up to 1.4.46 (2017-10-21)

up to 1.4.46 (2017-10-21)

http://www.lighttpd.net/2017/10/21/1.4.46/
https://redmine.lighttpd.net/projects/lighttpd/wiki/Release-1_4_46

Important changes:
- new modules: mod_openssl, mod_vhostdb, mod_wstunnel
- new protocols: Upgrade: websocket, HAProxy PROXY, RFC7239 Forwarded

Selected features:
- HTTP/1.1 Upgrade: websocket (mod_proxy, mod_cgi, and mod_wstunnel)
- HTTP/1.1 Expect: 100-continue
- proxy: HAProxy PROXY protocol (mod_extforward, mod_proxy)
- proxy: RFC7239 Forwared HTTP extension (mod_extforward, mod_proxy)
- proxy: basic host/URL header remapping to/from backend
- config: resolve DNS names to first IP returned at lighttpd startup
- config: allow overriding prior config values using :=
- config: allow conditions on arbitrary HTTP request headers ($REQUEST_HEADER[])
- new module: mod_openssl - isolate SSL/TLS code; cleaner abstractions
- new module: mod_vhostdb* - framework for mass vhost via database backends
- new module: mod_wstunnel - decode/encode websocket proto to/from backend
- common code for dynamic backends; common features; better process management
- numerous new directives for experimental new features

Bug Fixes:
- core: fix streaming response when client catches up to stream from backend
- CGI: RFC3875 CGI local-redir strict adherence; local-redir disable dy default
- BSD: use kqueue in level-triggered mode
- fix triggered assert on HTTP chunked input
- SSL: fix bidirectional streaming over SSL

Behavior Changes:
- mod_scgi binds to INADDR_LOOPBACK if no host is specified (prior behavior
  used INADDR_ANY) If lighttpd is spawning SCGI backend, default is now to
  limit exposure to localhost unless explicitly configured otherwise. This
  matches the behavior (since 2008) in mod_fastcgi.
- core: mimetype.assign matches basename or longest extension(s) (".tar.gz"),
  not just any suffix match, if 16 or more entries
- core: increase default server.max-keep-alive-requests from 16 to 100
- proxy: add X-Forwarded-Host
- openssl: ssl.read-ahead = "disable" default (safer for slow embedded systems)
- mod_cgi cgi.local-redir = "disable" default (RFC3875 6.2.2 local-redir
  optimization added in lighttpd 1.4.40)
- reproducible builds: omit __DATE__ and __TIME__ in lighttpd -h or lighttpd -v