Commit Graph

4631 Commits (0b49e767b906d6861f63d3764001bd73a65265dc)

Author SHA1 Message Date
Glenn Strauss 19569ab916 [core] default server.max-keep-alive-requests 1000
change default server.max-keep-alive-requests = 1000 to adjust
to increasing HTTP/2 usage and to web2/web3 application usage

prior default: server.max-keep-alive-requests = 100
2022-05-05 13:35:18 -04:00
Glenn Strauss 23409e75af [core] connection_state_machine_h2 only if con->h2
call connection_state_machine_h2() only if con->h2 has been initialized

(additional safeguard for #3152)

  "Random Segfaults with version 1.4.64 w/ mod_sockproxy and ALPN h2"
2022-05-05 13:35:18 -04:00
Glenn Strauss c183b8875b [core] delay response to http auth invalid creds
server.feature-flags += ("auth.delay-invalid-creds" => "enable")

The default is enabled.  This feature delays a response to bad http auth
(invalid username or password) to the next second, so up to 1 sec delay.
Delaying the response greatly reduces the efficiency of brute force
password attacks, limiting tries to one-per-second per connection.
Limiting the number of client connections allowed by lighttpd with
server.max-connections sets an upper bound on password tries per second,
but also makes it easier for an attacker to DoS (denial of service) the
server.  Therefore, while this mitigation is enabled by default, it can
be disabled with
  server.feature-flags += ("auth.delay-invalid-creds" => "disable")
2022-05-05 13:35:18 -04:00
Glenn Strauss fbade1850f [multiple] reset http vers, avoid rare crash (fixes #3152)
(thx ultimator)

do not set r->http_version to HTTP_VERSION_2 when selecting TLS ALPN
if r->handler_module already set, since handler module is likely
mod_sockproxy, and con->h2 will not get initialized.

This does continue to select "h2", so the mod_sockproxy backend
should be prepared to receive the HTTP/2 client connection preface.

  "Random Segfaults with version 1.4.64 w/ mod_sockproxy and ALPN h2"
2022-05-05 13:35:18 -04:00
Glenn Strauss 1ed3a78ea9 [core] send Priority resp hdr w/ .css, .js re-prio
send Priority response header with .css, .js re-prioriziation
2022-05-05 13:35:18 -04:00
Glenn Strauss 59b9a9a73d [core] h2 prio sort urgency, incr, then stream id
h2 priority sort based on urgency, incremental, then stream id
2022-05-05 13:35:18 -04:00
Glenn Strauss d48947ffa0 [core] fix config typo reading large int from str 2022-05-05 13:35:18 -04:00
Glenn Strauss b1f7ccd750 [multiple] limit scope of socket config options
warn if socket config options used only at startup are used outside
global scope or $SERVER["socket"] with '==' condition
2022-05-05 13:35:18 -04:00
Glenn Strauss d0494fc081 [multiple] recognize HTTP QUERY method
2022-05-05 13:35:16 -04:00
Glenn Strauss 206fafa37d [core] quiet compiler warning 2022-04-13 22:18:10 -04:00
Glenn Strauss 20b6ef9985 [mod_webdav] opt for partial PUT via copy/rename
option for partial PUT via copy/modify/rename

webdav.opts += ("partial-put-copy-modify" => "enable")

Some modern filesystems support efficiently cloning files,
making it less expensive to copy to a tempfile, modify, and
atomically rename the modified tempfile to replace the original.
2022-04-12 19:24:59 -04:00
Glenn Strauss f3258cef1f [mod_mbedtls] use newer mbedtls 3.2.0+ interfaces 2022-04-11 23:14:29 -04:00
Glenn Strauss 3795c6740c [core] stricter check of HTTP/2 GOAWAY frame size 2022-04-10 17:23:03 -04:00
Glenn Strauss 0f3075b885 [core] send HTTP/2 SETTINGS_NO_RFC7540_PRIORITIES
send HTTP/2 SETTINGS_NO_RFC7540_PRIORITIES=1 with server connection

RFC9218 Extensible Prioritization Scheme for HTTP
  2.1 Disabling RFC 7540 Priorities
  If endpoints use SETTINGS_NO_RFC7540_PRIORITIES they MUST send it in
  the first SETTINGS frame.

RFC7540 Hypertext Transfer Protocol Version 2 (HTTP/2)
  6.5.3.  Settings Synchronization
  Unsupported parameters MUST be ignored.

2022-04-10 11:50:03 -04:00
Glenn Strauss 9a3f6c521b [core] HTTP/2 PRIORITY_UPDATE frame (experimental)
*experimental* support for HTTP/2 PRIORITY_UPDATE frame

  "Extensible Prioritization Scheme for HTTP"
2022-04-10 08:12:27 -04:00
Glenn Strauss e5dc98faf3 [mod_sockproxy] reset http vers, avoid rare crash (fixes #3152)
(thx ultimator)

  "Random Segfaults with version 1.4.64 w/ mod_sockproxy and ALPN h2"
2022-04-08 06:33:02 -04:00
Glenn Strauss 63beba3a4c [core] allow redirect,rewrite ext subst w/o pcre
allow redirect and rewrite extended substitution when lighttpd is built
without pcre.  When built without pcre, url.rewrite and url.redirect
always match first list entry as if it were "", and numerical
substitutions ($0 %0 $1 %1 etc) are always ignored, but other extended
substitutions (e.g. ${url.path}) may still occur.
2022-04-08 06:33:02 -04:00
Glenn Strauss 7258624e51 [tests] able to run tests when built w/o pcre
perl test framework now runs most tests even when lighttpd has been
built without pcre support, though some tests which rely on regex
are skipped (tests/core-condition.t)
2022-04-08 06:33:02 -04:00
Glenn Strauss dcb5f2318b [core] convert simple config cond regex to pre/sfx
convert simple config condition regex to prefix/suffix match
2022-04-08 06:33:02 -04:00
Glenn Strauss b3e80a1363 [core] tighten config parsing loop 2022-04-08 06:33:02 -04:00
Glenn Strauss 39c312780e [core] prefix (=^), suffix (=$) config conditions (fixes #3153)
  "lighttpd.conf conditionals using prefix and suffix matching"
2022-04-08 06:31:50 -04:00
Glenn Strauss 8071b80388 [core] request_config bitmasks for smaller struct 2022-04-04 15:34:08 -04:00
Glenn Strauss efb24c54b9 [core] consolidate trace for log-state-handling
consolidate trace func for debug.log-state-handling = "enable"
2022-04-04 10:59:30 -04:00
Glenn Strauss 0012d7ef93 [core] reformat h2.h for cleaner enum additions
reformat h2.h for cleaner enum additions in the future
2022-04-03 08:03:45 -04:00
Glenn Strauss 8fa3014483 [core] short-circuit earlier parsing h2 trailers 2022-03-30 07:58:09 -04:00
Glenn Strauss aa4d9b63c3 [core] build fix for cygwin and lmingw 2022-03-30 04:43:35 -04:00
Glenn Strauss e298e868d6 [mod_extforward] support addtl IPv6 syntax w/ "[]"
support addtl IPv6 syntax w/ "[...]" in extforward.forwarder
when used with CIDR masks (n.b. only support "[]" with CIDR masks)
2022-03-30 03:49:47 -04:00
Glenn Strauss 1bb0cbc798 [build] -D_DEFAULT_SOURCE consistency in builds
(previously defined in src/CMakeLists.txt)
2022-03-29 15:30:49 -04:00
Glenn Strauss 772919f934 [core] stricter conformance w/ upcoming HTTP/2 rev
stricter conformance with upcoming HTTP and HTTP/2 RFC revisions
2022-03-29 02:04:24 -04:00
Glenn Strauss aea4a18098 [TLS] warn if leaf cert read is inactive/expired
When reading certificates, warn if leaf certificate is inactive/expired
(according to notBefore, notAfter fields of leaf certificate)
(note: not adding a delta for fudge factor when comparing times)
(note: not currently verifying each certificate in chain)
2022-03-28 00:03:19 -04:00
Glenn Strauss e202b187f9 [mod_openssl] libressl v3.5.0 adds ASN1_TIME_diff 2022-03-27 01:39:44 -04:00
Glenn Strauss d05289b1b2 [mod_wolfssl] wolfssl v5.0.0 adds ASN1_TIME_diff()
wolfssl v5.0.0 adds functional wolfSSL_ASN1_TIME_diff()
2022-03-27 00:45:44 -04:00
Glenn Strauss 317b4ba128 [mod_cgi] immed start CGI if Upgrade 2022-03-25 21:03:22 -04:00
Glenn Strauss ce9e0dfc6d [mod_cgi] disable input optim if might Upgrade
(thx pegasus)

disable CGI stdin input optimizations if CGI might Upgrade connection,
since if we upgrade protocols, the original Content-Length -- expected
to be 0 for Upgrade -- does not represent the end of the input.
2022-03-25 20:37:46 -04:00
Glenn Strauss 999457a0e4 [core] adjust when TCP_CORK used on TLS connection 2022-03-25 08:43:42 -04:00
Glenn Strauss b0e43f3bf7 [core] reduce trace on Upgrade backend connection
reduce trace on Upgrade'd backend connection when ECONNRESET received,
which, for example, apparently might occur if a backend calls close()
on socket without first calling shutdown(fd, SHUT_WR) -- seen on Linux
kernel 5.16.15 where lighttpd received ECONNRESET when trying to read()
(instead of receiving EOF).
2022-03-25 08:43:42 -04:00
Glenn Strauss 38a01d98ff [core] ensure socket ready before checking connect
ensure socket ready for writing before checking connect() status

(sanity check in case request gets rescheduled for another reason
 before the socket is ready for writing)
2022-03-25 08:43:42 -04:00
Glenn Strauss fa5e9b5364 [multiple] immed connect to backend for streaming
connect to backend (mod_cgi, mod_proxy, mod_sockproxy, mod_wstunnel)
for streaming request body without waiting for initial data in request
body.  Useful for things like websockets when data starts on server-side
2022-03-25 08:43:42 -04:00
Glenn Strauss 5d1aa5d06f [multiple] WebSockets over HTTP/2 (fixes #3151)
Add support for WebSockets over HTTP/2 to lighttpd core and to
  mod_cgi       w/ config: cgi.upgrade = "enable"
  mod_proxy     w/ config: proxy.header += ("upgrade" => "enable")

HTTP/2 CONNECT extension defined in RFC8441 is translated to HTTP/1.1
'Upgrade: websocket' requests to mod_cgi or mod_proxy, and is handled
directly in mod_wstunnel.

  WebSockets over HTTP/2
  Bootstrapping WebSockets with HTTP/2
2022-03-25 08:43:42 -04:00
Glenn Strauss 8fe9f1c053 [core] discard DATA from REFUSED_STREAM at h2 init
discard DATA from REFUSED_STREAM at h2 connection init
while waiting for SETTINGS ackn from client

This is not a bugfix in lighttpd, but rather is a workaround for
impolite/aggressive/dumb/lazy (take your picks) client behavior.

  "POST request DATA part for non-existing URI closes HTTP/2 connection prematurely"
  "HTTP/2 Error"
  "Possible HTTP/2 error - GOAWAY sent"
  "[WAD] HTTP/2 GOAWAY with excessive PUT requests exceeding stream concurrency limit"
2022-03-25 08:43:42 -04:00
Glenn Strauss 1f4cc7476d [core] chunkqueue_steal() handle unexpected 0 len
pedantic: chunkqueue_steal() handle unexpected 0 len and 0-length chunks

more code reuse (slightly more instructions) when pwritev not available
2022-03-25 08:43:42 -04:00
Glenn Strauss c6c0873e8a [mod_ssi] check http_chunk_transfer_cqlen for err
pedantic check of http_chunk_transfer_cqlen() for error
2022-03-25 08:43:42 -04:00
Glenn Strauss f82006a0db [mod_mbedtls] use newer mbedtls 3.2.0+ interfaces 2022-03-25 08:43:42 -04:00
Glenn Strauss 54c07b5456 [core] compiler workarounds for very old gcc,glibc
added in gcc 4.6:
  #pragma GCC diagnostic push
  #pragma GCC diagnostic pop
added in gcc 5 (?):
  fix for error: #pragma GCC diagnostic not allowed inside functions

2022-03-12 00:07:54 -05:00
Glenn Strauss 75017b72f8 [mod_magnet] allow removal of req_env elt via nil
allow removal of lighty.r.req_env[] element by assigning nil value
(blank values ("") are permitted for environment variables,
 unlike request and response headers)
2022-03-11 01:08:34 -05:00
Glenn Strauss 26e27f140d [TLS] consistent debug.log-ssl-noise config type
(thx flynn)

2022-03-10 04:17:50 -05:00
Glenn Strauss bd67d9f4ac [core] permit env w/ blank value (fix regression)
(thx Lars Bingchong)

empty env var must be set to blank string and not left unset
(regression in lighttpd 1.4.56 - lighttpd 1.4.64)

2022-03-09 19:51:42 -05:00
Glenn Strauss e447de1b66 [mod_proxy] adjust handling of legacy X-* headers
append to X-Forwarded-For

overwrite X-Host, X-Forwarded-Host, X-Forwarded-Proto
(with value that might be obtained from trusted downstream proxy
 configured with mod_extforward)
(do not blindly pass through client-provided values, unless
 mod_extforward has been configured to trust the downstream proxy)

(RFC 7239 Forwarded is a standardized header with structured format
 and ought to be preferred over the legacy X-* headers, where available)
2022-03-09 19:50:09 -05:00
Glenn Strauss 18c5f3eb48 [mod_extforward] adjust trust check for HTTP/2
adjust trust check for HTTP/2 streams, as trust is cached at the
connection level, but headers and scheme may need to be overwritten
2022-03-08 01:41:29 -05:00
Glenn Strauss 0e404df2fb [core] fill in un.sun_path after accept() (fixes #3147)
(thx fstelzer)

  "mod_proxy breaks X-Forwarded-For on requests via unix sockets"
2022-03-03 20:46:33 -05:00