-Index: src/base.h
+# Revision 2815
+Index: src/http_auth_digest.c
===================================================================
---- src/base.h (.../tags/lighttpd-1.4.15) (revision 1878)
-+++ src/base.h (.../branches/lighttpd-1.4.x) (revision 1878)
-@@ -269,6 +269,9 @@
- unsigned short use_ipv6;
- unsigned short is_ssl;
- unsigned short allow_http11;
-+ unsigned short etag_use_inode;
-+ unsigned short etag_use_mtime;
-+ unsigned short etag_use_size;
- unsigned short force_lowercase_filenames; /* if the FS is case-insensitive, force all files to lower-case */
- unsigned short max_request_size;
-
-Index: src/connections.c
+--- src/http_auth_digest.c (.../tags/lighttpd-1.4.29)
++++ src/http_auth_digest.c (.../branches/lighttpd-1.4.x)
+@@ -1,26 +0,0 @@
+-#include "buffer.h"
+-
+-#include "http_auth_digest.h"
+-
+-#include <string.h>
+-
+-#ifndef USE_OPENSSL
+-# include "md5.h"
+-
+-typedef li_MD5_CTX MD5_CTX;
+-#define MD5_Init li_MD5_Init
+-#define MD5_Update li_MD5_Update
+-#define MD5_Final li_MD5_Final
+-
+-#endif
+-
+-void CvtHex(IN HASH Bin, OUT HASHHEX Hex) {
+- unsigned short i;
+-
+- for (i = 0; i < HASHLEN; i++) {
+- Hex[i*2] = int2hex((Bin[i] >> 4) & 0xf);
+- Hex[i*2+1] = int2hex(Bin[i] & 0xf);
+- }
+- Hex[HASHHEXLEN] = '\0';
+-}
+-
+Index: src/http_auth_digest.h
+===================================================================
+--- src/http_auth_digest.h (.../tags/lighttpd-1.4.29)
++++ src/http_auth_digest.h (.../branches/lighttpd-1.4.x)
+@@ -1,24 +0,0 @@
+-#ifndef _DIGCALC_H_
+-#define _DIGCALC_H_
+-
+-#ifdef HAVE_CONFIG_H
+-# include "config.h"
+-#endif
+-
+-#define HASHLEN 16
+-typedef unsigned char HASH[HASHLEN];
+-#define HASHHEXLEN 32
+-typedef char HASHHEX[HASHHEXLEN+1];
+-#ifdef USE_OPENSSL
+-#define IN const
+-#else
+-#define IN
+-#endif
+-#define OUT
+-
+-void CvtHex(
+- IN HASH Bin,
+- OUT HASHHEX Hex
+- );
+-
+-#endif
+Index: src/network_write.c
===================================================================
---- src/connections.c (.../tags/lighttpd-1.4.15) (revision 1878)
-+++ src/connections.c (.../branches/lighttpd-1.4.x) (revision 1878)
-@@ -1252,6 +1252,16 @@
- socklen_t cnt_len;
- /* accept it and register the fd */
-
-+ /**
-+ * check if we can still open a new connections
-+ *
-+ * see #1216
-+ */
+--- src/network_write.c (.../tags/lighttpd-1.4.29)
++++ src/network_write.c (.../branches/lighttpd-1.4.x)
+@@ -24,17 +24,16 @@
+ # include <sys/resource.h>
+ #endif
+
+-int network_write_chunkqueue_write(server *srv, connection *con, int fd, chunkqueue *cq) {
++int network_write_chunkqueue_write(server *srv, connection *con, int fd, chunkqueue *cq, off_t max_bytes) {
+ chunk *c;
+- size_t chunks_written = 0;
+
+- for(c = cq->first; c; c = c->next) {
++ for(c = cq->first; (max_bytes > 0) && (NULL != c); c = c->next) {
+ int chunk_finished = 0;
+
+ switch(c->type) {
+ case MEM_CHUNK: {
+ char * offset;
+- size_t toSend;
++ off_t toSend;
+ ssize_t r;
+
+ if (c->mem->used == 0) {
+@@ -44,6 +43,8 @@
+
+ offset = c->mem->ptr + c->offset;
+ toSend = c->mem->used - 1 - c->offset;
++ if (toSend > max_bytes) toSend = max_bytes;
+
-+ if (srv->conns->used >= srv->max_conns) {
-+ return NULL;
-+ }
+ #ifdef __WIN32
+ if ((r = send(fd, offset, toSend, 0)) < 0) {
+ /* no error handling for windows... */
+@@ -72,6 +73,7 @@
+
+ c->offset += r;
+ cq->bytes_out += r;
++ max_bytes -= r;
+
+ if (c->offset == (off_t)c->mem->used - 1) {
+ chunk_finished = 1;
+@@ -85,7 +87,7 @@
+ #endif
+ ssize_t r;
+ off_t offset;
+- size_t toSend;
++ off_t toSend;
+ stat_cache_entry *sce = NULL;
+ int ifd;
+
+@@ -98,6 +100,8 @@
+ offset = c->file.start + c->offset;
+ toSend = c->file.length - c->offset;
+
++ if (toSend > max_bytes) toSend = max_bytes;
+
- cnt_len = sizeof(cnt_addr);
+ if (offset > sce->st.st_size) {
+ log_error_write(srv, __FILE__, __LINE__, "sb", "file was shrinked:", c->file.name);
+
+@@ -181,6 +185,7 @@
+
+ c->offset += r;
+ cq->bytes_out += r;
++ max_bytes -= r;
+
+ if (c->offset == c->file.length) {
+ chunk_finished = 1;
+@@ -200,11 +205,9 @@
- if (-1 == (cnt = accept(srv_socket->fd, (struct sockaddr *) &cnt_addr, &cnt_len))) {
-@@ -1265,6 +1275,9 @@
- case ECONNABORTED: /* this is a FreeBSD thingy */
- /* we were stopped _after_ we had a connection */
break;
-+ case EMFILE:
-+ /* out of fds */
-+ break;
+ }
+-
+- chunks_written++;
+ }
+
+- return chunks_written;
++ return 0;
+ }
+
+ #if 0
+Index: src/mod_secure_download.c
+===================================================================
+--- src/mod_secure_download.c (.../tags/lighttpd-1.4.29)
++++ src/mod_secure_download.c (.../branches/lighttpd-1.4.x)
+@@ -8,18 +8,8 @@
+ #include <stdlib.h>
+ #include <string.h>
+
+-#ifdef USE_OPENSSL
+-# include <openssl/md5.h>
+-#else
+-# include "md5.h"
++#include "md5.h"
+
+-typedef li_MD5_CTX MD5_CTX;
+-#define MD5_Init li_MD5_Init
+-#define MD5_Update li_MD5_Update
+-#define MD5_Final li_MD5_Final
+-
+-#endif
+-
+ #define HASHLEN 16
+ typedef unsigned char HASH[HASHLEN];
+ #define HASHHEXLEN 32
+@@ -200,7 +190,7 @@
+
+ URIHANDLER_FUNC(mod_secdownload_uri_handler) {
+ plugin_data *p = p_d;
+- MD5_CTX Md5Ctx;
++ li_MD5_CTX Md5Ctx;
+ HASH HA1;
+ const char *rel_uri, *ts_str, *md5_str;
+ time_t ts = 0;
+@@ -266,9 +256,9 @@
+ buffer_append_string(p->md5, rel_uri);
+ buffer_append_string_len(p->md5, ts_str, 8);
+
+- MD5_Init(&Md5Ctx);
+- MD5_Update(&Md5Ctx, (unsigned char *)p->md5->ptr, p->md5->used - 1);
+- MD5_Final(HA1, &Md5Ctx);
++ li_MD5_Init(&Md5Ctx);
++ li_MD5_Update(&Md5Ctx, (unsigned char *)p->md5->ptr, p->md5->used - 1);
++ li_MD5_Final(HA1, &Md5Ctx);
+
+ buffer_copy_string_hex(p->md5, (char *)HA1, 16);
+
+Index: src/base.h
+===================================================================
+--- src/base.h (.../tags/lighttpd-1.4.29)
++++ src/base.h (.../branches/lighttpd-1.4.x)
+@@ -277,6 +277,7 @@
+ buffer *ssl_cipher_list;
+ buffer *ssl_dh_file;
+ buffer *ssl_ec_curve;
++ unsigned short ssl_honor_cipher_order; /* determine SSL cipher in server-preferred order, not client-order */
+ unsigned short ssl_use_sslv2;
+ unsigned short ssl_use_sslv3;
+ unsigned short ssl_verifyclient;
+@@ -284,6 +285,7 @@
+ unsigned short ssl_verifyclient_depth;
+ buffer *ssl_verifyclient_username;
+ unsigned short ssl_verifyclient_export_cert;
++ unsigned short ssl_disable_client_renegotiation;
+
+ unsigned short use_ipv6, set_v6only; /* set_v6only is only a temporary option */
+ unsigned short defer_accept;
+@@ -437,6 +439,7 @@
+ # ifndef OPENSSL_NO_TLSEXT
+ buffer *tlsext_server_name;
+ # endif
++ unsigned int renegotiations; /* count of SSL_CB_HANDSHAKE_START */
+ #endif
+ /* etag handling */
+ etag_flags_t etag_flags;
+@@ -647,11 +650,9 @@
+
+ fdevent_handler_t event_handler;
+
+- int (* network_backend_write)(struct server *srv, connection *con, int fd, chunkqueue *cq);
+- int (* network_backend_read)(struct server *srv, connection *con, int fd, chunkqueue *cq);
++ int (* network_backend_write)(struct server *srv, connection *con, int fd, chunkqueue *cq, off_t max_bytes);
+ #ifdef USE_OPENSSL
+- int (* network_ssl_backend_write)(struct server *srv, connection *con, SSL *ssl, chunkqueue *cq);
+- int (* network_ssl_backend_read)(struct server *srv, connection *con, SSL *ssl, chunkqueue *cq);
++ int (* network_ssl_backend_write)(struct server *srv, connection *con, SSL *ssl, chunkqueue *cq, off_t max_bytes);
+ #endif
+
+ uid_t uid;
+Index: src/connections.c
+===================================================================
+--- src/connections.c (.../tags/lighttpd-1.4.29)
++++ src/connections.c (.../branches/lighttpd-1.4.x)
+@@ -223,6 +223,12 @@
+
+ len = SSL_read(con->ssl, b->ptr + read_offset, toread);
+
++ if (con->renegotiations > 1 && con->conf.ssl_disable_client_renegotiation) {
++ connection_set_state(srv, con, CON_STATE_ERROR);
++ log_error_write(srv, __FILE__, __LINE__, "s", "SSL: renegotiation initiated by client");
++ return -1;
++ }
++
+ if (len > 0) {
+ if (b->used > 0) b->used--;
+ b->used += len;
+@@ -445,6 +451,7 @@
default:
- log_error_write(srv, __FILE__, __LINE__, "ssd", "accept failed:", strerror(errno), errno);
+ switch(con->http_status) {
+ case 400: /* bad request */
++ case 401: /* authorization required */
+ case 414: /* overload request header */
+ case 505: /* unknown protocol */
+ case 207: /* this was webdav */
+@@ -617,8 +624,9 @@
+ }
+
+ static int connection_handle_write(server *srv, connection *con) {
+- switch(network_write_chunkqueue(srv, con, con->write_queue)) {
++ switch(network_write_chunkqueue(srv, con, con->write_queue, MAX_WRITE_LIMIT)) {
+ case 0:
++ con->write_request_ts = srv->cur_ts;
+ if (con->file_finished) {
+ connection_set_state(srv, con, CON_STATE_RESPONSE_END);
+ joblist_append(srv, con);
+@@ -635,6 +643,7 @@
+ joblist_append(srv, con);
+ break;
+ case 1:
++ con->write_request_ts = srv->cur_ts;
+ con->is_writable = 0;
+
+ /* not finished yet -> WRITE */
+@@ -1251,8 +1260,6 @@
+ log_error_write(srv, __FILE__, __LINE__, "ds",
+ con->fd,
+ "handle write failed.");
+- } else if (con->state == CON_STATE_WRITE) {
+- con->write_request_ts = srv->cur_ts;
}
-@@ -1432,6 +1445,7 @@
- } else if (con->in_error_handler) {
- /* error-handler is back and has generated content */
- /* if Status: was set, take it otherwise use 200 */
-+ con->http_status = con->error_handler_saved_status;
+ }
+
+@@ -1352,6 +1359,7 @@
+ return NULL;
+ }
+
++ con->renegotiations = 0;
+ #ifndef OPENSSL_NO_TLSEXT
+ SSL_set_app_data(con->ssl, con);
+ #endif
+@@ -1667,8 +1675,6 @@
+ con->fd,
+ "handle write failed.");
+ connection_set_state(srv, con, CON_STATE_ERROR);
+- } else if (con->state == CON_STATE_WRITE) {
+- con->write_request_ts = srv->cur_ts;
}
+ }
- if (con->http_status == 0) con->http_status = 200;
Index: src/mod_staticfile.c
===================================================================
---- src/mod_staticfile.c (.../tags/lighttpd-1.4.15) (revision 1878)
-+++ src/mod_staticfile.c (.../branches/lighttpd-1.4.x) (revision 1878)
-@@ -25,6 +25,7 @@
-
+--- src/mod_staticfile.c (.../tags/lighttpd-1.4.29)
++++ src/mod_staticfile.c (.../branches/lighttpd-1.4.x)
+@@ -26,6 +26,7 @@
typedef struct {
array *exclude_ext;
-+ unsigned short etags_used;
+ unsigned short etags_used;
++ unsigned short disable_pathinfo;
} plugin_config;
typedef struct {
-@@ -82,6 +83,7 @@
-
+@@ -84,6 +85,7 @@
config_values_t cv[] = {
{ "static-file.exclude-extensions", NULL, T_CONFIG_ARRAY, T_CONFIG_SCOPE_CONNECTION }, /* 0 */
-+ { "static-file.etags", NULL, T_CONFIG_BOOLEAN, T_CONFIG_SCOPE_CONNECTION }, /* 1 */
+ { "static-file.etags", NULL, T_CONFIG_BOOLEAN, T_CONFIG_SCOPE_CONNECTION }, /* 1 */
++ { "static-file.disable-pathinfo", NULL, T_CONFIG_BOOLEAN, T_CONFIG_SCOPE_CONNECTION }, /* 2 */
{ NULL, NULL, T_CONFIG_UNSET, T_CONFIG_SCOPE_UNSET }
};
-@@ -94,8 +96,10 @@
-
+@@ -97,9 +99,11 @@
s = calloc(1, sizeof(plugin_config));
s->exclude_ext = array_init();
-+ s->etags_used = 1;
+ s->etags_used = 1;
++ s->disable_pathinfo = 0;
cv[0].destination = s->exclude_ext;
-+ cv[1].destination = &(s->etags_used);
+ cv[1].destination = &(s->etags_used);
++ cv[2].destination = &(s->disable_pathinfo);
p->config_storage[i] = s;
-@@ -114,6 +118,7 @@
- plugin_config *s = p->config_storage[0];
+@@ -119,6 +123,7 @@
PATCH(exclude_ext);
-+ PATCH(etags_used);
+ PATCH(etags_used);
++ PATCH(disable_pathinfo);
/* skip the first, the global context */
for (i = 1; i < srv->config_context->used; i++) {
-@@ -129,7 +134,9 @@
-
- if (buffer_is_equal_string(du->key, CONST_STR_LEN("static-file.exclude-extensions"))) {
+@@ -136,7 +141,9 @@
PATCH(exclude_ext);
-- }
-+ } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("static-file.etags"))) {
-+ PATCH(etags_used);
-+ }
+ } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("static-file.etags"))) {
+ PATCH(etags_used);
+- }
++ } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("static-file.disable-pathinfo"))) {
++ PATCH(disable_pathinfo);
++ }
}
}
-@@ -446,11 +453,17 @@
- response_header_overwrite(srv, con, CONST_STR_LEN("Accept-Ranges"), CONST_STR_LEN("bytes"));
+@@ -350,7 +357,6 @@
+ URIHANDLER_FUNC(mod_staticfile_subrequest) {
+ plugin_data *p = p_d;
+ size_t k;
+- int s_len;
+ stat_cache_entry *sce = NULL;
+ buffer *mtime = NULL;
+ data_string *ds;
+@@ -376,7 +382,12 @@
+
+ mod_staticfile_patch_connection(srv, con, p);
+
+- s_len = con->uri.path->used - 1;
++ if (p->conf.disable_pathinfo && 0 != con->request.pathinfo->used) {
++ if (con->conf.log_request_handling) {
++ log_error_write(srv, __FILE__, __LINE__, "s", "-- NOT handling file as static file, pathinfo forbidden");
++ }
++ return HANDLER_GO_ON;
++ }
+
+ /* ignore certain extensions */
+ for (k = 0; k < p->conf.exclude_ext->used; k++) {
+Index: src/network.c
+===================================================================
+--- src/network.c (.../tags/lighttpd-1.4.29)
++++ src/network.c (.../branches/lighttpd-1.4.x)
+@@ -27,6 +27,19 @@
+ # include <openssl/rand.h>
+ #endif
+
++#ifdef USE_OPENSSL
++static void ssl_info_callback(const SSL *ssl, int where, int ret) {
++ UNUSED(ret);
++
++ if (0 != (where & SSL_CB_HANDSHAKE_START)) {
++ connection *con = SSL_get_app_data(ssl);
++ ++con->renegotiations;
++ } else if (0 != (where & SSL_CB_HANDSHAKE_DONE)) {
++ ssl->s3->flags |= SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS;
++ }
++}
++#endif
++
+ static handler_t network_server_handle_fdevent(server *srv, void *context, int revents) {
+ server_socket *srv_socket = (server_socket *)context;
+ connection *con;
+@@ -480,9 +493,11 @@
+ network_backend_t backend;
+
+ #if OPENSSL_VERSION_NUMBER >= 0x0090800fL
++#ifndef OPENSSL_NO_ECDH
+ EC_KEY *ecdh;
+ int nid;
+ #endif
++#endif
- if (allow_caching) {
-- if (NULL == array_get_element(con->response.headers, "ETag")) {
-- /* generate e-tag */
-- etag_mutate(con->physical.etag, sce->etag);
-+ etag_flags_t flags;
+ #ifdef USE_OPENSSL
+ DH *dh;
+@@ -553,6 +568,11 @@
+ /* load SSL certificates */
+ for (i = 0; i < srv->config_context->used; i++) {
+ specific_config *s = srv->config_storage[i];
++#ifndef SSL_OP_NO_COMPRESSION
++# define SSL_OP_NO_COMPRESSION 0
++#endif
++ long ssloptions =
++ SSL_OP_ALL | SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION | SSL_OP_NO_COMPRESSION;
+
+ if (buffer_is_empty(s->ssl_pemfile)) continue;
+
+@@ -586,6 +606,9 @@
+ return -1;
+ }
-- response_header_overwrite(srv, con, CONST_STR_LEN("ETag"), CONST_BUF_LEN(con->physical.etag));
-+ flags = (con->conf.etag_use_mtime ? ETAG_USE_MTIME : 0) | (con->conf.etag_use_inode ? ETAG_USE_INODE : 0) | (con->conf.etag_use_size ? ETAG_USE_SIZE : 0);
++ SSL_CTX_set_options(s->ssl_ctx, ssloptions);
++ SSL_CTX_set_info_callback(s->ssl_ctx, ssl_info_callback);
+
-+ if (p->conf.etags_used && flags != 0 && !buffer_is_empty(sce->etag)) {
-+ if (NULL == array_get_element(con->response.headers, "ETag")) {
-+ /* generate e-tag */
-+ etag_mutate(con->physical.etag, sce->etag);
+ if (!s->ssl_use_sslv2) {
+ /* disable SSLv2 */
+ if (!(SSL_OP_NO_SSLv2 & SSL_CTX_set_options(s->ssl_ctx, SSL_OP_NO_SSLv2))) {
+@@ -611,6 +634,10 @@
+ ERR_error_string(ERR_get_error(), NULL));
+ return -1;
+ }
+
-+ response_header_overwrite(srv, con, CONST_STR_LEN("ETag"), CONST_BUF_LEN(con->physical.etag));
++ if (s->ssl_honor_cipher_order) {
++ SSL_CTX_set_options(s->ssl_ctx, SSL_OP_CIPHER_SERVER_PREFERENCE);
+ }
}
- /* prepare header */
+ /* Support for Diffie-Hellman key exchange */
+@@ -847,7 +874,7 @@
+ return 0;
+ }
+
+-int network_write_chunkqueue(server *srv, connection *con, chunkqueue *cq) {
++int network_write_chunkqueue(server *srv, connection *con, chunkqueue *cq, off_t max_bytes) {
+ int ret = -1;
+ off_t written = 0;
+ #ifdef TCP_CORK
+@@ -855,16 +882,34 @@
+ #endif
+ server_socket *srv_socket = con->srv_socket;
+
+- if (con->conf.global_kbytes_per_second &&
+- *(con->conf.global_bytes_per_second_cnt_ptr) > con->conf.global_kbytes_per_second * 1024) {
+- /* we reached the global traffic limit */
++ if (con->conf.global_kbytes_per_second) {
++ off_t limit = con->conf.global_kbytes_per_second * 1024 - *(con->conf.global_bytes_per_second_cnt_ptr);
++ if (limit <= 0) {
++ /* we reached the global traffic limit */
+
+- con->traffic_limit_reached = 1;
+- joblist_append(srv, con);
++ con->traffic_limit_reached = 1;
++ joblist_append(srv, con);
+
+- return 1;
++ return 1;
++ } else {
++ if (max_bytes > limit) max_bytes = limit;
++ }
+ }
+
++ if (con->conf.kbytes_per_second) {
++ off_t limit = con->conf.kbytes_per_second * 1024 - con->bytes_written_cur_second;
++ if (limit <= 0) {
++ /* we reached the traffic limit */
++
++ con->traffic_limit_reached = 1;
++ joblist_append(srv, con);
++
++ return 1;
++ } else {
++ if (max_bytes > limit) max_bytes = limit;
++ }
++ }
++
+ written = cq->bytes_out;
+
+ #ifdef TCP_CORK
+@@ -879,10 +924,10 @@
+
+ if (srv_socket->is_ssl) {
+ #ifdef USE_OPENSSL
+- ret = srv->network_ssl_backend_write(srv, con, con->ssl, cq);
++ ret = srv->network_ssl_backend_write(srv, con, con->ssl, cq, max_bytes);
+ #endif
+ } else {
+- ret = srv->network_backend_write(srv, con, con->fd, cq);
++ ret = srv->network_backend_write(srv, con, con->fd, cq, max_bytes);
+ }
+
+ if (ret >= 0) {
+@@ -903,12 +948,5 @@
+
+ *(con->conf.global_bytes_per_second_cnt_ptr) += written;
+
+- if (con->conf.kbytes_per_second &&
+- (con->bytes_written_cur_second > con->conf.kbytes_per_second * 1024)) {
+- /* we reached the traffic limit */
+-
+- con->traffic_limit_reached = 1;
+- joblist_append(srv, con);
+- }
+ return ret;
+ }
+Index: src/network.h
+===================================================================
+--- src/network.h (.../tags/lighttpd-1.4.29)
++++ src/network.h (.../branches/lighttpd-1.4.x)
+@@ -3,7 +3,7 @@
+
+ #include "server.h"
+
+-int network_write_chunkqueue(server *srv, connection *con, chunkqueue *c);
++int network_write_chunkqueue(server *srv, connection *con, chunkqueue *c, off_t max_bytes);
+
+ int network_init(server *srv);
+ int network_close(server *srv);
Index: src/configfile.c
===================================================================
---- src/configfile.c (.../tags/lighttpd-1.4.15) (revision 1878)
-+++ src/configfile.c (.../branches/lighttpd-1.4.x) (revision 1878)
-@@ -89,7 +89,9 @@
- { "server.core-files", NULL, T_CONFIG_BOOLEAN, T_CONFIG_SCOPE_CONNECTION }, /* 45 */
- { "ssl.cipher-list", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_SERVER }, /* 46 */
- { "ssl.use-sslv2", NULL, T_CONFIG_BOOLEAN, T_CONFIG_SCOPE_CONNECTION }, /* 47 */
--
-+ { "etag.use-inode", NULL, T_CONFIG_BOOLEAN, T_CONFIG_SCOPE_SERVER }, /* 48 */
-+ { "etag.use-mtime", NULL, T_CONFIG_BOOLEAN, T_CONFIG_SCOPE_SERVER }, /* 49 */
-+ { "etag.use-size", NULL, T_CONFIG_BOOLEAN, T_CONFIG_SCOPE_SERVER }, /* 50 */
+--- src/configfile.c (.../tags/lighttpd-1.4.29)
++++ src/configfile.c (.../branches/lighttpd-1.4.x)
+@@ -105,6 +105,8 @@
+ { "ssl.use-sslv3", NULL, T_CONFIG_BOOLEAN, T_CONFIG_SCOPE_SERVER }, /* 62 */
+ { "ssl.dh-file", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_SERVER }, /* 63 */
+ { "ssl.ec-curve", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_SERVER }, /* 64 */
++ { "ssl.disable-client-renegotiation", NULL, T_CONFIG_BOOLEAN, T_CONFIG_SCOPE_SERVER },/* 65 */
++ { "ssl.honor-cipher-order", NULL, T_CONFIG_BOOLEAN, T_CONFIG_SCOPE_SERVER }, /* 66 */
+
{ "server.host", "use server.bind instead", T_CONFIG_DEPRECATED, T_CONFIG_SCOPE_UNSET },
{ "server.docroot", "use server.document-root instead", T_CONFIG_DEPRECATED, T_CONFIG_SCOPE_UNSET },
- { "server.virtual-root", "load mod_simple_vhost and use simple-vhost.server-root instead", T_CONFIG_DEPRECATED, T_CONFIG_SCOPE_UNSET },
-@@ -162,6 +164,9 @@
- #endif
- s->kbytes_per_second = 0;
- s->allow_http11 = 1;
-+ s->etag_use_inode = 1;
-+ s->etag_use_mtime = 1;
-+ s->etag_use_size = 1;
- s->range_requests = 1;
- s->force_lowercase_filenames = 0;
- s->global_kbytes_per_second = 0;
-@@ -206,6 +211,9 @@
-
- cv[46].destination = s->ssl_cipher_list;
- cv[47].destination = &(s->ssl_use_sslv2);
-+ cv[48].destination = &(s->etag_use_inode);
-+ cv[49].destination = &(s->etag_use_mtime);
-+ cv[50].destination = &(s->etag_use_size);
+@@ -176,6 +178,7 @@
+ s->max_write_idle = 360;
+ s->use_xattr = 0;
+ s->is_ssl = 0;
++ s->ssl_honor_cipher_order = 1;
+ s->ssl_use_sslv2 = 0;
+ s->ssl_use_sslv3 = 1;
+ s->use_ipv6 = 0;
+@@ -199,6 +202,7 @@
+ s->ssl_verifyclient_username = buffer_init();
+ s->ssl_verifyclient_depth = 9;
+ s->ssl_verifyclient_export_cert = 0;
++ s->ssl_disable_client_renegotiation = 1;
+
+ cv[2].destination = s->errorfile_prefix;
+
+@@ -245,6 +249,8 @@
+ cv[62].destination = &(s->ssl_use_sslv3);
+ cv[63].destination = s->ssl_dh_file;
+ cv[64].destination = s->ssl_ec_curve;
++ cv[66].destination = &(s->ssl_honor_cipher_order);
++
+ cv[49].destination = &(s->etag_use_inode);
+ cv[50].destination = &(s->etag_use_mtime);
+ cv[51].destination = &(s->etag_use_size);
+@@ -255,6 +261,7 @@
+ cv[58].destination = &(s->ssl_verifyclient_depth);
+ cv[59].destination = s->ssl_verifyclient_username;
+ cv[60].destination = &(s->ssl_verifyclient_export_cert);
++ cv[65].destination = &(s->ssl_disable_client_renegotiation);
srv->config_storage[i] = s;
-@@ -280,8 +288,10 @@
- PATCH(ssl_ca_file);
+@@ -335,6 +342,7 @@
PATCH(ssl_cipher_list);
+ PATCH(ssl_dh_file);
+ PATCH(ssl_ec_curve);
++ PATCH(ssl_honor_cipher_order);
PATCH(ssl_use_sslv2);
--
--
-+ PATCH(etag_use_inode);
-+ PATCH(etag_use_mtime);
-+ PATCH(etag_use_size);
-+
- return 0;
- }
-
-@@ -323,6 +333,12 @@
- PATCH(max_read_idle);
- } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("mimetype.use-xattr"))) {
- PATCH(use_xattr);
-+ } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("etag.use-inode"))) {
-+ PATCH(etag_use_inode);
-+ } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("etag.use-mtime"))) {
-+ PATCH(etag_use_mtime);
-+ } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("etag.use-size"))) {
-+ PATCH(etag_use_size);
- } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("ssl.pemfile"))) {
- PATCH(ssl_pemfile);
- } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("ssl.ca-file"))) {
-Index: src/etag.c
-===================================================================
---- src/etag.c (.../tags/lighttpd-1.4.15) (revision 1878)
-+++ src/etag.c (.../branches/lighttpd-1.4.x) (revision 1878)
-@@ -8,12 +8,22 @@
- return 0;
- }
-
--int etag_create(buffer *etag, struct stat *st) {
-- buffer_copy_off_t(etag, st->st_ino);
-- buffer_append_string_len(etag, CONST_STR_LEN("-"));
-- buffer_append_off_t(etag, st->st_size);
-- buffer_append_string_len(etag, CONST_STR_LEN("-"));
-- buffer_append_long(etag, st->st_mtime);
-+int etag_create(buffer *etag, struct stat *st,etag_flags_t flags) {
-+ if (0 == flags) return 0;
-+
-+ if (flags & ETAG_USE_INODE) {
-+ buffer_copy_off_t(etag, st->st_ino);
-+ buffer_append_string_len(etag, CONST_STR_LEN("-"));
-+ }
-+
-+ if (flags & ETAG_USE_SIZE) {
-+ buffer_append_off_t(etag, st->st_size);
-+ buffer_append_string_len(etag, CONST_STR_LEN("-"));
-+ }
-+
-+ if (flags & ETAG_USE_MTIME) {
-+ buffer_append_long(etag, st->st_mtime);
-+ }
+ PATCH(ssl_use_sslv3);
+ PATCH(etag_use_inode);
+@@ -346,6 +354,7 @@
+ PATCH(ssl_verifyclient_depth);
+ PATCH(ssl_verifyclient_username);
+ PATCH(ssl_verifyclient_export_cert);
++ PATCH(ssl_disable_client_renegotiation);
return 0;
}
+@@ -400,6 +409,8 @@
+ #endif
+ } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("ssl.ca-file"))) {
+ PATCH(ssl_ca_file);
++ } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("ssl.honor-cipher-order"))) {
++ PATCH(ssl_honor_cipher_order);
+ } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("ssl.use-sslv2"))) {
+ PATCH(ssl_use_sslv2);
+ } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("ssl.use-sslv3"))) {
+@@ -454,6 +465,8 @@
+ PATCH(ssl_verifyclient_username);
+ } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("ssl.verifyclient.exportcert"))) {
+ PATCH(ssl_verifyclient_export_cert);
++ } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("ssl.disable-client-renegotiation"))) {
++ PATCH(ssl_disable_client_renegotiation);
+ }
+ }
+ }
Index: src/mod_scgi.c
===================================================================
---- src/mod_scgi.c (.../tags/lighttpd-1.4.15) (revision 1878)
-+++ src/mod_scgi.c (.../branches/lighttpd-1.4.x) (revision 1878)
-@@ -803,7 +803,7 @@
- buffer_append_string_buffer(b, host->bin_path);
-
- /* exec the cgi */
-- execle("/bin/sh", "sh", "-c", b->ptr, NULL, env.ptr);
-+ execle("/bin/sh", "sh", "-c", b->ptr, (char *)NULL, env.ptr);
-
- log_error_write(srv, __FILE__, __LINE__, "sbs",
- "execl failed for:", host->bin_path, strerror(errno));
-Index: src/etag.h
-===================================================================
---- src/etag.h (.../tags/lighttpd-1.4.15) (revision 1878)
-+++ src/etag.h (.../branches/lighttpd-1.4.x) (revision 1878)
-@@ -7,8 +7,10 @@
-
- #include "buffer.h"
+--- src/mod_scgi.c (.../tags/lighttpd-1.4.29)
++++ src/mod_scgi.c (.../branches/lighttpd-1.4.x)
+@@ -2296,7 +2296,7 @@
-+typedef enum { ETAG_USE_INODE = 1, ETAG_USE_MTIME = 2, ETAG_USE_SIZE = 4 } etag_flags_t;
-+
- int etag_is_equal(buffer *etag, const char *matches);
--int etag_create(buffer *etag, struct stat *st);
-+int etag_create(buffer *etag, struct stat *st, etag_flags_t flags);
- int etag_mutate(buffer *mut, buffer *etag);
+ /* fall through */
+ case FCGI_STATE_WRITE:
+- ret = srv->network_backend_write(srv, con, hctx->fd, hctx->wb);
++ ret = srv->network_backend_write(srv, con, hctx->fd, hctx->wb, MAX_WRITE_LIMIT);
+ chunkqueue_remove_finished_chunks(hctx->wb);
Index: src/request.c
===================================================================
---- src/request.c (.../tags/lighttpd-1.4.15) (revision 1878)
-+++ src/request.c (.../branches/lighttpd-1.4.x) (revision 1878)
-@@ -284,8 +284,6 @@
-
- int done = 0;
-
-- data_string *ds = NULL;
--
- /*
- * Request: "^(GET|POST|HEAD) ([^ ]+(\\?[^ ]+|)) (HTTP/1\\.[01])$"
- * Option : "^([-a-zA-Z]+): (.+)$"
-@@ -715,12 +713,24 @@
- switch(*cur) {
- case '\r':
- if (con->parse_request->ptr[i+1] == '\n') {
-+ data_string *ds = NULL;
-+
- /* End of Headerline */
- con->parse_request->ptr[i] = '\0';
- con->parse_request->ptr[i+1] = '\0';
-
- if (in_folding) {
-- if (!ds) {
-+ buffer *key_b;
-+ /**
-+ * we use a evil hack to handle the line-folding
-+ *
-+ * As array_insert_unique() deletes 'ds' in the case of a duplicate
-+ * ds points somewhere and we get a evil crash. As a solution we keep the old
-+ * "key" and get the current value from the hash and append us
-+ *
-+ * */
-+
-+ if (!key || !key_len) {
- /* 400 */
-
- if (srv->srvconf.log_request_header_on_error) {
-@@ -737,7 +747,15 @@
- con->response.keep_alive = 0;
- return 0;
- }
-- buffer_append_string(ds->value, value);
-+
-+ key_b = buffer_init();
-+ buffer_copy_string_len(key_b, key, key_len);
-+
-+ if (NULL != (ds = (data_string *)array_get_element(con->request.headers, key_b->ptr))) {
-+ buffer_append_string(ds->value, value);
-+ }
-+
-+ buffer_free(key_b);
- } else {
- int s_len;
- key = con->parse_request->ptr + first;
-@@ -969,7 +987,12 @@
- first = i+1;
- is_key = 1;
- value = 0;
-- key_len = 0;
-+#if 0
-+ /**
-+ * for Bug 1230 keep the key_len a live
-+ */
-+ key_len = 0;
-+#endif
- in_folding = 0;
- } else {
- if (srv->srvconf.log_request_header_on_error) {
-Index: src/stat_cache.c
-===================================================================
---- src/stat_cache.c (.../tags/lighttpd-1.4.15) (revision 1878)
-+++ src/stat_cache.c (.../branches/lighttpd-1.4.x) (revision 1878)
-@@ -608,14 +608,16 @@
- break;
+--- src/request.c (.../tags/lighttpd-1.4.29)
++++ src/request.c (.../branches/lighttpd-1.4.x)
+@@ -49,7 +49,7 @@
+ if (++colon_cnt > 7) {
+ return -1;
+ }
+- } else if (!light_isxdigit(*c)) {
++ } else if (!light_isxdigit(*c) && '.' != *c) {
+ return -1;
}
}
-- etag_create(sce->etag, &(sce->st));
-+ etag_create(sce->etag, &(sce->st),
-+ (con->conf.etag_use_mtime ? ETAG_USE_MTIME : 0) | (con->conf.etag_use_inode ? ETAG_USE_INODE : 0) | (con->conf.etag_use_size ? ETAG_USE_SIZE : 0));
- #ifdef HAVE_XATTR
-- if (buffer_is_empty(sce->content_type)) {
-+ if (con->conf.use_xattr && buffer_is_empty(sce->content_type)) {
- stat_cache_attr_get(sce->content_type, name->ptr);
- }
+Index: src/network_backends.h
+===================================================================
+--- src/network_backends.h (.../tags/lighttpd-1.4.29)
++++ src/network_backends.h (.../branches/lighttpd-1.4.x)
+@@ -47,18 +47,18 @@
+ #include "base.h"
+
+ /* return values:
+- * >= 0 : chunks completed
++ * >= 0 : no error
+ * -1 : error (on our side)
+ * -2 : remote close
+ */
+
+-int network_write_chunkqueue_write(server *srv, connection *con, int fd, chunkqueue *cq);
+-int network_write_chunkqueue_writev(server *srv, connection *con, int fd, chunkqueue *cq);
+-int network_write_chunkqueue_linuxsendfile(server *srv, connection *con, int fd, chunkqueue *cq);
+-int network_write_chunkqueue_freebsdsendfile(server *srv, connection *con, int fd, chunkqueue *cq);
+-int network_write_chunkqueue_solarissendfilev(server *srv, connection *con, int fd, chunkqueue *cq);
++int network_write_chunkqueue_write(server *srv, connection *con, int fd, chunkqueue *cq, off_t max_bytes);
++int network_write_chunkqueue_writev(server *srv, connection *con, int fd, chunkqueue *cq, off_t max_bytes);
++int network_write_chunkqueue_linuxsendfile(server *srv, connection *con, int fd, chunkqueue *cq, off_t max_bytes);
++int network_write_chunkqueue_freebsdsendfile(server *srv, connection *con, int fd, chunkqueue *cq, off_t max_bytes);
++int network_write_chunkqueue_solarissendfilev(server *srv, connection *con, int fd, chunkqueue *cq, off_t max_bytes);
+ #ifdef USE_OPENSSL
+-int network_write_chunkqueue_openssl(server *srv, connection *con, SSL *ssl, chunkqueue *cq);
++int network_write_chunkqueue_openssl(server *srv, connection *con, SSL *ssl, chunkqueue *cq, off_t max_bytes);
#endif
- } else if (S_ISDIR(st.st_mode)) {
-- etag_create(sce->etag, &(sce->st));
-+ etag_create(sce->etag, &(sce->st),
-+ (con->conf.etag_use_mtime ? ETAG_USE_MTIME : 0) | (con->conf.etag_use_inode ? ETAG_USE_INODE : 0) | (con->conf.etag_use_size ? ETAG_USE_SIZE : 0));
- }
- #ifdef HAVE_FAM_H
-Index: src/http_auth.c
+ #endif
+Index: src/SConscript
===================================================================
---- src/http_auth.c (.../tags/lighttpd-1.4.15) (revision 1878)
-+++ src/http_auth.c (.../branches/lighttpd-1.4.x) (revision 1878)
-@@ -830,8 +830,14 @@
-
- username = buffer_init();
-
-- base64_decode(username, realm_str);
-+ if (!base64_decode(username, realm_str)) {
-+ buffer_free(username);
-
-+ log_error_write(srv, __FILE__, __LINE__, "sb", "decodeing base64-string failed", username);
-+
-+ return 0;
-+ }
-+
- /* r2 == user:password */
- if (NULL == (pw = strchr(username->ptr, ':'))) {
- buffer_free(username);
-@@ -967,7 +973,7 @@
- for (c = b->ptr; *c; c++) {
- /* skip whitespaces */
- while (*c == ' ' || *c == '\t') c++;
-- if (!c) break;
-+ if (!*c) break;
-
- for (i = 0; dkv[i].key; i++) {
- if ((0 == strncmp(c, dkv[i].key, dkv[i].key_len))) {
-@@ -1016,9 +1022,24 @@
-
- log_error_write(srv, __FILE__, __LINE__, "s",
- "digest: missing field");
-+
-+ buffer_free(b);
- return -1;
+--- src/SConscript (.../tags/lighttpd-1.4.29)
++++ src/SConscript (.../branches/lighttpd-1.4.x)
+@@ -12,7 +12,8 @@
+ data_integer.c md5.c data_fastcgi.c \
+ fdevent_select.c fdevent_libev.c \
+ fdevent_poll.c fdevent_linux_sysepoll.c \
+- fdevent_solaris_devpoll.c fdevent_freebsd_kqueue.c \
++ fdevent_solaris_devpoll.c fdevent_solaris_port.c \
++ fdevent_freebsd_kqueue.c \
+ data_config.c bitset.c \
+ inet_ntop_cache.c crc32.c \
+ connections-glue.c \
+@@ -62,7 +63,7 @@
+ 'mod_redirect' : { 'src' : [ 'mod_redirect.c' ], 'lib' : [ env['LIBPCRE'] ] },
+ 'mod_rewrite' : { 'src' : [ 'mod_rewrite.c' ], 'lib' : [ env['LIBPCRE'] ] },
+ 'mod_auth' : {
+- 'src' : [ 'mod_auth.c', 'http_auth_digest.c', 'http_auth.c' ],
++ 'src' : [ 'mod_auth.c', 'http_auth.c' ],
+ 'lib' : [ env['LIBCRYPT'], env['LIBLDAP'], env['LIBLBER'] ] },
+ 'mod_webdav' : { 'src' : [ 'mod_webdav.c' ], 'lib' : [ env['LIBXML2'], env['LIBSQLITE3'], env['LIBUUID'] ] },
+ 'mod_mysql_vhost' : { 'src' : [ 'mod_mysql_vhost.c' ], 'lib' : [ env['LIBMYSQL'] ] },
+Index: src/mod_cml_funcs.c
+===================================================================
+--- src/mod_cml_funcs.c (.../tags/lighttpd-1.4.29)
++++ src/mod_cml_funcs.c (.../branches/lighttpd-1.4.x)
+@@ -17,18 +17,8 @@
+ #include <dirent.h>
+ #include <stdio.h>
+
+-#ifdef USE_OPENSSL
+-# include <openssl/md5.h>
+-#else
+-# include "md5.h"
++#include "md5.h"
+
+-typedef li_MD5_CTX MD5_CTX;
+-#define MD5_Init li_MD5_Init
+-#define MD5_Update li_MD5_Update
+-#define MD5_Final li_MD5_Final
+-
+-#endif
+-
+ #define HASHLEN 16
+ typedef unsigned char HASH[HASHLEN];
+ #define HASHHEXLEN 32
+@@ -43,7 +33,7 @@
+ #ifdef HAVE_LUA_H
+
+ int f_crypto_md5(lua_State *L) {
+- MD5_CTX Md5Ctx;
++ li_MD5_CTX Md5Ctx;
+ HASH HA1;
+ buffer b;
+ char hex[33];
+@@ -63,9 +53,9 @@
+ lua_error(L);
}
-+ /**
-+ * protect the md5-sess against missing cnonce and nonce
-+ */
-+ if (algorithm &&
-+ 0 == strcasecmp(algorithm, "md5-sess") &&
-+ (!nonce || !cnonce)) {
-+ log_error_write(srv, __FILE__, __LINE__, "s",
-+ "digest: (md5-sess: missing field");
-+
-+ buffer_free(b);
-+ return -1;
-+ }
-+
- m = get_http_method_name(con->request.http_method);
+- MD5_Init(&Md5Ctx);
+- MD5_Update(&Md5Ctx, (unsigned char *)lua_tostring(L, 1), lua_strlen(L, 1));
+- MD5_Final(HA1, &Md5Ctx);
++ li_MD5_Init(&Md5Ctx);
++ li_MD5_Update(&Md5Ctx, (unsigned char *)lua_tostring(L, 1), lua_strlen(L, 1));
++ li_MD5_Final(HA1, &Md5Ctx);
- /* password-string == HA1 */
-Index: src/mod_status.c
+ buffer_copy_string_hex(&b, (char *)HA1, 16);
+
+Index: src/mod_userdir.c
===================================================================
---- src/mod_status.c (.../tags/lighttpd-1.4.15) (revision 1878)
-+++ src/mod_status.c (.../branches/lighttpd-1.4.x) (revision 1878)
-@@ -220,6 +220,7 @@
- BUFFER_APPEND_STRING_CONST(b,
- " <style type=\"text/css\">\n"
- " table.status { border: black solid thin; }\n"
-+ " td { white-space: nowrap; }\n"
- " td.int { background-color: #f0f0f0; text-align: right }\n"
- " td.string { background-color: #f0f0f0; text-align: left }\n"
- " th.status { background-color: black; color: white; font-weight: bold; }\n"
-@@ -520,6 +521,16 @@
- buffer_append_string_encoded(b, CONST_BUF_LEN(c->uri.path), ENCODING_HTML);
- }
+--- src/mod_userdir.c (.../tags/lighttpd-1.4.29)
++++ src/mod_userdir.c (.../branches/lighttpd-1.4.x)
+@@ -166,7 +166,6 @@
-+ if (!buffer_is_empty(c->uri.query)) {
-+ BUFFER_APPEND_STRING_CONST(b, "?");
-+ buffer_append_string_encoded(b, CONST_BUF_LEN(c->uri.query), ENCODING_HTML);
-+ }
-+
-+ if (!buffer_is_empty(c->request.orig_uri)) {
-+ BUFFER_APPEND_STRING_CONST(b, " (");
-+ buffer_append_string_encoded(b, CONST_BUF_LEN(c->request.orig_uri), ENCODING_HTML);
-+ BUFFER_APPEND_STRING_CONST(b, ")");
-+ }
- BUFFER_APPEND_STRING_CONST(b, "</td><td class=\"string\">");
+ URIHANDLER_FUNC(mod_userdir_docroot_handler) {
+ plugin_data *p = p_d;
+- int uri_len;
+ size_t k;
+ char *rel_url;
+ #ifdef HAVE_PWD_H
+@@ -182,8 +181,6 @@
+ */
+ if (p->conf.path->used == 0) return HANDLER_GO_ON;
- buffer_append_string_buffer(b, c->physical.path);
-Index: src/mod_ssi.c
+- uri_len = con->uri.path->used - 1;
+-
+ /* /~user/foo.html -> /home/user/public_html/foo.html */
+
+ if (con->uri.path->ptr[0] != '/' ||
+Index: src/mod_proxy.c
===================================================================
---- src/mod_ssi.c (.../tags/lighttpd-1.4.15) (revision 1878)
-+++ src/mod_ssi.c (.../branches/lighttpd-1.4.x) (revision 1878)
-@@ -702,7 +702,7 @@
- /* close stdin */
- close(STDIN_FILENO);
+--- src/mod_proxy.c (.../tags/lighttpd-1.4.29)
++++ src/mod_proxy.c (.../branches/lighttpd-1.4.x)
+@@ -825,7 +825,7 @@
-- execl("/bin/sh", "sh", "-c", cmd, NULL);
-+ execl("/bin/sh", "sh", "-c", cmd, (char *)NULL);
+ /* fall through */
+ case PROXY_STATE_WRITE:;
+- ret = srv->network_backend_write(srv, con, hctx->fd, hctx->wb);
++ ret = srv->network_backend_write(srv, con, hctx->fd, hctx->wb, MAX_WRITE_LIMIT);
- log_error_write(srv, __FILE__, __LINE__, "sss", "spawing exec failed:", strerror(errno), cmd);
+ chunkqueue_remove_finished_chunks(hctx->wb);
-Index: src/spawn-fcgi.c
+Index: src/Makefile.am
+===================================================================
+--- src/Makefile.am (.../tags/lighttpd-1.4.29)
++++ src/Makefile.am (.../branches/lighttpd-1.4.x)
+@@ -241,7 +241,7 @@
+ mod_compress_la_LIBADD = $(Z_LIB) $(BZ_LIB) $(common_libadd)
+
+ lib_LTLIBRARIES += mod_auth.la
+-mod_auth_la_SOURCES = mod_auth.c http_auth_digest.c http_auth.c
++mod_auth_la_SOURCES = mod_auth.c http_auth.c
+ mod_auth_la_LDFLAGS = -module -export-dynamic -avoid-version -no-undefined
+ mod_auth_la_LIBADD = $(CRYPT_LIB) $(LDAP_LIB) $(LBER_LIB) $(common_libadd)
+
+@@ -268,7 +268,7 @@
+
+ hdr = server.h buffer.h network.h log.h keyvalue.h \
+ response.h request.h fastcgi.h chunk.h \
+- settings.h http_chunk.h http_auth_digest.h \
++ settings.h http_chunk.h \
+ md5.h http_auth.h stream.h \
+ fdevent.h connections.h base.h stat_cache.h \
+ plugin.h mod_auth.h \
+Index: src/network_writev.c
===================================================================
---- src/spawn-fcgi.c (.../tags/lighttpd-1.4.15) (revision 1878)
-+++ src/spawn-fcgi.c (.../branches/lighttpd-1.4.x) (revision 1878)
-@@ -169,7 +169,7 @@
- strcat(b, appPath);
+--- src/network_writev.c (.../tags/lighttpd-1.4.29)
++++ src/network_writev.c (.../branches/lighttpd-1.4.x)
+@@ -30,17 +30,16 @@
+ #define LOCAL_BUFFERING 1
+ #endif
- /* exec the cgi */
-- execl("/bin/sh", "sh", "-c", b, NULL);
-+ execl("/bin/sh", "sh", "-c", b, (char *)NULL);
+-int network_write_chunkqueue_writev(server *srv, connection *con, int fd, chunkqueue *cq) {
++int network_write_chunkqueue_writev(server *srv, connection *con, int fd, chunkqueue *cq, off_t max_bytes) {
+ chunk *c;
+- size_t chunks_written = 0;
+
+- for(c = cq->first; c; c = c->next) {
++ for(c = cq->first; (max_bytes > 0) && (NULL != c); c = c->next) {
+ int chunk_finished = 0;
+
+ switch(c->type) {
+ case MEM_CHUNK: {
+ char * offset;
+- size_t toSend;
++ off_t toSend;
+ ssize_t r;
+
+ size_t num_chunks, i;
+@@ -65,12 +64,10 @@
+ #error "sysconf() doesnt return _SC_IOV_MAX ..., check the output of 'man writev' for the EINVAL error and send the output to jan@kneschke.de"
+ #endif
- exit(errno);
+- /* we can't send more then SSIZE_MAX bytes in one chunk */
+-
+ /* build writev list
+ *
+ * 1. limit: num_chunks < max_chunks
+- * 2. limit: num_bytes < SSIZE_MAX
++ * 2. limit: num_bytes < max_bytes
+ */
+ for (num_chunks = 0, tc = c; tc && tc->type == MEM_CHUNK && num_chunks < max_chunks; num_chunks++, tc = tc->next);
+
+@@ -87,9 +84,9 @@
+ chunks[i].iov_base = offset;
+
+ /* protect the return value of writev() */
+- if (toSend > SSIZE_MAX ||
+- num_bytes + toSend > SSIZE_MAX) {
+- chunks[i].iov_len = SSIZE_MAX - num_bytes;
++ if (toSend > max_bytes ||
++ (off_t) num_bytes + toSend > max_bytes) {
++ chunks[i].iov_len = max_bytes - num_bytes;
+
+ num_chunks = i + 1;
+ break;
+@@ -121,6 +118,7 @@
+ }
-Index: src/mod_fastcgi.c
-===================================================================
---- src/mod_fastcgi.c (.../tags/lighttpd-1.4.15) (revision 1878)
-+++ src/mod_fastcgi.c (.../branches/lighttpd-1.4.x) (revision 1878)
-@@ -69,7 +69,7 @@
- buffer *unixsocket; /* config.socket + "-" + id */
- unsigned port; /* config.port + pno */
-
-- buffer *connection_name; /* either tcp:<host>:<port> or unix:<socket> for debuggin purposes */
-+ buffer *connection_name; /* either tcp:<host>:<port> or unix:<socket> for debugging purposes */
-
- pid_t pid; /* PID of the spawned process (0 if not spawned locally) */
-
-@@ -80,7 +80,7 @@
- size_t requests; /* see max_requests */
- struct fcgi_proc *prev, *next; /* see first */
-
-- time_t disabled_until; /* this proc is disabled until, use something else until than */
-+ time_t disabled_until; /* this proc is disabled until, use something else until then */
-
- int is_local;
-
-@@ -88,7 +88,7 @@
- PROC_STATE_UNSET, /* init-phase */
- PROC_STATE_RUNNING, /* alive */
- PROC_STATE_OVERLOADED, /* listen-queue is full,
-- don't send something to this proc for the next 2 seconds */
-+ don't send anything to this proc for the next 2 seconds */
- PROC_STATE_DIED_WAIT_FOR_PID, /* */
- PROC_STATE_DIED, /* marked as dead, should be restarted */
- PROC_STATE_KILLED /* was killed as we don't have the load anymore */
-@@ -145,7 +145,7 @@
- unsigned short disable_time;
-
- /*
-- * same fastcgi processes get a little bit larger
-+ * some fastcgi processes get a little bit larger
- * than wanted. max_requests_per_proc kills a
- * process after a number of handled requests.
- *
-@@ -184,7 +184,7 @@
- * bin-path is the path to the binary
- *
- * check min_procs and max_procs for the number
-- * of process to start-up
-+ * of process to start up
- */
- buffer *bin_path;
-
-@@ -217,7 +217,7 @@
- unsigned short mode;
-
- /*
-- * check_local tell you if the phys file is stat()ed
-+ * check_local tells you if the phys file is stat()ed
- * or not. FastCGI doesn't care if the service is
- * remote. If the web-server side doesn't contain
- * the fastcgi-files we should not stat() for them
-@@ -228,7 +228,7 @@
- /*
- * append PATH_INFO to SCRIPT_FILENAME
- *
-- * php needs this if cgi.fix_pathinfo is provied
-+ * php needs this if cgi.fix_pathinfo is provided
- *
- */
+ cq->bytes_out += r;
++ max_bytes -= r;
-@@ -247,7 +247,7 @@
- num_procs.
+ /* check which chunks have been written */
- only if a process is killed max_id waits for the process itself
-- to die and decrements its afterwards */
-+ to die and decrements it afterwards */
+@@ -132,11 +130,10 @@
- buffer *strip_request_uri;
+ if (chunk_finished) {
+ /* skip the chunks from further touches */
+- chunks_written++;
+ c = c->next;
+ } else {
+ /* chunks_written + c = c->next is done in the for()*/
+- chunk_finished++;
++ chunk_finished = 1;
+ }
+ } else {
+ /* partially written */
+@@ -284,6 +281,8 @@
+ assert(toSend < 0);
+ }
-@@ -826,7 +826,7 @@
- } else {
- struct hostent *he;
++ if (toSend > max_bytes) toSend = max_bytes;
++
+ #ifdef LOCAL_BUFFERING
+ start = c->mem->ptr;
+ #else
+@@ -309,6 +308,7 @@
-- /* set a usefull default */
-+ /* set a useful default */
- fcgi_addr_in.sin_addr.s_addr = htonl(INADDR_ANY);
+ c->offset += r;
+ cq->bytes_out += r;
++ max_bytes -= r;
+ if (c->offset == c->file.length) {
+ chunk_finished = 1;
+@@ -334,11 +334,9 @@
-@@ -869,7 +869,7 @@
+ break;
+ }
+-
+- chunks_written++;
}
- if (-1 == connect(fcgi_fd, fcgi_addr, servlen)) {
-- /* server is not up, spawn in */
-+ /* server is not up, spawn it */
- pid_t child;
- int val;
-
-@@ -1029,10 +1029,11 @@
- "child exited with status",
- WEXITSTATUS(status), host->bin_path);
- log_error_write(srv, __FILE__, __LINE__, "s",
-- "if you try do run PHP as FastCGI backend make sure you use the FastCGI enabled version.\n"
-+ "If you're trying to run PHP as a FastCGI backend, make sure you're using the FastCGI-enabled version.\n"
- "You can find out if it is the right one by executing 'php -v' and it should display '(cgi-fcgi)' "
-- "in the output, NOT (cgi) NOR (cli)\n"
-- "For more information check http://www.lighttpd.net/documentation/fastcgi.html#preparing-php-as-a-fastcgi-program");
-+ "in the output, NOT '(cgi)' NOR '(cli)'.\n"
-+ "For more information, check http://trac.lighttpd.net/trac/wiki/Docs%3AModFastCGI#preparing-php-as-a-fastcgi-program"
-+ "If this is PHP on Gentoo, add 'fastcgi' to the USE flags.");
- } else if (WIFSIGNALED(status)) {
- log_error_write(srv, __FILE__, __LINE__, "sd",
- "terminated by signal:",
-@@ -1040,9 +1041,9 @@
-
- if (WTERMSIG(status) == 11) {
- log_error_write(srv, __FILE__, __LINE__, "s",
-- "to be exact: it seg-fault, crashed, died, ... you get the idea." );
-+ "to be exact: it segfaulted, crashed, died, ... you get the idea." );
- log_error_write(srv, __FILE__, __LINE__, "s",
-- "If this is PHP try to remove the byte-code caches for now and try again.");
-+ "If this is PHP, try removing the bytecode caches for now and try again.");
+- return chunks_written;
++ return 0;
+ }
+
+ #endif
+Index: src/network_freebsd_sendfile.c
+===================================================================
+--- src/network_freebsd_sendfile.c (.../tags/lighttpd-1.4.29)
++++ src/network_freebsd_sendfile.c (.../branches/lighttpd-1.4.x)
+@@ -31,17 +31,16 @@
+ # endif
+ #endif
+
+-int network_write_chunkqueue_freebsdsendfile(server *srv, connection *con, int fd, chunkqueue *cq) {
++int network_write_chunkqueue_freebsdsendfile(server *srv, connection *con, int fd, chunkqueue *cq, off_t max_bytes) {
+ chunk *c;
+- size_t chunks_written = 0;
+
+- for(c = cq->first; c; c = c->next, chunks_written++) {
++ for(c = cq->first; (max_bytes > 0) && (NULL != c); c = c->next) {
+ int chunk_finished = 0;
+
+ switch(c->type) {
+ case MEM_CHUNK: {
+ char * offset;
+- size_t toSend;
++ off_t toSend;
+ ssize_t r;
+
+ size_t num_chunks, i;
+@@ -49,12 +48,10 @@
+ chunk *tc;
+ size_t num_bytes = 0;
+
+- /* we can't send more then SSIZE_MAX bytes in one chunk */
+-
+ /* build writev list
+ *
+ * 1. limit: num_chunks < UIO_MAXIOV
+- * 2. limit: num_bytes < SSIZE_MAX
++ * 2. limit: num_bytes < max_bytes
+ */
+ for(num_chunks = 0, tc = c; tc && tc->type == MEM_CHUNK && num_chunks < UIO_MAXIOV; num_chunks++, tc = tc->next);
+
+@@ -69,9 +66,9 @@
+ chunks[i].iov_base = offset;
+
+ /* protect the return value of writev() */
+- if (toSend > SSIZE_MAX ||
+- num_bytes + toSend > SSIZE_MAX) {
+- chunks[i].iov_len = SSIZE_MAX - num_bytes;
++ if (toSend > max_bytes ||
++ (off_t) num_bytes + toSend > max_bytes) {
++ chunks[i].iov_len = max_bytes - num_bytes;
+
+ num_chunks = i + 1;
+ break;
+@@ -105,6 +102,7 @@
+
+ /* check which chunks have been written */
+ cq->bytes_out += r;
++ max_bytes -= r;
+
+ for(i = 0, tc = c; i < num_chunks; i++, tc = tc->next) {
+ if (r >= (ssize_t)chunks[i].iov_len) {
+@@ -114,11 +112,10 @@
+
+ if (chunk_finished) {
+ /* skip the chunks from further touches */
+- chunks_written++;
+ c = c->next;
+ } else {
+ /* chunks_written + c = c->next is done in the for()*/
+- chunk_finished++;
++ chunk_finished = 1;
}
} else {
- log_error_write(srv, __FILE__, __LINE__, "sd",
-@@ -1066,7 +1067,7 @@
-
- if (p->conf.debug) {
- log_error_write(srv, __FILE__, __LINE__, "sb",
-- "(debug) socket is already used, won't spawn:",
-+ "(debug) socket is already used; won't spawn:",
- proc->connection_name);
+ /* partially written */
+@@ -134,7 +131,7 @@
+ }
+ case FILE_CHUNK: {
+ off_t offset, r;
+- size_t toSend;
++ off_t toSend;
+ stat_cache_entry *sce = NULL;
+
+ if (HANDLER_ERROR == stat_cache_get_entry(srv, con, c->file.name, &sce)) {
+@@ -144,9 +141,8 @@
+ }
+
+ offset = c->file.start + c->offset;
+- /* limit the toSend to 2^31-1 bytes in a chunk */
+- toSend = c->file.length - c->offset > ((1 << 30) - 1) ?
+- ((1 << 30) - 1) : c->file.length - c->offset;
++ toSend = c->file.length - c->offset;
++ if (toSend > max_bytes) toSend = max_bytes;
+
+ if (-1 == c->file.fd) {
+ if (-1 == (c->file.fd = open(c->file.name->ptr, O_RDONLY))) {
+@@ -197,6 +193,7 @@
+
+ c->offset += r;
+ cq->bytes_out += r;
++ max_bytes -= r;
+
+ if (c->offset == c->file.length) {
+ chunk_finished = 1;
+@@ -218,7 +215,7 @@
}
}
-@@ -1508,7 +1509,7 @@
- *
- * next step is resetting this attemp and setup a connection again
- *
-- * if we have more then 5 reconnects for the same request, die
-+ * if we have more than 5 reconnects for the same request, die
- *
- * 2.
+
+- return chunks_written;
++ return 0;
+ }
+
+ #endif
+Index: src/network_openssl.c
+===================================================================
+--- src/network_openssl.c (.../tags/lighttpd-1.4.29)
++++ src/network_openssl.c (.../branches/lighttpd-1.4.x)
+@@ -27,10 +27,9 @@
+ # include <openssl/ssl.h>
+ # include <openssl/err.h>
+
+-int network_write_chunkqueue_openssl(server *srv, connection *con, SSL *ssl, chunkqueue *cq) {
++int network_write_chunkqueue_openssl(server *srv, connection *con, SSL *ssl, chunkqueue *cq, off_t max_bytes) {
+ int ssl_r;
+ chunk *c;
+- size_t chunks_written = 0;
+
+ /* this is a 64k sendbuffer
*
-@@ -1626,7 +1627,7 @@
- CONNECTION_UNSET,
- CONNECTION_OK,
- CONNECTION_DELAYED, /* retry after event, take same host */
-- CONNECTION_OVERLOADED, /* disable for 1 seconds, take another backend */
-+ CONNECTION_OVERLOADED, /* disable for 1 second, take another backend */
- CONNECTION_DEAD /* disable for 60 seconds, take another backend */
- } connection_result_t;
-
-@@ -1669,7 +1670,7 @@
- fcgi_addr_in.sin_family = AF_INET;
- if (0 == inet_aton(host->host->ptr, &(fcgi_addr_in.sin_addr))) {
- log_error_write(srv, __FILE__, __LINE__, "sbs",
-- "converting IP-adress failed for", host->host,
-+ "converting IP address failed for", host->host,
- "\nBe sure to specify an IP address here");
+@@ -59,13 +58,13 @@
+ SSL_set_shutdown(ssl, SSL_RECEIVED_SHUTDOWN);
+ }
- return -1;
-@@ -1694,16 +1695,16 @@
- errno == EINTR) {
- if (hctx->conf.debug > 2) {
- log_error_write(srv, __FILE__, __LINE__, "sb",
-- "connect delayed, will continue later:", proc->connection_name);
-+ "connect delayed; will continue later:", proc->connection_name);
- }
+- for(c = cq->first; c; c = c->next) {
++ for(c = cq->first; (max_bytes > 0) && (NULL != c); c = c->next) {
+ int chunk_finished = 0;
- return CONNECTION_DELAYED;
- } else if (errno == EAGAIN) {
- if (hctx->conf.debug) {
- log_error_write(srv, __FILE__, __LINE__, "sbsd",
-- "This means that the you have more incoming requests than your fastcgi-backend can handle in parallel. "
-- "Perhaps it helps to spawn more fastcgi backend or php-children, if not decrease server.max-connections."
-- "The load for this fastcgi backend", proc->connection_name, "is", proc->load);
-+ "This means that you have more incoming requests than your FastCGI backend can handle in parallel."
-+ "It might help to spawn more FastCGI backends or PHP children; if not, decrease server.max-connections."
-+ "The load for this FastCGI backend", proc->connection_name, "is", proc->load);
- }
+ switch(c->type) {
+ case MEM_CHUNK: {
+ char * offset;
+- size_t toSend;
++ off_t toSend;
+ ssize_t r;
- return CONNECTION_OVERLOADED;
-@@ -1881,8 +1882,6 @@
- fcgi_env_add(p->fcgi_env, CONST_STR_LEN("REMOTE_ADDR"), s, strlen(s));
-
- if (!buffer_is_empty(con->authed_user)) {
-- fcgi_env_add(p->fcgi_env, CONST_STR_LEN("REMOTE_USER"), CONST_BUF_LEN(con->authed_user));
--
- /* AUTH_TYPE fix by Troy Kruthoff (tkruthoff@gmail.com)
- * section 4.1.1 of RFC 3875 (cgi spec) requires the server to set a AUTH_TYPE env
- * declaring the type of authentication used. (see http://tools.ietf.org/html/rfc3875#page-11)
-@@ -1896,6 +1895,8 @@
- char *http_authorization = NULL;
- data_string *ds;
-
-+ fcgi_env_add(p->fcgi_env, CONST_STR_LEN("REMOTE_USER"), CONST_BUF_LEN(con->authed_user));
-+
- if (NULL != (ds = (data_string *)array_get_element(con->request.headers, "Authorization"))) {
- http_authorization = ds->value->ptr;
- }
-@@ -2055,8 +2056,8 @@
- off_t written = 0;
- off_t weHave = 0;
-
-- /* we announce toWrite octects
-- * now take all the request_content chunk that we need to fill this request
-+ /* we announce toWrite octets
-+ * now take all the request_content chunks that we need to fill this request
- * */
-
- b = chunkqueue_get_append_buffer(hctx->wb);
-@@ -2356,7 +2357,7 @@
- }
+ if (c->mem->used == 0 || c->mem->used == 1) {
+@@ -75,6 +74,7 @@
- if (packet->b->used < packet->len + 1) {
-- /* we didn't got the full packet */
-+ /* we didn't get the full packet */
+ offset = c->mem->ptr + c->offset;
+ toSend = c->mem->used - 1 - c->offset;
++ if (toSend > max_bytes) toSend = max_bytes;
- buffer_free(packet->b);
- return -1;
-@@ -2558,7 +2559,7 @@
- if (host->mode != FCGI_AUTHORIZER ||
- !(con->http_status == 0 ||
- con->http_status == 200)) {
-- /* send chunk-end if nesseary */
-+ /* send chunk-end if necessary */
- http_chunk_append_mem(srv, con, NULL, 0);
- joblist_append(srv, con);
- }
-@@ -2653,7 +2654,7 @@
- if (proc->state != PROC_STATE_DIED) break;
-
- case PROC_STATE_DIED:
-- /* local proc get restarted by us,
-+ /* local procs get restarted by us,
- * remote ones hopefully by the admin */
-
- if (proc->is_local) {
-@@ -2774,7 +2775,7 @@
- proc && proc->state != PROC_STATE_RUNNING;
- proc = proc->next);
-
-- /* all childs are dead */
-+ /* all children are dead */
- if (proc == NULL) {
- hctx->fde_ndx = -1;
-
-@@ -2834,7 +2835,7 @@
- * -> EAGAIN */
-
- log_error_write(srv, __FILE__, __LINE__, "ssdsd",
-- "backend is overloaded, we disable it for a 2 seconds and send the request to another backend instead:",
-+ "backend is overloaded; we'll disable it for 2 seconds and send the request to another backend instead:",
- "reconnects:", hctx->reconnects,
- "load:", host->load);
-
-@@ -2864,7 +2865,7 @@
- }
+ /**
+ * SSL_write man-page
+@@ -87,7 +87,14 @@
+ */
- log_error_write(srv, __FILE__, __LINE__, "ssdsd",
-- "backend died, we disable it for a 5 seconds and send the request to another backend instead:",
-+ "backend died; we'll disable it for 5 seconds and send the request to another backend instead:",
- "reconnects:", hctx->reconnects,
- "load:", host->load);
-
-@@ -2950,7 +2951,7 @@
- if (hctx->wb->bytes_out == 0 &&
- hctx->reconnects < 5) {
- usleep(10000); /* take away the load of the webserver
-- * to let the php a chance to restart
-+ * to give the php a chance to restart
- */
-
- fcgi_reconnect(srv, hctx);
-@@ -3152,9 +3153,9 @@
- (con->http_status == 200 ||
- con->http_status == 0)) {
- /*
-- * If we are here in AUTHORIZER mode then a request for autorizer
-- * was proceeded already, and status 200 has been returned. We need
-- * now to handle autorized request.
-+ * If we are here in AUTHORIZER mode then a request for authorizer
-+ * was processed already, and status 200 has been returned. We need
-+ * now to handle authorized request.
- */
-
- buffer_copy_string_buffer(con->physical.doc_root, host->docroot);
-@@ -3220,7 +3221,7 @@
+ ERR_clear_error();
+- if ((r = SSL_write(ssl, offset, toSend)) <= 0) {
++ r = SSL_write(ssl, offset, toSend);
++
++ if (con->renegotiations > 1 && con->conf.ssl_disable_client_renegotiation) {
++ log_error_write(srv, __FILE__, __LINE__, "s", "SSL: renegotiation initiated by client");
++ return -1;
++ }
++
++ if (r <= 0) {
+ unsigned long err;
+
+ switch ((ssl_r = SSL_get_error(ssl, r))) {
+@@ -139,6 +146,7 @@
+ } else {
+ c->offset += r;
+ cq->bytes_out += r;
++ max_bytes -= r;
}
- if (con->file_started == 0) {
-- /* nothing has been send out yet, try to use another child */
-+ /* nothing has been sent out yet, try to use another child */
+ if (c->offset == (off_t)c->mem->used - 1) {
+@@ -168,6 +176,7 @@
+ do {
+ off_t offset = c->file.start + c->offset;
+ off_t toSend = c->file.length - c->offset;
++ if (toSend > max_bytes) toSend = max_bytes;
- if (hctx->wb->bytes_out == 0 &&
- hctx->reconnects < 5) {
-@@ -3270,8 +3271,8 @@
- hctx->state == FCGI_STATE_WRITE) {
- /* we are allowed to send something out
- *
-- * 1. in a unfinished connect() call
-- * 2. in a unfinished write() call (long POST request)
-+ * 1. in an unfinished connect() call
-+ * 2. in an unfinished write() call (long POST request)
- */
- return mod_fastcgi_handle_subrequest(srv, con, p);
- } else {
-@@ -3286,8 +3287,8 @@
- if (hctx->state == FCGI_STATE_CONNECT_DELAYED) {
- /* getoptsock will catch this one (right ?)
- *
-- * if we are in connect we might get a EINPROGRESS
-- * in the first call and a FDEVENT_HUP in the
-+ * if we are in connect we might get an EINPROGRESS
-+ * in the first call and an FDEVENT_HUP in the
- * second round
- *
- * FIXME: as it is a bit ugly.
-@@ -3485,7 +3486,7 @@
- return HANDLER_FINISHED;
- }
+ if (toSend > LOCAL_SEND_BUFSIZE) toSend = LOCAL_SEND_BUFSIZE;
-- /* a note about no handler is not sent yey */
-+ /* a note about no handler is not sent yet */
- extension->note_is_sent = 0;
+@@ -190,7 +199,14 @@
+ close(ifd);
- /*
-@@ -3520,7 +3521,7 @@
- }
+ ERR_clear_error();
+- if ((r = SSL_write(ssl, s, toSend)) <= 0) {
++ r = SSL_write(ssl, s, toSend);
++
++ if (con->renegotiations > 1 && con->conf.ssl_disable_client_renegotiation) {
++ log_error_write(srv, __FILE__, __LINE__, "s", "SSL: renegotiation initiated by client");
++ return -1;
++ }
++
++ if (r <= 0) {
+ unsigned long err;
- /* the prefix is the SCRIPT_NAME,
-- * everthing from start to the next slash
-+ * everything from start to the next slash
- * this is important for check-local = "disable"
- *
- * if prefix = /admin.fcgi
-@@ -3630,13 +3631,13 @@
+ switch ((ssl_r = SSL_get_error(ssl, r))) {
+@@ -243,12 +259,13 @@
+ } else {
+ c->offset += r;
+ cq->bytes_out += r;
++ max_bytes -= r;
+ }
- /* perhaps we should kill a connect attempt after 10-15 seconds
- *
-- * currently we wait for the TCP timeout which is on Linux 180 seconds
-+ * currently we wait for the TCP timeout which is 180 seconds on Linux
- *
- *
- *
- */
+ if (c->offset == c->file.length) {
+ chunk_finished = 1;
+ }
+- } while(!chunk_finished && !write_wait);
++ } while (!chunk_finished && !write_wait && max_bytes > 0);
-- /* check all childs if they are still up */
-+ /* check all children if they are still up */
+ break;
+ }
+@@ -263,11 +280,9 @@
- for (i = 0; i < srv->config_context->used; i++) {
- plugin_config *conf;
-@@ -3718,11 +3719,11 @@
-
- if (srv->cur_ts - proc->last_used > host->idle_timeout) {
- /* a proc is idling for a long time now,
-- * terminated it */
-+ * terminate it */
-
- if (p->conf.debug) {
- log_error_write(srv, __FILE__, __LINE__, "ssbsd",
-- "idle-timeout reached, terminating child:",
-+ "idle-timeout reached; terminating child:",
- "socket:", proc->connection_name,
- "pid", proc->pid);
- }
-Index: src/mod_access.c
-===================================================================
---- src/mod_access.c (.../tags/lighttpd-1.4.15) (revision 1878)
-+++ src/mod_access.c (.../branches/lighttpd-1.4.x) (revision 1878)
-@@ -111,6 +111,15 @@
- }
- #undef PATCH
-
-+/**
-+ * URI handler
-+ *
-+ * we will get called twice:
-+ * - after the clean up of the URL and
-+ * - after the pathinfo checks are done
-+ *
-+ * this handles the issue of trailing slashes
-+ */
- URIHANDLER_FUNC(mod_access_uri_handler) {
- plugin_data *p = p_d;
- int s_len;
-@@ -122,28 +131,41 @@
+ break;
+ }
+-
+- chunks_written++;
+ }
- s_len = con->uri.path->used - 1;
+- return chunks_written;
++ return 0;
+ }
+ #endif
-+ if (con->conf.log_request_handling) {
-+ log_error_write(srv, __FILE__, __LINE__, "s",
-+ "-- mod_access_uri_handler called");
+Index: src/http_auth.c
+===================================================================
+--- src/http_auth.c (.../tags/lighttpd-1.4.29)
++++ src/http_auth.c (.../branches/lighttpd-1.4.x)
+@@ -1,7 +1,6 @@
+ #include "server.h"
+ #include "log.h"
+ #include "http_auth.h"
+-#include "http_auth_digest.h"
+ #include "inet_ntop_cache.h"
+ #include "stream.h"
+
+@@ -28,18 +27,23 @@
+ #include <unistd.h>
+ #include <ctype.h>
+
+-#ifdef USE_OPENSSL
+-# include <openssl/md5.h>
+-#else
+-# include "md5.h"
++#include "md5.h"
+
+-typedef li_MD5_CTX MD5_CTX;
+-#define MD5_Init li_MD5_Init
+-#define MD5_Update li_MD5_Update
+-#define MD5_Final li_MD5_Final
++#define HASHLEN 16
++#define HASHHEXLEN 32
++typedef unsigned char HASH[HASHLEN];
++typedef char HASHHEX[HASHHEXLEN+1];
+
+-#endif
++static void CvtHex(const HASH Bin, char Hex[33]) {
++ unsigned short i;
+
++ for (i = 0; i < 16; i++) {
++ Hex[i*2] = int2hex((Bin[i] >> 4) & 0xf);
++ Hex[i*2+1] = int2hex(Bin[i] & 0xf);
+ }
++ Hex[32] = '\0';
++}
+
- for (k = 0; k < p->conf.access_deny->used; k++) {
- data_string *ds = (data_string *)p->conf.access_deny->data[k];
- int ct_len = ds->value->used - 1;
-+ int denied = 0;
+ /**
+ * the $apr1$ handling is taken from apache 1.3.x
+ */
+@@ -95,7 +99,7 @@
+ ch = in[0];
+ /* run through the whole string, converting as we go */
+ for (i = 0; i < in_len; i++) {
+- ch = in[i];
++ ch = (unsigned char) in[i];
+
+ if (ch == '\0') break;
+
+@@ -435,7 +439,7 @@
+
+ static void to64(char *s, unsigned long v, int n)
+ {
+- static unsigned char itoa64[] = /* 0 ... 63 => ASCII - 64 */
++ static const unsigned char itoa64[] = /* 0 ... 63 => ASCII - 64 */
+ "./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
+
+ while (--n >= 0) {
+@@ -455,7 +459,7 @@
+ const char *sp, *ep;
+ unsigned char final[APR_MD5_DIGESTSIZE];
+ ssize_t sl, pl, i;
+- MD5_CTX ctx, ctx1;
++ li_MD5_CTX ctx, ctx1;
+ unsigned long l;
+
+ /*
+@@ -487,33 +491,33 @@
+ /*
+ * 'Time to make the doughnuts..'
+ */
+- MD5_Init(&ctx);
++ li_MD5_Init(&ctx);
+
+ /*
+ * The password first, since that is what is most unknown
+ */
+- MD5_Update(&ctx, pw, strlen(pw));
++ li_MD5_Update(&ctx, pw, strlen(pw));
+
+ /*
+ * Then our magic string
+ */
+- MD5_Update(&ctx, APR1_ID, strlen(APR1_ID));
++ li_MD5_Update(&ctx, APR1_ID, strlen(APR1_ID));
+
+ /*
+ * Then the raw salt
+ */
+- MD5_Update(&ctx, sp, sl);
++ li_MD5_Update(&ctx, sp, sl);
+
+ /*
+ * Then just as many characters of the MD5(pw, salt, pw)
+ */
+- MD5_Init(&ctx1);
+- MD5_Update(&ctx1, pw, strlen(pw));
+- MD5_Update(&ctx1, sp, sl);
+- MD5_Update(&ctx1, pw, strlen(pw));
+- MD5_Final(final, &ctx1);
++ li_MD5_Init(&ctx1);
++ li_MD5_Update(&ctx1, pw, strlen(pw));
++ li_MD5_Update(&ctx1, sp, sl);
++ li_MD5_Update(&ctx1, pw, strlen(pw));
++ li_MD5_Final(final, &ctx1);
+ for (pl = strlen(pw); pl > 0; pl -= APR_MD5_DIGESTSIZE) {
+- MD5_Update(&ctx, final,
++ li_MD5_Update(&ctx, final,
+ (pl > APR_MD5_DIGESTSIZE) ? APR_MD5_DIGESTSIZE : pl);
+ }
+
+@@ -527,10 +531,10 @@
+ */
+ for (i = strlen(pw); i != 0; i >>= 1) {
+ if (i & 1) {
+- MD5_Update(&ctx, final, 1);
++ li_MD5_Update(&ctx, final, 1);
+ }
+ else {
+- MD5_Update(&ctx, pw, 1);
++ li_MD5_Update(&ctx, pw, 1);
+ }
+ }
+
+@@ -542,7 +546,7 @@
+ strncat(passwd, sp, sl);
+ strcat(passwd, "$");
+
+- MD5_Final(final, &ctx);
++ li_MD5_Final(final, &ctx);
+
+ /*
+ * And now, just to make sure things don't run too fast..
+@@ -550,28 +554,28 @@
+ * need 30 seconds to build a 1000 entry dictionary...
+ */
+ for (i = 0; i < 1000; i++) {
+- MD5_Init(&ctx1);
++ li_MD5_Init(&ctx1);
+ if (i & 1) {
+- MD5_Update(&ctx1, pw, strlen(pw));
++ li_MD5_Update(&ctx1, pw, strlen(pw));
+ }
+ else {
+- MD5_Update(&ctx1, final, APR_MD5_DIGESTSIZE);
++ li_MD5_Update(&ctx1, final, APR_MD5_DIGESTSIZE);
+ }
+ if (i % 3) {
+- MD5_Update(&ctx1, sp, sl);
++ li_MD5_Update(&ctx1, sp, sl);
+ }
+
+ if (i % 7) {
+- MD5_Update(&ctx1, pw, strlen(pw));
++ li_MD5_Update(&ctx1, pw, strlen(pw));
+ }
+
+ if (i & 1) {
+- MD5_Update(&ctx1, final, APR_MD5_DIGESTSIZE);
++ li_MD5_Update(&ctx1, final, APR_MD5_DIGESTSIZE);
+ }
+ else {
+- MD5_Update(&ctx1, pw, strlen(pw));
++ li_MD5_Update(&ctx1, pw, strlen(pw));
+ }
+- MD5_Final(final,&ctx1);
++ li_MD5_Final(final,&ctx1);
+ }
+
+ p = passwd + strlen(passwd);
+@@ -614,17 +618,17 @@
+ * user:realm:md5(user:realm:password)
+ */
+
+- MD5_CTX Md5Ctx;
++ li_MD5_CTX Md5Ctx;
+ HASH HA1;
+ char a1[256];
+
+- MD5_Init(&Md5Ctx);
+- MD5_Update(&Md5Ctx, (unsigned char *)username->ptr, username->used - 1);
+- MD5_Update(&Md5Ctx, (unsigned char *)":", 1);
+- MD5_Update(&Md5Ctx, (unsigned char *)realm->ptr, realm->used - 1);
+- MD5_Update(&Md5Ctx, (unsigned char *)":", 1);
+- MD5_Update(&Md5Ctx, (unsigned char *)pw, strlen(pw));
+- MD5_Final(HA1, &Md5Ctx);
++ li_MD5_Init(&Md5Ctx);
++ li_MD5_Update(&Md5Ctx, (unsigned char *)username->ptr, username->used - 1);
++ li_MD5_Update(&Md5Ctx, (unsigned char *)":", 1);
++ li_MD5_Update(&Md5Ctx, (unsigned char *)realm->ptr, realm->used - 1);
++ li_MD5_Update(&Md5Ctx, (unsigned char *)":", 1);
++ li_MD5_Update(&Md5Ctx, (unsigned char *)pw, strlen(pw));
++ li_MD5_Final(HA1, &Md5Ctx);
+
+ CvtHex(HA1, a1);
+
+@@ -930,7 +934,7 @@
+ int i;
+ buffer *password, *b, *username_buf, *realm_buf;
+
+- MD5_CTX Md5Ctx;
++ li_MD5_CTX Md5Ctx;
+ HASH HA1;
+ HASH HA2;
+ HASH RespHash;
+@@ -1067,13 +1071,13 @@
+
+ if (p->conf.auth_backend == AUTH_BACKEND_PLAIN) {
+ /* generate password from plain-text */
+- MD5_Init(&Md5Ctx);
+- MD5_Update(&Md5Ctx, (unsigned char *)username, strlen(username));
+- MD5_Update(&Md5Ctx, (unsigned char *)":", 1);
+- MD5_Update(&Md5Ctx, (unsigned char *)realm, strlen(realm));
+- MD5_Update(&Md5Ctx, (unsigned char *)":", 1);
+- MD5_Update(&Md5Ctx, (unsigned char *)password->ptr, password->used - 1);
+- MD5_Final(HA1, &Md5Ctx);
++ li_MD5_Init(&Md5Ctx);
++ li_MD5_Update(&Md5Ctx, (unsigned char *)username, strlen(username));
++ li_MD5_Update(&Md5Ctx, (unsigned char *)":", 1);
++ li_MD5_Update(&Md5Ctx, (unsigned char *)realm, strlen(realm));
++ li_MD5_Update(&Md5Ctx, (unsigned char *)":", 1);
++ li_MD5_Update(&Md5Ctx, (unsigned char *)password->ptr, password->used - 1);
++ li_MD5_Final(HA1, &Md5Ctx);
+ } else if (p->conf.auth_backend == AUTH_BACKEND_HTDIGEST) {
+ /* HA1 */
+ /* transform the 32-byte-hex-md5 to a 16-byte-md5 */
+@@ -1090,45 +1094,45 @@
+
+ if (algorithm &&
+ strcasecmp(algorithm, "md5-sess") == 0) {
+- MD5_Init(&Md5Ctx);
+- MD5_Update(&Md5Ctx, (unsigned char *)HA1, 16);
+- MD5_Update(&Md5Ctx, (unsigned char *)":", 1);
+- MD5_Update(&Md5Ctx, (unsigned char *)nonce, strlen(nonce));
+- MD5_Update(&Md5Ctx, (unsigned char *)":", 1);
+- MD5_Update(&Md5Ctx, (unsigned char *)cnonce, strlen(cnonce));
+- MD5_Final(HA1, &Md5Ctx);
++ li_MD5_Init(&Md5Ctx);
++ li_MD5_Update(&Md5Ctx, (unsigned char *)HA1, 16);
++ li_MD5_Update(&Md5Ctx, (unsigned char *)":", 1);
++ li_MD5_Update(&Md5Ctx, (unsigned char *)nonce, strlen(nonce));
++ li_MD5_Update(&Md5Ctx, (unsigned char *)":", 1);
++ li_MD5_Update(&Md5Ctx, (unsigned char *)cnonce, strlen(cnonce));
++ li_MD5_Final(HA1, &Md5Ctx);
+ }
+
+ CvtHex(HA1, a1);
+
+ /* calculate H(A2) */
+- MD5_Init(&Md5Ctx);
+- MD5_Update(&Md5Ctx, (unsigned char *)m, strlen(m));
+- MD5_Update(&Md5Ctx, (unsigned char *)":", 1);
+- MD5_Update(&Md5Ctx, (unsigned char *)uri, strlen(uri));
++ li_MD5_Init(&Md5Ctx);
++ li_MD5_Update(&Md5Ctx, (unsigned char *)m, strlen(m));
++ li_MD5_Update(&Md5Ctx, (unsigned char *)":", 1);
++ li_MD5_Update(&Md5Ctx, (unsigned char *)uri, strlen(uri));
+ if (qop && strcasecmp(qop, "auth-int") == 0) {
+- MD5_Update(&Md5Ctx, (unsigned char *)":", 1);
+- MD5_Update(&Md5Ctx, (unsigned char *)"", HASHHEXLEN);
++ li_MD5_Update(&Md5Ctx, (unsigned char *)":", 1);
++ li_MD5_Update(&Md5Ctx, (unsigned char *)"", HASHHEXLEN);
+ }
+- MD5_Final(HA2, &Md5Ctx);
++ li_MD5_Final(HA2, &Md5Ctx);
+ CvtHex(HA2, HA2Hex);
+
+ /* calculate response */
+- MD5_Init(&Md5Ctx);
+- MD5_Update(&Md5Ctx, (unsigned char *)a1, HASHHEXLEN);
+- MD5_Update(&Md5Ctx, (unsigned char *)":", 1);
+- MD5_Update(&Md5Ctx, (unsigned char *)nonce, strlen(nonce));
+- MD5_Update(&Md5Ctx, (unsigned char *)":", 1);
++ li_MD5_Init(&Md5Ctx);
++ li_MD5_Update(&Md5Ctx, (unsigned char *)a1, HASHHEXLEN);
++ li_MD5_Update(&Md5Ctx, (unsigned char *)":", 1);
++ li_MD5_Update(&Md5Ctx, (unsigned char *)nonce, strlen(nonce));
++ li_MD5_Update(&Md5Ctx, (unsigned char *)":", 1);
+ if (qop && *qop) {
+- MD5_Update(&Md5Ctx, (unsigned char *)nc, strlen(nc));
+- MD5_Update(&Md5Ctx, (unsigned char *)":", 1);
+- MD5_Update(&Md5Ctx, (unsigned char *)cnonce, strlen(cnonce));
+- MD5_Update(&Md5Ctx, (unsigned char *)":", 1);
+- MD5_Update(&Md5Ctx, (unsigned char *)qop, strlen(qop));
+- MD5_Update(&Md5Ctx, (unsigned char *)":", 1);
++ li_MD5_Update(&Md5Ctx, (unsigned char *)nc, strlen(nc));
++ li_MD5_Update(&Md5Ctx, (unsigned char *)":", 1);
++ li_MD5_Update(&Md5Ctx, (unsigned char *)cnonce, strlen(cnonce));
++ li_MD5_Update(&Md5Ctx, (unsigned char *)":", 1);
++ li_MD5_Update(&Md5Ctx, (unsigned char *)qop, strlen(qop));
++ li_MD5_Update(&Md5Ctx, (unsigned char *)":", 1);
+ };
+- MD5_Update(&Md5Ctx, (unsigned char *)HA2Hex, HASHHEXLEN);
+- MD5_Final(RespHash, &Md5Ctx);
++ li_MD5_Update(&Md5Ctx, (unsigned char *)HA2Hex, HASHHEXLEN);
++ li_MD5_Final(RespHash, &Md5Ctx);
+ CvtHex(RespHash, a2);
+
+ if (0 != strcmp(a2, respons)) {
+@@ -1171,24 +1175,24 @@
+
+ int http_auth_digest_generate_nonce(server *srv, mod_auth_plugin_data *p, buffer *fn, char out[33]) {
+ HASH h;
+- MD5_CTX Md5Ctx;
++ li_MD5_CTX Md5Ctx;
+ char hh[32];
+
+ UNUSED(p);
+
+ /* generate shared-secret */
+- MD5_Init(&Md5Ctx);
+- MD5_Update(&Md5Ctx, (unsigned char *)fn->ptr, fn->used - 1);
+- MD5_Update(&Md5Ctx, (unsigned char *)"+", 1);
++ li_MD5_Init(&Md5Ctx);
++ li_MD5_Update(&Md5Ctx, (unsigned char *)fn->ptr, fn->used - 1);
++ li_MD5_Update(&Md5Ctx, (unsigned char *)"+", 1);
+
+ /* we assume sizeof(time_t) == 4 here, but if not it ain't a problem at all */
+ LI_ltostr(hh, srv->cur_ts);
+- MD5_Update(&Md5Ctx, (unsigned char *)hh, strlen(hh));
+- MD5_Update(&Md5Ctx, (unsigned char *)srv->entropy, sizeof(srv->entropy));
++ li_MD5_Update(&Md5Ctx, (unsigned char *)hh, strlen(hh));
++ li_MD5_Update(&Md5Ctx, (unsigned char *)srv->entropy, sizeof(srv->entropy));
+ LI_ltostr(hh, rand());
+- MD5_Update(&Md5Ctx, (unsigned char *)hh, strlen(hh));
++ li_MD5_Update(&Md5Ctx, (unsigned char *)hh, strlen(hh));
+
+- MD5_Final(h, &Md5Ctx);
++ li_MD5_Final(h, &Md5Ctx);
+
+ CvtHex(h, out);
+
+Index: src/mod_usertrack.c
+===================================================================
+--- src/mod_usertrack.c (.../tags/lighttpd-1.4.29)
++++ src/mod_usertrack.c (.../branches/lighttpd-1.4.x)
+@@ -8,18 +8,8 @@
+ #include <stdlib.h>
+ #include <string.h>
+
+-#ifdef USE_OPENSSL
+-# include <openssl/md5.h>
+-#else
+-# include "md5.h"
++#include "md5.h"
+
+-typedef li_MD5_CTX MD5_CTX;
+-#define MD5_Init li_MD5_Init
+-#define MD5_Update li_MD5_Update
+-#define MD5_Final li_MD5_Final
+-
+-#endif
+-
+ /* plugin config for all request/connections */
+ typedef struct {
+@@ -182,7 +172,7 @@
+ plugin_data *p = p_d;
+ data_string *ds;
+ unsigned char h[16];
+- MD5_CTX Md5Ctx;
++ li_MD5_CTX Md5Ctx;
+ char hh[32];
+
+ if (con->uri.path->used == 0) return HANDLER_GO_ON;
+@@ -228,18 +218,18 @@
+ /* taken from mod_auth.c */
+
+ /* generate shared-secret */
+- MD5_Init(&Md5Ctx);
+- MD5_Update(&Md5Ctx, (unsigned char *)con->uri.path->ptr, con->uri.path->used - 1);
+- MD5_Update(&Md5Ctx, (unsigned char *)"+", 1);
++ li_MD5_Init(&Md5Ctx);
++ li_MD5_Update(&Md5Ctx, (unsigned char *)con->uri.path->ptr, con->uri.path->used - 1);
++ li_MD5_Update(&Md5Ctx, (unsigned char *)"+", 1);
+
+ /* we assume sizeof(time_t) == 4 here, but if not it ain't a problem at all */
+ LI_ltostr(hh, srv->cur_ts);
+- MD5_Update(&Md5Ctx, (unsigned char *)hh, strlen(hh));
+- MD5_Update(&Md5Ctx, (unsigned char *)srv->entropy, sizeof(srv->entropy));
++ li_MD5_Update(&Md5Ctx, (unsigned char *)hh, strlen(hh));
++ li_MD5_Update(&Md5Ctx, (unsigned char *)srv->entropy, sizeof(srv->entropy));
+ LI_ltostr(hh, rand());
+- MD5_Update(&Md5Ctx, (unsigned char *)hh, strlen(hh));
++ li_MD5_Update(&Md5Ctx, (unsigned char *)hh, strlen(hh));
+
+- MD5_Final(h, &Md5Ctx);
++ li_MD5_Final(h, &Md5Ctx);
+
+ buffer_append_string_encoded(ds->value, (char *)h, 16, ENCODING_HEX);
+ buffer_append_string_len(ds->value, CONST_STR_LEN("; Path=/"));
+Index: src/mod_status.c
+===================================================================
+--- src/mod_status.c (.../tags/lighttpd-1.4.29)
++++ src/mod_status.c (.../branches/lighttpd-1.4.x)
+@@ -487,7 +487,7 @@
+
+ buffer_append_string_len(b, CONST_STR_LEN("</td><td class=\"int\">"));
+
+- if (con->request.content_length) {
++ if (c->request.content_length) {
+ buffer_append_long(b, c->request_content_queue->bytes_in);
+ buffer_append_string_len(b, CONST_STR_LEN("/"));
+ buffer_append_long(b, c->request.content_length);
+Index: src/settings.h
+===================================================================
+--- src/settings.h (.../tags/lighttpd-1.4.29)
++++ src/settings.h (.../branches/lighttpd-1.4.x)
+@@ -21,8 +21,11 @@
+ * 64kB (no real reason, just a guess)
+ */
+ #define BUFFER_MAX_REUSE_SIZE (4 * 1024)
+-#define MAX_READ_LIMIT (4*1024*1024)
+
++/* both should be way smaller than SSIZE_MAX :) */
++#define MAX_READ_LIMIT (256*1024)
++#define MAX_WRITE_LIMIT (256*1024)
+
- if (ct_len > s_len) continue;
+ /**
+ * max size of the HTTP request header
+ *
+Index: src/mod_cml_lua.c
+===================================================================
+--- src/mod_cml_lua.c (.../tags/lighttpd-1.4.29)
++++ src/mod_cml_lua.c (.../branches/lighttpd-1.4.x)
+@@ -11,18 +11,6 @@
+ #include <time.h>
+ #include <string.h>
+
+-#ifdef USE_OPENSSL
+-# include <openssl/md5.h>
+-#else
+-# include "md5.h"
-
- if (ds->value->used == 0) continue;
+-typedef li_MD5_CTX MD5_CTX;
+-#define MD5_Init li_MD5_Init
+-#define MD5_Update li_MD5_Update
+-#define MD5_Final li_MD5_Final
+-
+-#endif
+-
+ #define HASHLEN 16
+ typedef unsigned char HASH[HASHLEN];
+ #define HASHHEXLEN 32
+Index: src/mod_fastcgi.c
+===================================================================
+--- src/mod_fastcgi.c (.../tags/lighttpd-1.4.29)
++++ src/mod_fastcgi.c (.../branches/lighttpd-1.4.x)
+@@ -3075,7 +3075,7 @@
+ fcgi_set_state(srv, hctx, FCGI_STATE_WRITE);
+ /* fall through */
+ case FCGI_STATE_WRITE:
+- ret = srv->network_backend_write(srv, con, hctx->fd, hctx->wb);
++ ret = srv->network_backend_write(srv, con, hctx->fd, hctx->wb, MAX_WRITE_LIMIT);
+
+ chunkqueue_remove_finished_chunks(hctx->wb);
+
+@@ -3132,7 +3132,6 @@
+ plugin_data *p = p_d;
- /* if we have a case-insensitive FS we have to lower-case the URI here too */
+ handler_ctx *hctx = con->plugin_ctx[p->id];
+- fcgi_proc *proc;
+ fcgi_extension_host *host;
- if (con->conf.force_lowercase_filenames) {
- if (0 == strncasecmp(con->uri.path->ptr + s_len - ct_len, ds->value->ptr, ct_len)) {
-- con->http_status = 403;
--
-- return HANDLER_FINISHED;
-+ denied = 1;
- }
- } else {
- if (0 == strncmp(con->uri.path->ptr + s_len - ct_len, ds->value->ptr, ct_len)) {
-- con->http_status = 403;
-+ denied = 1;
-+ }
-+ }
+ if (NULL == hctx) return HANDLER_GO_ON;
+@@ -3201,7 +3200,6 @@
+ /* ok, create the request */
+ switch(fcgi_write_request(srv, hctx)) {
+ case HANDLER_ERROR:
+- proc = hctx->proc;
+ host = hctx->host;
-- return HANDLER_FINISHED;
-+ if (denied) {
-+ con->http_status = 403;
-+
-+ if (con->conf.log_request_handling) {
-+ log_error_write(srv, __FILE__, __LINE__, "sb",
-+ "url denied as we match:", ds->value);
- }
-+
-+ return HANDLER_FINISHED;
+ if (hctx->state == FCGI_STATE_INIT ||
+Index: src/network_solaris_sendfilev.c
+===================================================================
+--- src/network_solaris_sendfilev.c (.../tags/lighttpd-1.4.29)
++++ src/network_solaris_sendfilev.c (.../branches/lighttpd-1.4.x)
+@@ -38,17 +38,16 @@
+ */
+
+
+-int network_write_chunkqueue_solarissendfilev(server *srv, connection *con, int fd, chunkqueue *cq) {
++int network_write_chunkqueue_solarissendfilev(server *srv, connection *con, int fd, chunkqueue *cq, off_t max_bytes) {
+ chunk *c;
+- size_t chunks_written = 0;
+
+- for(c = cq->first; c; c = c->next, chunks_written++) {
++ for(c = cq->first; (max_bytes > 0) && (NULL != c); c = c->next) {
+ int chunk_finished = 0;
+
+ switch(c->type) {
+ case MEM_CHUNK: {
+ char * offset;
+- size_t toSend;
++ off_t toSend;
+ ssize_t r;
+
+ size_t num_chunks, i;
+@@ -77,9 +76,9 @@
+ chunks[i].iov_base = offset;
+
+ /* protect the return value of writev() */
+- if (toSend > SSIZE_MAX ||
+- num_bytes + toSend > SSIZE_MAX) {
+- chunks[i].iov_len = SSIZE_MAX - num_bytes;
++ if (toSend > max_bytes ||
++ (off_t) num_bytes + toSend > max_bytes) {
++ chunks[i].iov_len = max_bytes - num_bytes;
+
+ num_chunks = i + 1;
+ break;
+@@ -119,11 +118,10 @@
+
+ if (chunk_finished) {
+ /* skip the chunks from further touches */
+- chunks_written++;
+ c = c->next;
+ } else {
+ /* chunks_written + c = c->next is done in the for()*/
+- chunk_finished++;
++ chunk_finished = 1;
+ }
+ } else {
+ /* partially written */
+@@ -139,8 +137,8 @@
+ }
+ case FILE_CHUNK: {
+ ssize_t r;
+- off_t offset;
+- size_t toSend, written;
++ off_t offset, toSend;
++ size_t written;
+ sendfilevec_t fvec;
+ stat_cache_entry *sce = NULL;
+ int ifd;
+@@ -153,6 +151,7 @@
+
+ offset = c->file.start + c->offset;
+ toSend = c->file.length - c->offset;
++ if (toSend > max_bytes) toSend = max_bytes;
+
+ if (offset > sce->st.st_size) {
+ log_error_write(srv, __FILE__, __LINE__, "sb", "file was shrinked:", c->file.name);
+@@ -186,6 +185,7 @@
+ close(ifd);
+ c->offset += written;
+ cq->bytes_out += written;
++ max_bytes -= written;
+
+ if (c->offset == c->file.length) {
+ chunk_finished = 1;
+@@ -207,7 +207,7 @@
}
}
-@@ -158,7 +180,8 @@
-
- p->init = mod_access_init;
- p->set_defaults = mod_access_set_defaults;
-- p->handle_uri_clean = mod_access_uri_handler;
-+ p->handle_uri_clean = mod_access_uri_handler;
-+ p->handle_subrequest_start = mod_access_uri_handler;
- p->cleanup = mod_access_free;
+- return chunks_written;
++ return 0;
+ }
- p->data = NULL;
-Index: src/mod_accesslog.c
+ #endif
+Index: src/CMakeLists.txt
===================================================================
---- src/mod_accesslog.c (.../tags/lighttpd-1.4.15) (revision 1878)
-+++ src/mod_accesslog.c (.../branches/lighttpd-1.4.x) (revision 1878)
-@@ -507,7 +507,7 @@
- *
- */
-
-- execl("/bin/sh", "sh", "-c", s->access_logfile->ptr + 1, NULL);
-+ execl("/bin/sh", "sh", "-c", s->access_logfile->ptr + 1, (char *)NULL);
-
- log_error_write(srv, __FILE__, __LINE__, "sss",
- "spawning log-process failed: ", strerror(errno),
-Index: src/server.c
+Index: src/mod_dirlisting.c
===================================================================
---- src/server.c (.../tags/lighttpd-1.4.15) (revision 1878)
-+++ src/server.c (.../branches/lighttpd-1.4.x) (revision 1878)
-@@ -775,6 +775,22 @@
- return -1;
- }
-
-+ /**
-+ * we are not root can can't increase the fd-limit, but we can reduce it
-+ */
-+ if (srv->srvconf.max_fds && srv->srvconf.max_fds < rlim.rlim_cur) {
-+ /* set rlimits */
-+
-+ rlim.rlim_cur = srv->srvconf.max_fds;
-+
-+ if (0 != setrlimit(RLIMIT_NOFILE, &rlim)) {
-+ log_error_write(srv, __FILE__, __LINE__,
-+ "ss", "couldn't set 'max filedescriptors'",
-+ strerror(errno));
-+ return -1;
-+ }
-+ }
-+
- if (srv->event_handler == FDEVENT_HANDLER_SELECT) {
- srv->max_fds = rlim.rlim_cur < FD_SETSIZE - 200 ? rlim.rlim_cur : FD_SETSIZE - 200;
- } else {
-Index: src/proc_open.c
+--- src/mod_dirlisting.c (.../tags/lighttpd-1.4.29)
++++ src/mod_dirlisting.c (.../branches/lighttpd-1.4.x)
+@@ -657,7 +657,8 @@
+ i = dir->used - 1;
+
+ #ifdef HAVE_PATHCONF
+- if (-1 == (name_max = pathconf(dir->ptr, _PC_NAME_MAX))) {
++ if (0 >= (name_max = pathconf(dir->ptr, _PC_NAME_MAX))) {
++ /* some broken fs (fuse) return 0 instead of -1 */
+ #ifdef NAME_MAX
+ name_max = NAME_MAX;
+ #else
+Index: src/network_linux_sendfile.c
===================================================================
---- src/proc_open.c (.../tags/lighttpd-1.4.15) (revision 1878)
-+++ src/proc_open.c (.../branches/lighttpd-1.4.x) (revision 1878)
-@@ -255,7 +255,7 @@
- */
- proc_close_parents(proc);
+--- src/network_linux_sendfile.c (.../tags/lighttpd-1.4.29)
++++ src/network_linux_sendfile.c (.../branches/lighttpd-1.4.x)
+@@ -27,17 +27,16 @@
+ /* on linux 2.4.29 + debian/ubuntu we have crashes if this is enabled */
+ #undef HAVE_POSIX_FADVISE
+
+-int network_write_chunkqueue_linuxsendfile(server *srv, connection *con, int fd, chunkqueue *cq) {
++int network_write_chunkqueue_linuxsendfile(server *srv, connection *con, int fd, chunkqueue *cq, off_t max_bytes) {
+ chunk *c;
+- size_t chunks_written = 0;
+
+- for(c = cq->first; c; c = c->next, chunks_written++) {
++ for(c = cq->first; (max_bytes > 0) && (NULL != c); c = c->next) {
+ int chunk_finished = 0;
+
+ switch(c->type) {
+ case MEM_CHUNK: {
+ char * offset;
+- size_t toSend;
++ off_t toSend;
+ ssize_t r;
+
+ size_t num_chunks, i;
+@@ -45,12 +44,10 @@
+ chunk *tc;
+ size_t num_bytes = 0;
+
+- /* we can't send more then SSIZE_MAX bytes in one chunk */
+-
+ /* build writev list
+ *
+ * 1. limit: num_chunks < UIO_MAXIOV
+- * 2. limit: num_bytes < SSIZE_MAX
++ * 2. limit: num_bytes < max_bytes
+ */
+ for (num_chunks = 0, tc = c;
+ tc && tc->type == MEM_CHUNK && num_chunks < UIO_MAXIOV;
+@@ -67,9 +64,9 @@
+ chunks[i].iov_base = offset;
+
+ /* protect the return value of writev() */
+- if (toSend > SSIZE_MAX ||
+- num_bytes + toSend > SSIZE_MAX) {
+- chunks[i].iov_len = SSIZE_MAX - num_bytes;
++ if (toSend > max_bytes ||
++ (off_t) num_bytes + toSend > max_bytes) {
++ chunks[i].iov_len = max_bytes - num_bytes;
+
+ num_chunks = i + 1;
+ break;
+@@ -100,6 +97,7 @@
+
+ /* check which chunks have been written */
+ cq->bytes_out += r;
++ max_bytes -= r;
+
+ for(i = 0, tc = c; i < num_chunks; i++, tc = tc->next) {
+ if (r >= (ssize_t)chunks[i].iov_len) {
+@@ -109,11 +107,10 @@
+
+ if (chunk_finished) {
+ /* skip the chunks from further touches */
+- chunks_written++;
+ c = c->next;
+ } else {
+ /* chunks_written + c = c->next is done in the for()*/
+- chunk_finished++;
++ chunk_finished = 1;
+ }
+ } else {
+ /* partially written */
+@@ -130,13 +127,12 @@
+ case FILE_CHUNK: {
+ ssize_t r;
+ off_t offset;
+- size_t toSend;
++ off_t toSend;
+ stat_cache_entry *sce = NULL;
+
+ offset = c->file.start + c->offset;
+- /* limit the toSend to 2^31-1 bytes in a chunk */
+- toSend = c->file.length - c->offset > ((1 << 30) - 1) ?
+- ((1 << 30) - 1) : c->file.length - c->offset;
++ toSend = c->file.length - c->offset;
++ if (toSend > max_bytes) toSend = max_bytes;
+
+ /* open file if not already opened */
+ if (-1 == c->file.fd) {
+@@ -215,6 +211,7 @@
+
+ c->offset += r;
+ cq->bytes_out += r;
++ max_bytes -= r;
+
+ if (c->offset == c->file.length) {
+ chunk_finished = 1;
+@@ -243,7 +240,7 @@
+ }
+ }
-- execl(shell, shell, "-c", command, NULL);
-+ execl(shell, shell, "-c", command, (char *)NULL);
- _exit(127);
+- return chunks_written;
++ return 0;
+ }
- } else if (child < 0) {
+ #endif
Index: tests/mod-auth.t
===================================================================
---- tests/mod-auth.t (.../tags/lighttpd-1.4.15) (revision 1878)
-+++ tests/mod-auth.t (.../branches/lighttpd-1.4.x) (revision 1878)
+--- tests/mod-auth.t (.../tags/lighttpd-1.4.29)
++++ tests/mod-auth.t (.../branches/lighttpd-1.4.x)
@@ -8,7 +8,7 @@
use strict;
use IO::Socket;
--use Test::More tests => 10;
-+use Test::More tests => 13;
+-use Test::More tests => 14;
++use Test::More tests => 15;
use LightyTest;
my $tf = LightyTest->new();
-@@ -93,7 +93,44 @@
- $t->{RESPONSE} = [ { 'HTTP-Protocol' => 'HTTP/1.0', 'HTTP-Status' => 400 } ];
- ok($tf->handle_http($t) == 0, 'Digest-Auth: missing nc (noncecount instead), no crash');
+@@ -25,6 +25,14 @@
-+$t->{REQUEST} = ( <<EOF
-+GET /server-status HTTP/1.0
-+Authorization: Basic =
-+EOF
-+ );
-+$t->{RESPONSE} = [ { 'HTTP-Protocol' => 'HTTP/1.0', 'HTTP-Status' => 401 } ];
-+ok($tf->handle_http($t) == 0, 'Basic-Auth: Invalid Base64');
-
-
-+$t->{REQUEST} = ( <<EOF
-+GET /server-status HTTP/1.0
-+User-Agent: Wget/1.9.1
-+Authorization: Digest username="jan", realm="jan",
-+ nonce="b1d12348b4620437c43dd61c50ae4639", algorithm="md5-sess",
-+ uri="/MJ-BONG.xm.mpc", qop=auth, noncecount=00000001",
-+ cnonce="036FCA5B86F7E7C4965C7F9B8FE714B7",
-+ nc="asd",
-+ response="29B32C2953C763C6D033C8A49983B87E"
+ $t->{REQUEST} = ( <<EOF
+ GET /server-status HTTP/1.0
++Authorization: Basic \x80mFuOmphb
+EOF
+ );
+$t->{RESPONSE} = [ { 'HTTP-Protocol' => 'HTTP/1.0', 'HTTP-Status' => 401 } ];
-+ok($tf->handle_http($t) == 0, 'Digest-Auth: md5-sess + missing cnonce');
++ok($tf->handle_http($t) == 0, 'Basic-Auth: Invalid base64 Auth-token');
+
+$t->{REQUEST} = ( <<EOF
+GET /server-status HTTP/1.0
-+User-Agent: Wget/1.9.1
-+Authorization: Digest username="jan", realm="jan",
-+ nonce="b1d12348b4620437c43dd61c50ae4639", algorithm="md5-sess",
-+ uri="/MJ-BONG.xm.mpc", qop=auth, noncecount=00000001",
-+ cnonce="036FCA5B86F7E7C4965C7F9B8FE714B7",
-+ nc="asd",
-+ response="29B32C2953C763C6D033C8A49983B87E"
-+EOF
-+ );
-+$t->{RESPONSE} = [ { 'HTTP-Protocol' => 'HTTP/1.0', 'HTTP-Status' => 401 } ];
-+ok($tf->handle_http($t) == 0, 'Digest-Auth: trailing WS');
-+
-+
-+
- ok($tf->stop_proc == 0, "Stopping lighttpd");
-
-Index: tests/mod-access.t
-===================================================================
---- tests/mod-access.t (.../tags/lighttpd-1.4.15) (revision 1878)
-+++ tests/mod-access.t (.../branches/lighttpd-1.4.x) (revision 1878)
-@@ -8,7 +8,7 @@
-
- use strict;
- use IO::Socket;
--use Test::More tests => 3;
-+use Test::More tests => 4;
- use LightyTest;
-
- my $tf = LightyTest->new();
-@@ -23,5 +23,12 @@
- $t->{RESPONSE} = [ { 'HTTP-Protocol' => 'HTTP/1.0', 'HTTP-Status' => 403 } ];
- ok($tf->handle_http($t) == 0, 'forbid access to ...~');
-
-+$t->{REQUEST} = ( <<EOF
-+GET /index.html~/ HTTP/1.0
-+EOF
-+ );
-+$t->{RESPONSE} = [ { 'HTTP-Protocol' => 'HTTP/1.0', 'HTTP-Status' => 403 } ];
-+ok($tf->handle_http($t) == 0, '#1230 - forbid access to ...~ - trailing slash');
-+
- ok($tf->stop_proc == 0, "Stopping lighttpd");
-
-Index: tests/core-request.t
+ Authorization: Basic amFuOmphb
+ EOF
+ );
+Index: tests/request.t
===================================================================
---- tests/core-request.t (.../tags/lighttpd-1.4.15) (revision 1878)
-+++ tests/core-request.t (.../branches/lighttpd-1.4.x) (revision 1878)
+--- tests/request.t (.../tags/lighttpd-1.4.29)
++++ tests/request.t (.../branches/lighttpd-1.4.x)
@@ -8,7 +8,7 @@
use strict;
use IO::Socket;
--use Test::More tests => 33;
-+use Test::More tests => 36;
+-use Test::More tests => 44;
++use Test::More tests => 46;
use LightyTest;
my $tf = LightyTest->new();
-@@ -273,6 +273,38 @@
- $t->{RESPONSE} = [ { 'HTTP-Protocol' => 'HTTP/1.0', 'HTTP-Status' => 200 } ];
- ok($tf->handle_http($t) == 0, 'uppercase filenames');
+@@ -413,5 +413,21 @@
+ $t->{SLOWREQUEST} = 1;
+ ok($tf->handle_http($t) == 0, 'GET, slow \\r\\n\\r\\n (#2105)');
++print "\nPathinfo for static files\n";
+$t->{REQUEST} = ( <<EOF
-+GET / HTTP/1.0
-+Location: foo
-+Location: foobar
-+ baz
++GET /image.jpg/index.php HTTP/1.0
+EOF
+ );
-+$t->{RESPONSE} = [ { 'HTTP-Protocol' => 'HTTP/1.0', 'HTTP-Status' => 200 } ];
-+ok($tf->handle_http($t) == 0, '#1232 - duplicate headers with line-wrapping');
-
-+$t->{REQUEST} = ( <<EOF
-+GET / HTTP/1.0
-+Location:
-+Location: foobar
-+ baz
-+EOF
-+ );
-+$t->{RESPONSE} = [ { 'HTTP-Protocol' => 'HTTP/1.0', 'HTTP-Status' => 200 } ];
-+ok($tf->handle_http($t) == 0, '#1232 - duplicate headers with line-wrapping - test 2');
++$t->{RESPONSE} = [ { 'HTTP-Protocol' => 'HTTP/1.0', 'HTTP-Status' => 200, 'Content-Type' => 'image/jpeg' } ];
++ok($tf->handle_http($t) == 0, 'static file accepting pathinfo by default');
+
+$t->{REQUEST} = ( <<EOF
-+GET / HTTP/1.0
-+A:
-+Location: foobar
-+ baz
++GET /image.jpg/index.php HTTP/1.0
++Host: zzz.example.org
+EOF
+ );
-+$t->{RESPONSE} = [ { 'HTTP-Protocol' => 'HTTP/1.0', 'HTTP-Status' => 200 } ];
-+ok($tf->handle_http($t) == 0, '#1232 - duplicate headers with line-wrapping - test 3');
-+
-+
-+
++$t->{RESPONSE} = [ { 'HTTP-Protocol' => 'HTTP/1.0', 'HTTP-Status' => 403 } ];
++ok($tf->handle_http($t) == 0, 'static file with forbidden pathinfo');
+
ok($tf->stop_proc == 0, "Stopping lighttpd");
-Index: tests/prepare.sh
+Index: tests/wrapper.sh
===================================================================
---- tests/prepare.sh (.../tags/lighttpd-1.4.15) (revision 1878)
-+++ tests/prepare.sh (.../branches/lighttpd-1.4.x) (revision 1878)
-@@ -25,6 +25,7 @@
- # copy everything into the right places
- cp $srcdir/docroot/www/*.html \
- $srcdir/docroot/www/*.php \
-+ $srcdir/docroot/www/*.html~ \
- $srcdir/docroot/www/*.pl \
- $srcdir/docroot/www/*.fcgi \
- $srcdir/docroot/www/*.shtml \
-Index: tests/docroot/www/index.html~
+--- tests/wrapper.sh (.../tags/lighttpd-1.4.29)
++++ tests/wrapper.sh (.../branches/lighttpd-1.4.x)
+@@ -6,4 +6,4 @@
+ top_builddir=$2
+ export SHELL srcdir top_builddir
+
+-$3
++exec $3
+Index: tests/lighttpd.conf
===================================================================
-Index: tests/docroot/www/Makefile.am
+--- tests/lighttpd.conf (.../tags/lighttpd-1.4.29)
++++ tests/lighttpd.conf (.../branches/lighttpd-1.4.x)
+@@ -149,6 +149,7 @@
+ $HTTP["host"] == "zzz.example.org" {
+ server.document-root = env.SRCDIR + "/tmp/lighttpd/servers/www.example.org/pages/"
+ server.name = "zzz.example.org"
++ static-file.disable-pathinfo = "enable"
+ }
+
+ $HTTP["host"] == "symlink.example.org" {
+Index: configure.ac
+===================================================================
+Index: doc/config/lighttpd.conf
+===================================================================
+--- doc/config/lighttpd.conf (.../tags/lighttpd-1.4.29)
++++ doc/config/lighttpd.conf (.../branches/lighttpd-1.4.x)
+@@ -394,6 +394,25 @@
+ ## $SERVER["socket"] == "10.0.0.1:443" {
+ ## ssl.engine = "enable"
+ ## ssl.pemfile = "/etc/ssl/private/www.example.com.pem"
++## #
++## # Mitigate BEAST attack:
++## #
++## # A stricter base cipher suite. For details see:
++## # http://blog.ivanristic.com/2011/10/mitigating-the-beast-attack-on-tls.html
++## #
++## ssl.ciphers = "ECDHE-RSA-AES256-SHA384:AES256-SHA256:RC4-SHA:RC4:HIGH:!MD5:!aNULL:!EDH:!AESGCM"
++## #
++## # Make the server prefer the order of the server side cipher suite instead of the client suite.
++## # This is necessary to mitigate the BEAST attack (unless you disable all non RC4 algorithms).
++## # This option is enabled by default, but only used if ssl.ciphers is set.
++## #
++## # ssl.honor-cipher-order = "enable"
++## #
++## # Mitigate CVE-2009-3555 by disabling client triggered renegotation
++## # This is enabled by default.
++## #
++## # ssl.disable-client-renegotiation = "enable"
++## #
+ ## server.name = "www.example.com"
+ ##
+ ## server.document-root = "/srv/www/vhosts/example.com/www/"
+Index: SConstruct
===================================================================
---- tests/docroot/www/Makefile.am (.../tags/lighttpd-1.4.15) (revision 1878)
-+++ tests/docroot/www/Makefile.am (.../branches/lighttpd-1.4.x) (revision 1878)
-@@ -1,5 +1,5 @@
- EXTRA_DIST=cgi.php cgi.pl dummydir index.html index.txt phpinfo.php \
- redirect.php cgi-pathinfo.pl get-env.php get-server-env.php \
- nph-status.pl prefix.fcgi get-header.pl ssi.shtml get-post-len.pl \
-- exec-date.shtml
-+ exec-date.shtml index.html~
- SUBDIRS=go indexfile expire
Index: NEWS
===================================================================
---- NEWS (.../tags/lighttpd-1.4.15) (revision 1878)
-+++ NEWS (.../branches/lighttpd-1.4.x) (revision 1878)
-@@ -3,9 +3,26 @@
+--- NEWS (.../tags/lighttpd-1.4.29)
++++ NEWS (.../branches/lighttpd-1.4.x)
+@@ -3,7 +3,20 @@
NEWS
====
-+- 1.4.16 -
+-- 1.4.29 -
++- 1.4.30 -
++ * Always use our 'own' md5 implementation, fixes linking issues on MacOS (fixes #2331)
++ * Limit amount of bytes we send in one go; fixes stalling in one connection and timeouts on slow systems.
++ * [ssl] fix build errors when Elliptic-Curve Diffie-Hellman is disabled
++ * Add static-file.disable-pathinfo option to prevent handling of urls like .../secret.php/image.jpg as static file
++ * Don't overwrite 401 (auth required) with 501 (unknown method) (fixes #2341)
++ * Fix mod_status bug: always showed "0/0" in the "Read" column for uploads (fixes #2351)
++ * [mod_auth] Fix signedness error in http_auth (fixes #2370, CVE-2011-4362)
++ * [ssl] count renegotiations to prevent client renegotiations
++ * [ssl] add option to honor server cipher order (fixes #2364, BEAST attack)
++ * [core] accept dots in ipv6 addresses in host header (fixes #2359)
++ * [ssl] fix ssl connection aborts if files are larger than the MAX_WRITE_LIMIT (256kb)
+
-+ * added static-file.etags, etag.use-inode, etag.use-mtime, etag.use-size
-+ to customize the generation of ETags for static files. (#1209)
-+ (patch by <Yusufg@gmail.com>)
-+ * fixed typecast of NULL on execl() (#1235)
-+ (patch by F. Denis)
-+ * fixed circumventing url.access-deny by trailing slash (#1230)
-+ * fixed crash on duplicate headers with trailing WS (#1232)
-+ * fixed accepting more connections then requested (#1216)
-+ * fixed mem-leak in mod_auth (reported by Stefan Esser)
-+ * fixed crash with md5-sess and cnonce not set in mod_auth (reported by Stefan Esser)
-+ * fixed missing check for base64 encoded string in mod_auth and Basic auth
-+ (reported by Stefan Esser)
-+ * fixed possible crash in Auth-Digest header parser on trailing WS in
-+ mod_auth (reported by Stefan Esser)
-+
- - 1.4.15 - 2007-04-13
-
-- * fixed broken Set-Cookie headers
-+ * fixed broken Set-Cookie headers
-
- - 1.4.14 - 2007-04-13
-
-@@ -29,7 +46,7 @@
- * fix cpu hog in certain requests [1473] CVE-2007-1869
- * fix for handling hostnames with trailing dot [1406]
- * fixed header-injection via server.tag (#1106)
-- * disabled caching of files without a content-type to solve the
-+ * disabled caching of files without a content-type to solve the
- aggressive caching of FF
- * remove trailing white-spaces from HTTP-requests before parsing (#1098)
- * fixed accesslog.use-syslog in a conditional and the caching of the
-@@ -42,7 +59,7 @@
- * fixed crash on url.redirect and url.rewrite if %0 is used in a global context
- (#800)
- * fixed possible crash in debug-message in mod_extforward
-- * fixed compilation of mod_extforward on glibc < 2.3.4
-+ * fixed compilation of mod_extforward on glibc < 2.3.4
- * fixed include of empty in the configfiles (#1076)
- * send SIGUSR1 to fastcgi children before SIGTERM. libfcgi wants SIGUSR1. (#737)
- * fixed missing AUTH_TYPE entry in the fastcgi environment. (#889)
-@@ -54,16 +71,16 @@
- * added initgroups in spawn-fcgi (#871)
- * added apr1 support htpasswd in mod-auth (#870)
- * added lighty.stat() to mod_magnet
-- * fixed segfault in splitted CRLF CRLF sequences
-+ * fixed segfault in splitted CRLF CRLF sequences
- (introduced in 1.4.12) (#876)
- * fixed compilation of LOCK support in mod-webdav
- * fixed fragments in request-URLs (#869)
- * fixed pkg-config check for lua5.1 on debian
-- * fixed Content-Length = 0 on HEAD requests without
-+ * fixed Content-Length = 0 on HEAD requests without
- a known Content-Length (#119)
- * fixed mkdir() forcing 0700 (#884)
- * fixed writev() on FreeBSD 4.x and older (#875)
-- * removed warning about a 404-error-handler
-+ * removed warning about a 404-error-handler
- returned 404
- * backported and fixed the buildsystem changes for
- webdav locks
++- 1.4.29 - 2011-07-03
+ * Fix mod_proxy waiting for response even if content-length is 0 (fixes #2259)
+ * Silence annoying "connection closed: poll() -> ERR" error.log message (fixes #2257)
+ * mod_cgi: make read buffer as big as incoming data block
+Index: CMakeLists.txt
+===================================================================
projects / packages / lighttpd.git / blobdiff