- branch update:

  [ssl] fix ssl connection aborts if files are larger than the MAX_WRITE_LIMIT (256kb)

Changed files:
    lighttpd-branch.diff -> 1.71
    lighttpd.spec -> 1.351

diff --git a/lighttpd-branch.diff b/lighttpd-branch.diff
index 61b24e0c52a9b6433d4a6198514e4ccf545cf719..76f06ce17cb591b31c716dc962d936cf96c36b2c 100644 (file)
--- a/lighttpd-branch.diff
+++ b/lighttpd-branch.diff
@@ -1,4 +1,4 @@
-# Revision 2812
+# Revision 2815
 Index: src/http_auth_digest.c
 ===================================================================
 --- src/http_auth_digest.c     (.../tags/lighttpd-1.4.29)
@@ -562,7 +562,7 @@ Index: src/configfile.c
                cv[62].destination = &(s->ssl_use_sslv3);
                cv[63].destination = s->ssl_dh_file;
                cv[64].destination = s->ssl_ec_curve;
-+              cv[65].destination = &(s->ssl_honor_cipher_order);
++              cv[66].destination = &(s->ssl_honor_cipher_order);
 +
                cv[49].destination = &(s->etag_use_inode);
                cv[50].destination = &(s->etag_use_mtime);
@@ -1092,7 +1092,7 @@ Index: src/network_openssl.c
                                        unsigned long err;
  
                                        switch ((ssl_r = SSL_get_error(ssl, r))) {
-@@ -243,6 +259,7 @@
+@@ -243,12 +259,13 @@
                                } else {
                                        c->offset += r;
                                        cq->bytes_out += r;
@@ -1100,6 +1100,13 @@ Index: src/network_openssl.c
                                }
  
                                if (c->offset == c->file.length) {
+                                       chunk_finished = 1;
+                               }
+-                      } while(!chunk_finished && !write_wait);
++                      } while (!chunk_finished && !write_wait && max_bytes > 0);
+ 
+                       break;
+               }
 @@ -263,11 +280,9 @@
  
                        break;
@@ -1892,12 +1899,29 @@ Index: doc/config/lighttpd.conf
 ===================================================================
 --- doc/config/lighttpd.conf   (.../tags/lighttpd-1.4.29)
 +++ doc/config/lighttpd.conf   (.../branches/lighttpd-1.4.x)
-@@ -394,6 +394,8 @@
+@@ -394,6 +394,25 @@
  ##   $SERVER["socket"] == "10.0.0.1:443" {
  ##     ssl.engine                  = "enable"
  ##     ssl.pemfile                 = "/etc/ssl/private/www.example.com.pem"
++##     #
++##     # Mitigate BEAST attack:
++##     #
++##     # A stricter base cipher suite. For details see:
 +##     # http://blog.ivanristic.com/2011/10/mitigating-the-beast-attack-on-tls.html
-+##     ssl.ciphers                 = "ECDHE-RSA-AES256-SHA384:AES256-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH:!AESGCM"
++##     #
++##     ssl.ciphers                 = "ECDHE-RSA-AES256-SHA384:AES256-SHA256:RC4-SHA:RC4:HIGH:!MD5:!aNULL:!EDH:!AESGCM"
++##     #
++##     # Make the server prefer the order of the server side cipher suite instead of the client suite.
++##     # This is necessary to mitigate the BEAST attack (unless you disable all non RC4 algorithms).
++##     # This option is enabled by default, but only used if ssl.ciphers is set.
++##     #
++##     # ssl.honor-cipher-order = "enable"
++##     #
++##     # Mitigate CVE-2009-3555 by disabling client triggered renegotation
++##     # This is enabled by default.
++##     #
++##     # ssl.disable-client-renegotiation = "enable"
++##     #
  ##     server.name                 = "www.example.com"
  ##
  ##     server.document-root        = "/srv/www/vhosts/example.com/www/"
@@ -1907,7 +1931,7 @@ Index: NEWS
 ===================================================================
 --- NEWS       (.../tags/lighttpd-1.4.29)
 +++ NEWS       (.../branches/lighttpd-1.4.x)
-@@ -3,7 +3,19 @@
+@@ -3,7 +3,20 @@
  NEWS
  ====
  
@@ -1923,6 +1947,7 @@ Index: NEWS
 +  * [ssl] count renegotiations to prevent client renegotiations
 +  * [ssl] add option to honor server cipher order (fixes #2364, BEAST attack)
 +  * [core] accept dots in ipv6 addresses in host header (fixes #2359)
++  * [ssl] fix ssl connection aborts if files are larger than the MAX_WRITE_LIMIT (256kb)
 +
 +- 1.4.29 - 2011-07-03
    * Fix mod_proxy waiting for response even if content-length is 0 (fixes #2259)

diff --git a/lighttpd.spec b/lighttpd.spec
index 977eaa742bc4de48a6ad56d130599c7d6b57a99d..8a8847d7fe3a5607268a37aab56b799667677aa7 100644 (file)
--- a/lighttpd.spec
+++ b/lighttpd.spec
@@ -29,7 +29,7 @@ Summary:      Fast and light HTTP server
 Summary(pl.UTF-8):     Szybki i lekki serwer HTTP
 Name:          lighttpd
 Version:       1.4.29
-Release:       4
+Release:       5
 License:       BSD
 Group:         Networking/Daemons/HTTP
 Source0:       http://download.lighttpd.net/lighttpd/releases-1.4.x/%{name}-%{version}.tar.bz2