FINISHED;
ceb30c4b	619	}
b4c9cd45	620	+ lua_remove(L, errfunc);
ceb30c4b	621
b4c9cd45 ER	622	/* we should have the function-copy and the return value on the stack */
b4c9cd45 ER	623	assert(lua_gettop(L) == 2);
ceb30c4b ER	624	Index: configure.ac
ceb30c4b ER	625	===================================================================
ceb30c4b ER	626	Index: SConstruct
	627	===================================================================
	628	Index: NEWS
	629	===================================================================
b4c9cd45	630	--- NEWS (.../tags/lighttpd-1.4.24)
cc37bbfb	631	+++ NEWS (.../branches/lighttpd-1.4.x)
aaee4f7b	632	@@ -3,7 +3,18 @@
ceb30c4b ER	633	NEWS
	634	====
	635
b4c9cd45 ER	636	-- 1.4.24 -
	637	+- 1.4.25 -
	638	+ * mod_magnet: fix pairs() for normal tables and strings (fixes #1307)
	639	+ * mod_magnet: add traceback for printing lua errors
d896cce3 ER	640	+ * mod_rewrite: fix compile error if compiled without pcre
	641	+ * disable warning "CLOSE-read" (fixes #2091)
	642	+ * mod_rrdtool: fix creating file if it doesn't exist (#1788)
aaee4f7b ER	643	+ * reset tlsext_server_name in connection_reset - fixes random hostnames in the $HTTP["host"] conditional
	644	+ * export some SSL_CLIENT_* vars for client cert validation (fixes #1288, thx presbrey)
	645	+ * mod_fastcgi: fix mod_fastcgi packet parsing
	646	+ * mod_fastcgi: Don't reconnect after connect() succeeded (fixes #2096)
ceb30c4b	647	+
b4c9cd45 ER	648	+- 1.4.24 - 2009-10-25
	649	* Add T_CONFIG_INT for bigger integers from the config (needed for #1966)
	650	* Use unsigned int (and T_CONFIG_INT) for max_request_size
	651	* Use unsigned int for secdownload.timeout (fixes #1966)
ceb30c4b ER	652	Index: CMakeLists.txt
ceb30c4b ER	653	===================================================================