linux/poky.git/meta/recipes-extended/lighttpd, branch nanbield

lighttpd: upgrade 1.4.69 -> 1.4.71

2023-06-09T12:55:20+00:00

lighttpd 1.4.70 omits building separate (unused) modules for: mod_access mod_alias mod_evhost mod_expire mod_fastcgi mod_indexfile mod_redirect mod_rewrite mod_scgi mod_setenv mod_simple_vhost mod_staticfile https://www.lighttpd.net/2023/5/10/1.4.70/ Therefore, the lighttpd-module-indexfile, lighttpd-module-staticfile and lighttpd-module-access no longer exist and must be removed from RDEPENDS and RRECOMMENDS. lighttpd 1.4.71 split out the http/2 support into optional separate module (mod_h2). By default the mod_h2 is not enabled. https://www.lighttpd.net/2023/5/27/1.4.71/ (From OE-Core rev: ae40fb21a0f85ce02fc137c6e3cce2a90778d75f) Signed-off-by: Petr Gotthard Signed-off-by: Richard Purdie

lighttpd: upgrade 1.4.68 -> 1.4.69

2023-02-15T10:21:34+00:00

fix-missing-test.patch removed since it's included in new verion. (From OE-Core rev: b88ffd2c41d99099d444e9a05b6d1b84090160a0) Signed-off-by: Wang Mingyu Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

lighttpd: upgrade 1.4.67 -> 1.4.68

2023-02-09T09:57:24+00:00

Rename options where appropriate. pcre option supports pcre2 now, so convert to that. (From OE-Core rev: 7da38c6bdce5692b1c0b24c7d7694123b5329588) Signed-off-by: Alexander Kanavin Signed-off-by: Luca Ceresoli Signed-off-by: Richard Purdie

lighttpd: upgrade 1.4.66 -> 1.4.67

2022-10-28T08:44:52+00:00

Changelog: ============= * Update comment about TCP_INFO on OpenBSD * [mod_ajp13] fix crash with bad response headers (fixes #3170) * [core] handle RDHUP when collecting chunked body * [core] tweak streaming request body to backends * [core] handle ENOSPC with pwritev() (#3171) * [core] manually calculate off_t max (fixes #3171) * [autoconf] force large file support (#3171) * [multiple] quiet coverity warnings using casts * [meson] add license keyword to project declaration (From OE-Core rev: 7a399862bb2e1503fbffa18e7ec0767643f76132) Signed-off-by: Wang Mingyu Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

lighttpd: fix CVE-2022-41556

2022-10-25T12:42:03+00:00

Backport the fix from upstream to fix this CVE. (From OE-Core rev: 59f69125fb00dc8fd335f32fe6898e7a480141e4) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

lighttpd: upgrade 1.4.65 -> 1.4.66

2022-08-21T21:51:42+00:00

(From OE-Core rev: 3163134b0f58c58aaabe4e957c30109e63b2d60f) Signed-off-by: Alexander Kanavin Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

lighttpd: upgrade 1.4.64 -> 1.4.65

2022-06-17T16:57:44+00:00

Changelog: ========== * [build] meson: fix typo in variable name * [build] autoconf: report if building with zstd * [build] meson -Dlua_version=... to specify lua ver * [core] avoid CCRandomGenerateBytes on MacOS <10.12 (fixes #3140) * [core] use diff var name w/ CCRandomGenerateBytes (fixes #3141) * [core] parse conf cmds with SHELL or /bin/sh * [core] fix HMAC with openssl 3.0 * [mod_webdav] no COPYFILE_CLONE_FORCE on OSX <10.12 (fixes #3142) * [mod_deflate] fix to return 304 with If-None-Match (fixes #3143) * [core] Illumos epoll incompatible w/ lighttpd impl * [core] feature flag to allow Range w/ HTTP/1.0 * [mod_mbedtls] set usekeysize for mbedtls 3.2.0+ * [mod_deflate] collect mmap code * [mod_deflate] prototype using libdeflate w/ mmap * [mod_deflate] --with-libdeflate to use libdeflate * [mod_deflate] mark input bytes const * [core] sys-setjmp.[ch] * [mod_magnet] check lighty.result.content b4 setjmp * [core] include guard consistency in sys-time.h * [core] network_write_file_chunk_remap separate fn * [multiple] use new sys_setjmp_eval3() interface * [multiple] pedantic chunk.c checks for 0-len chunk * [multiple] shared code for struct chunk and mmap * [mod_deflate] use pread if available * [mod_deflate] improve loop compressing file chunk * [core] prep server_tag at startup for h2 resp hdr * [mod_magnet] defer req_env init unless needed * [mod_magnet] reset after error attaching content * [mod_magnet] lua_tointegerx() avoids raising error * [mod_mbedtls] use newer mbedtls 3.2.0+ interfaces * [mod_magnet] adjust hot path for more inlining * [mod_magnet] collect chk for magnet lua_State init * [mod_magnet] use type returned from lua_getfield() * [core] chunk_file_pread() to wrap pread() * [core] disable keep-alive if forcing HTTP/1.0 resp * [mod_magnet] use lua_getextraspace() to store r * [core] fall back to getauxval(AT_RANDOM), if avail * [mod_magnet] keep message handler on stack * [doc] update external links * [mod_magnet] pass lighty table index, defer pops * [mod_magnet] clear and reuse script-env table * [mod_magnet] clear stack when reloading script * [mod_magnet] use lua_isnoneornil() in interfaces * [mod_magnet] fix lighty.c.cookie_tokens() * [mod_magnet] fix lighty.c.urldec_query() * [mod_magnet] remove duplicated NULL checks * [mod_magnet] adjust magnet_lighty_result_get() * [mod_magnet] magnet_tmpbuf_acquire(),release() * [mod_magnet] lighty.c.quotedenc(),dec() funcs * [mod_magnet] fix header,content legacy table clear * [mod_cgi] cgi.local-redir request_reset thru fnptr * [core] isolate plugins_*() funcs to main server * [mod_wolfssl] wolfssl v5.0.0 defines DH_set0_pqg() * [mod_auth] save letter-case diff in require config * [mod_magnet] magnet_push_quoted_string shared code * [mod_magnet] lighty.c.header_tokens convenience fn * [core] fill in un.sun_path after accept() (fixes #3147) * [mod_extforward] adjust trust check for HTTP/2 * [mod_proxy] adjust handling of legacy X-* headers * [core] permit env w/ blank value (fix regression) * [TLS] consistent debug.log-ssl-noise config type * [mod_magnet] allow removal of req_env elt via nil * [core] compiler workarounds for very old gcc,glibc * [mod_mbedtls] use newer mbedtls 3.2.0+ interfaces * [mod_ssi] check http_chunk_transfer_cqlen for err * [core] chunkqueue_steal() handle unexpected 0 len * [core] discard DATA from REFUSED_STREAM at h2 init * [multiple] WebSockets over HTTP/2 (fixes #3151) * [multiple] immed connect to backend for streaming * [core] ensure socket ready before checking connect * [core] reduce trace on Upgrade backend connection * [core] adjust when TCP_CORK used on TLS connection * [mod_cgi] disable input optim if might Upgrade * [mod_cgi] immed start CGI if Upgrade * [mod_wolfssl] wolfssl v5.0.0 adds ASN1_TIME_diff() * [mod_openssl] libressl v3.5.0 adds ASN1_TIME_diff * [TLS] warn if leaf cert read is inactive/expired * [core] stricter conformance w/ upcoming HTTP/2 rev * [build] -D_DEFAULT_SOURCE consistency in builds * [mod_extforward] support addtl IPv6 syntax w/ "[]" * [core] build fix for cygwin and lmingw * [core] short-circuit earlier parsing h2 trailers * [core] reformat h2.h for cleaner enum additions * [core] consolidate trace for log-state-handling * [core] request_config bitmasks for smaller struct * [core] prefix (=^), suffix (=$) config conditions (fixes #3153) * [core] tighten config parsing loop * [core] convert simple config cond regex to pre/sfx * [tests] able to run tests when built w/o pcre * [core] allow redirect,rewrite ext subst w/o pcre * [mod_sockproxy] reset http vers, avoid rare crash (fixes #3152) * [core] HTTP/2 PRIORITY_UPDATE frame (experimental) * [core] send HTTP/2 SETTINGS_NO_RFC7540_PRIORITIES * [core] stricter check of HTTP/2 GOAWAY frame size * [mod_mbedtls] use newer mbedtls 3.2.0+ interfaces * [mod_webdav] opt for partial PUT via copy/rename * [core] quiet compiler warning * [multiple] recognize HTTP QUERY method * [multiple] limit scope of socket config options * [core] fix config typo reading large int from str * [core] h2 prio sort urgency, incr, then stream id * [core] send Priority resp hdr w/ .css, .js re-prio * [multiple] reset http vers, avoid rare crash (fixes #3152) * [core] delay response to http auth invalid creds * [core] connection_state_machine_h2 only if con->h2 * [core] default server.max-keep-alive-requests 1000 * [mod_magnet] set script env in func first upvalue * [mod_magnet] rewrite lighty.r as table of userdata * [mod_status] con->h2 instead of r->http_version * [mod_setenv] cleanup user-provided hdr sloppiness * [core] remove func decls duplicated in plugin.h * [mod_status] fix counting of HTTP/2 bytes written * [mod_magnet] no local server port on unix domain * [mod_extforward] unix domain socket pedantic chks * [core] sketch support for abstract sockets * [mod_magnet] magnet_plugin_stats_table() fn * [mod_magnet] magnet_script_setup_global_state() fn * [mod_magnet] lighty.server.* table w/ new function * [mod_accesslog] do not double-count hdr len in %I * [mod_magnet] reduce magnet_env_get_id() scanning * [mod_magnet] tighten magnet_env_get_buffer_by_id() * [mod_status] reusable code for r->state strings * [core] reusable code for r->state strings * [mod_magnet] expose r->state to lua scripts * [mod_magnet] tighten magnet_env_set() * [mod_magnet] lighty.r.req_item[] accessors * [mod_magnet] expose r->keep_alive to lua scripts * [mod_magnet] lighty.c.hrtime high-resolution time * [mod_magnet] lighty.r.resp_body.get * [mod_magnet] deprecate r.req_attr["response.*] * [mod_magnet] separate funcs for uri_path_raw * [mod_magnet] lighty.c.stat high precision time * [mod_magnet] format multiline err traceback * [mod_magnet] adjust p->conf.stage checks * [mod_magnet] further isolate legacy API result tbl * [core] buffer_append_char() convenience func * [mod_accesslog] accesslog.escaping = "json" * [multiple] use buffer_append_char() * [mod_accesslog] remove begin/end tags from %{}t * [core] fix configparser_simplify_regex() comment * [multiple] simplify bytes_in/bytes_out accounting * [mod_accesslog] reorder fields in switch() * [core] remove unused srv->con_* counters * [mod_magnet] read-only access to r->server_name * [core] buffer_append_bs_escaped() * [core] buffer_append_string_c_escaped ASCII optim * [mod_magnet] backspace-escape encode/decode * [mod_status] display HTTP/2 control stream w/ reqs * [multiple] use preferred syntax for Content-Type * [doc] regenerate doc/config/conf.d/mime.conf * [multiple] rename status_counter -> plugin_stats * [core] feature-flag server.metrics-high-precision * [mod_magnet] quiet coverity false positive * [mod_wolfssl] compile fix for OpenWRT * [mod_webdav] If-None-Match: * on non-existent * [mod_magnet] r.req_body .collect .get .set .add * [mod_cgi] fix detection of failing error handler (fixes #3157) * [core] "url-invalid-utf8-reject" normalization opt * [mod_magnet] skip req body collect warn if modsec3 * [build] update descriptions to remove old lua ver * [core] use current dir if context->basedir blank * [multiple] application/javascript text/javascript * [core] reset internal flags after graceful restart * [TLS] inherit ssl.engine from global scope * [core] avoid server.use-ipv6 warning after SIGUSR1 * [mod_webdav] alt handling PROPFIND on collection * [mod_mbedtls] fix crt chain construction logic * [core] h2 SETTINGS_INITIAL_WINDOW_SIZE 64k (fixes #3089) * [core] increase session window size to 256k * [core] h2: avoid sending small WINDOW_UPDATE frames * [core] h2: avoid sending tiny DATA frames * [core] update cached tables with Priority header * [tests] test stubs for http_header.c and http_kv.c (From OE-Core rev: 47188fa0dc19f160085554360c81bd9f363837d5) Signed-off-by: Wang Mingyu Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

lighttpd: upgrade 1.4.63 -> 1.4.64

2022-01-26T06:27:00+00:00

0001-mod_extforward-fix-out-of-bounds-OOB-write-fixes-313.patch removed since it's included in 1.4.64. with_gdbm, with_memcached removed since they're not applicable in 1.4.64. Changelog: ========= Important changes remove deprecated modules, bugfixes, CVE-2022-22707 (rare configs) Behavior Changes (previously announced and scheduled) -graceful restart/shutdown timeout changed from 0 (disabled) to 8 seconds configure an alternative with: server.feature-flags += ("server.graceful-shutdown-timeout" => 8) build: lighttpd defaults to -with-pcre2 instead of -with-pcre pcre2 is current. pcre is no longer maintained. Explicitly specify -with-pcre in build to use pcre instead of pcre2. -deprecated modules (previously announced) have been removed mod_authn_mysql mod_mysql_vhost mod_cml mod_flv_streaming mod_geoip mod_trigger_b4_dl https://wiki.lighttpd.net/Docs_ConfigurationOptions#Deprecated suggests migration steps for replacements, if needed Changes from 1.4.63 [core] fix trace issued for loading mod_auth (fixes #3121) [meson] need -lrt with glibc < 2.17 (fixes #3120) [core] adjust time jump detection (fixes #3123) [core] make setrlimit() warn, not fatal [core] add remote IP to some error msgs (fixes #3122) [mod_webdav] If-None-Match on non-existent entity [build] check getxattr before attr_get and -lattr [doc] SELinux: setsebool -P httpd_setrlimit on [build] create sha512sum file with release [build] CI builds now use make -j 2 [core] http_response_send_file() takes const path [core] use ETag response header to check cachable [core] add more const to stat_cache_update_entry() [multiple] remove r->physical.etag [mod_magnet] interface to http_response_send_file [build] add headers for sendfile() detect on MacOS [core] http_response_write_prepare optimization [core] define static_assert for uClibc (fixes #3127) [build] -Wno-implicit-fallthrough for ls-hpack [core] ignore pcre2 "bad JIT option" warning [build] pcre2: use pkg-config before pcre2-config [core] http_response_has_error_handler() [core] consolidate request restart loop check [core] defer retrieving Last-Modified until needed [mod_dirlisting] fix logic inversion in cache [core] mark expect cond in http_response_send_file [core] connection_handle_read_state() tweak [core] connection_state_machine_loop() tweaks [core] connection_state_machine_h2() tweaks [core] quiet coverity noise [core] use lower limit for max-fds if !setrlimit [build] do not check for prctl; HAVE_PRCTL unused [core] server.core-files support on FreeBSD (fixes #3128) [mod_extforward] support longer PROXY v2 TLV vec [mod_webdav] detect truncated copy_file_range() [mod_webdav] copy_file_range() new in FreeBSD 13 [mod_webdav] copy_file_range() new in FreeBSD 13 [build] feature consistency between build types [build] cmake build now defaults to C11 [core] CCRandomGenerateBytes() for rand on macOS (fixes #3129) [multiple] remove long-deprecated modules [build] default -with-pcre2 unless -with-pcre [core] "server.graceful-shutdown-timeout" => 8 [build] adjust trace for regex-conditionals [build] update tests/SConscript [core] errno_t detection on Illumos [build] cmake build now defaults to C11 [build] meson: find pcre2 w/o pkg-config [core] define EXTENSIONS on Illumos [build] cmake,meson socket libs for win32, Illumos (fixes #3130) [core] hide bsd_accept_filter code on OpenBSD (fixes #3131) [core] errno_t and rsize_t detection on Illumos [mod_webdav] copy acceleration [mod_webdav] define HAVE_RENAMEAT2 earlier [build] meson misdetects mempcpy on some platforms [build] cmake: skip "-Wl,-export-dynamic" Illumos [build] adjust .gitignore for macOS [build] meson crypt and dl detection on *BSD (fixes #3133) [core] /dev/null is a symlink on Illumos (fixes #3132) [core] server.core-files support for solaris (fixes #3135) [build] feature consistency between build types [build] Haiku build fix (fixes #3136) [lemon] silence coverity warnings [cmake] raise minimum version to 3.7 [cmake] add address/undefined sanitize compile options [asan tests] fix memory leaks [array] use speaking names for array "fn" vtables for better debugging experience [ci] add cmake-asan build type [core] buffer_copy_string() use "" if s is NULL [mod_authn_gssapi] code reuse: fdevent_mkostemp() [mod_authn_gssapi] reduce KRB5CCNAME mem alloc [build] adjust help strings for pcre2 default [core] (const char *) for srvconf.modules_dir [multiple] remove buffer_init_string() [multiple] remove buffer_init_buffer() [mod_extforward] fix out-of-bounds (OOB) write (fixes #3134) [build] use -fstack-protector-strong w/ extra warn [build] collect Sun-specific headers and funcs [build] collect Sun-specific headers and funcs [build] rm redundant check for -lnetwork on Haiku [build] check headers before some funcs [core] allow LISTEN_PID to be ppid if TRACEME (fixes #3137) [core] allow tests/tmp/bind.conf override (#3137) [mod_webdav] no sys/ioctl.h on _WIN32 [tests] _WIN32 adjustments in LightyTest.pm [tests] revert _WIN32 adjustments in LightyTest.pm [mod_gnutls] lift size check out of DN loop [mod_mbedtls] lift size check out of DN loop [mbedtls] save (mbedtls_ssl_config *) in hctx [multiple] permit UTF-8 in SSL_CLIENT_S_DN_* [mod_openssl] do not esc UTF-8 in cert subject [mod_mbedtls] reconstruct SSL_CLIENT_S_DN [mod_mbedtls] changes to build with mbedtls 3.0.0 [mod_mbedtls] remove use of out_left in mbedtls 3 [mod_mbedtls] mbedtls_ssl_conf_groups for 3.1.0 (From OE-Core rev: 478f5f30bf783fae513dbe6e8be9af9f6ec8a6a8) Signed-off-by: Wang Mingyu Signed-off-by: Richard Purdie

lighttpd: backport a fix for CVE-2022-22707

2022-01-17T17:56:46+00:00

Backport the fix for CVE-2022-22707, a buffer overflow in mod_extforward. (From OE-Core rev: 7758596613cc442f647fd4625b36532f30e6129f) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

lighttpd: upgrade 1.4.61 -> 1.4.63

2021-12-17T09:56:14+00:00

(From OE-Core rev: 84de86213709abbd9dd3c61105652e7fafce5615) Signed-off-by: Alexander Kanavin Signed-off-by: Richard Purdie