Commit Graph

4631 Commits (0b49e767b906d6861f63d3764001bd73a65265dc)

Author SHA1 Message Date
Glenn Strauss 7901259fbb [core] fix HMAC with openssl 3.0
(thx ryandesign)

2022-01-22 12:18:35 -05:00
Glenn Strauss d7a76d109e [core] parse conf cmds with SHELL or /bin/sh
(thx ryandesign)

Use $SHELL -c to execute commands if SHELL is set and is not set to
/usr/bin/false or /bin/false, else use /bin/sh -c

2022-01-22 12:18:35 -05:00
Glenn Strauss c0803bec08 [core] use diff var name w/ CCRandomGenerateBytes (fixes #3141)
(thx ryandesign)

CCRandomGenerateBytes is a fallback and might be present alongside
crypto libraries which (previously) used the same variable name.

  "error: redefinition of 'i'"
2022-01-22 12:18:35 -05:00
Glenn Strauss 6791f71b20 [core] avoid CCRandomGenerateBytes on MacOS <10.12 (fixes #3140)
(thx ryandesign)

  "lighttpd build failure on macOS 10.13 and earlier"
2022-01-22 12:18:26 -05:00
Glenn Strauss 7792bc7230 [build] meson -Dlua_version=... to specify lua ver
(thx herbmillerjr)

2022-01-21 12:48:10 -05:00
Glenn Strauss 37dd53bae9 [build] autoconf: report if building with zstd 2022-01-20 07:06:57 -05:00
Glenn Strauss 876a1e1b2c [build] meson: fix typo in variable name 2022-01-20 07:04:51 -05:00
Glenn Strauss 2a683cf25d - next is 1.4.65 2022-01-19 13:18:39 -05:00
Glenn Strauss 73bd6b41d3 [doc] NEWS 2022-01-19 10:35:29 -05:00
Glenn Strauss 274f8ce0bc [mod_mbedtls] mbedtls_ssl_conf_groups for 3.1.0
use mbedtls_ssl_conf_groups() for mbedtls 3.1.0
(replaces deprecated mbedtls_ssl_conf_curves())
2022-01-19 09:03:09 -05:00
Glenn Strauss 4f48825542 [mod_mbedtls] remove use of out_left in mbedtls 3
remove use of ssl->out_left in mbedtls 3.0.0

Discussed in,
the current implementations of mbedtls_net_send() and mbedtls_net_recv()
return MBEDTLS_ERR_SSL_WANT_WRITE only when there is a partial write
(though there is theoretical issue if writes are mixed with TLS alerts)

  "issues migrating lighttpd mod_mbedtls to mbedtls 3.0.0"
2022-01-19 08:28:23 -05:00
Glenn Strauss 955c95bf51 [mod_mbedtls] changes to build with mbedtls 3.0.0
  "issues migrating lighttpd mod_mbedtls to mbedtls 3.0.0"
2022-01-19 08:28:23 -05:00
Glenn Strauss 6f65dae4a5 [mod_mbedtls] reconstruct SSL_CLIENT_S_DN
reconstruct SSL_CLIENT_S_DN in lighttpd due to limitations of
mbedtls_x509_dn_gets().  Adds support for non-ASCII UTF-8,
but loses support for multi-valued RDNs.

  "Add access to mbedtls_x509_name::next_merged"
2022-01-18 08:46:05 -05:00
Glenn Strauss a300c87b86 [mod_openssl] do not esc UTF-8 in cert subject
unset flag which escapes chars with most-significant-bit set
for clean display of non-ASCII UTF-8 chars in cert subject

  man X509_NAME_oneline
  man ASN1_STRING_print_ex
2022-01-17 10:05:34 -05:00
Glenn Strauss 3426faf5ae [multiple] permit UTF-8 in SSL_CLIENT_S_DN_*
permit non-ASCII UTF-8 in SSL_CLIENT_S_DN_*

2022-01-16 13:05:50 -05:00
Glenn Strauss 3ac377177b [mbedtls] save (mbedtls_ssl_config *) in hctx
(cleaner approach and compatible with mbedtls 3.0.0)
2022-01-14 05:22:33 -05:00
Glenn Strauss efcc51c129 [mod_mbedtls] lift size check out of DN loop
lift size check out of client Subject DN loop
move loop invariant into for() declaration
2022-01-14 05:22:33 -05:00
Glenn Strauss 8a46e0b941 [mod_gnutls] lift size check out of DN loop
lift size check out of client Subject DN loop
2022-01-14 05:22:33 -05:00
Glenn Strauss d1b5f52e96 [tests] revert _WIN32 adjustments in
This reverts commit c1bc5efe9a.
2022-01-14 05:22:33 -05:00
Glenn Strauss c1bc5efe9a [tests] _WIN32 adjustments in
separate cygwin paths from Windows native paths

remove unnecessary variables
remove unnecessary file copies
2022-01-11 02:53:20 -05:00
Glenn Strauss faa134cad5 [mod_webdav] no sys/ioctl.h on _WIN32 2022-01-10 22:38:32 -05:00
Glenn Strauss 93bc7f2695 [core] allow tests/tmp/bind.conf override (#3137)
optional bind spec override for tests/*.conf,
e.g. for use on platforms w/o socket activation

  "TRACEME environment option in tests broken with LISTEN_PID"
2022-01-10 22:38:32 -05:00
Glenn Strauss 1e335b3724 [core] allow LISTEN_PID to be ppid if TRACEME (fixes #3137)
allow LISTEN_PID to be ppid (parent pid) if TRACEME set in environment
(e.g. for strace, gdb on Linux; valgrind starts lighttpd as LISTEN_PID)

  "TRACEME environment option in tests broken with LISTEN_PID"
2022-01-10 22:38:32 -05:00
Glenn Strauss aeba314454 [build] check headers before some funcs
skip some func checks (slow) if expected header does not exist
2022-01-10 22:38:27 -05:00
Glenn Strauss 618fb436f2 [build] rm redundant check for -lnetwork on Haiku 2022-01-08 18:09:42 -05:00
Glenn Strauss c0ced4e82b [build] collect Sun-specific headers and funcs
sendfilev() is Solaris-specific (and other OS have other alternatives)
2022-01-08 18:09:42 -05:00
Glenn Strauss 448621e026 [build] collect Sun-specific headers and funcs 2022-01-08 14:07:54 -05:00
Glenn Strauss f95ca5ef3b [build] use -fstack-protector-strong w/ extra warn
use -fstack-protector-strong if configured with --enable-extra-warnings
2022-01-08 13:33:02 -05:00
povcfe 8c62a890e2 [mod_extforward] fix out-of-bounds (OOB) write (fixes #3134)
(thx povcfe)

(edited: gstrauss)

There is a potential remote denial of service in lighttpd mod_extforward
under specific, non-default and uncommon 32-bit lighttpd mod_extforward

Under specific, non-default and uncommon lighttpd mod_extforward
configurations, a remote attacker can trigger a 4-byte out-of-bounds
write of value '-1' to the stack. This is not believed to be exploitable
in any way beyond triggering a crash of the lighttpd server on systems
where the lighttpd server has been built 32-bit and with compiler flags
which enable a stack canary -- gcc/clang -fstack-protector-strong or
-fstack-protector-all, but bug not visible with only -fstack-protector.

With standard lighttpd builds using -O2 optimization on 64-bit x86_64,
this bug has not been observed to cause adverse behavior, even with
gcc/clang -fstack-protector-strong.

For the bug to be reachable, the user must be using a non-default
lighttpd configuration which enables mod_extforward and configures
mod_extforward to accept and parse the "Forwarded" header from a trusted
proxy. At this time, support for RFC7239 Forwarded is not common in CDN
providers or popular web server reverse proxies. It bears repeating that
for the user to desire to configure lighttpd mod_extforward to accept
"Forwarded", the user must also be using a trusted proxy (in front of
lighttpd) which understands and actively modifies the "Forwarded" header
sent to lighttpd.

lighttpd natively supports RFC7239 "Forwarded"
hiawatha natively supports RFC7239 "Forwarded"

nginx can be manually configured to add a "Forwarded" header

A 64-bit build of lighttpd on x86_64 (not known to be affected by bug)
in front of another 32-bit lighttpd will detect and reject a malicious
"Forwarded" request header, thereby thwarting an attempt to trigger
this bug in an upstream 32-bit lighttpd.

The following servers currently do not natively support RFC7239 Forwarded:

Given the general dearth of support for RFC7239 Forwarded in popular
CDNs and web server reverse proxies, and given the prerequisites in
lighttpd mod_extforward needed to reach this bug, the number of lighttpd
servers vulnerable to this bug is estimated to be vanishingly small.
Large systems using reverse proxies are likely running 64-bit lighttpd,
which is not known to be adversely affected by this bug.

In the future, it is desirable for more servers to implement RFC7239
Forwarded.  lighttpd developers would like to thank povcfe for reporting
this bug so that it can be fixed before more CDNs and web servers
implement RFC7239 Forwarded.

  "mod_extforward plugin has out-of-bounds (OOB) write of 4-byte -1"
  (not yet written or published)
2022-01-08 13:07:12 -05:00
Glenn Strauss 51e141c803 [multiple] remove buffer_init_buffer()
remove (minor) convenience func; easy to replace

Like buffer_init_string(), buffer_init_buffer() was used in only a few
places at startup or in cold funcs, so better off removed from buffer.c
2022-01-07 02:06:08 -05:00
Glenn Strauss bade1c0319 [multiple] remove buffer_init_string()
remove (minor) convenience func; easy to replace
2022-01-07 02:06:08 -05:00
Glenn Strauss 10b307bd00 [core] (const char *) for srvconf.modules_dir
no need to be allocated (buffer *)
2022-01-07 02:06:08 -05:00
Glenn Strauss e563ae0173 [build] adjust help strings for pcre2 default 2022-01-07 02:06:08 -05:00
Glenn Strauss 9fcb03b68f [mod_authn_gssapi] reduce KRB5CCNAME mem alloc
reuse KRB5CCNAME path saved in r->env

request_reset() calls plugin cleanups (where KRB5CCNAME path unlinked)
before freeing the string from r->env.
2022-01-07 02:06:08 -05:00
Glenn Strauss 2e0b7cfb07 [mod_authn_gssapi] code reuse: fdevent_mkostemp() 2022-01-07 02:06:08 -05:00
Glenn Strauss e174e7dfe3 [core] buffer_copy_string() use "" if s is NULL
same for buffer_append_string()
2022-01-07 02:06:08 -05:00
Stefan Bühler f6d6295ab4 [ci] add cmake-asan build type 2022-01-06 19:30:56 -05:00
Stefan Bühler ae2fb97494 [array] use speaking names for array "fn" vtables for better debugging experience 2022-01-06 16:24:35 +01:00
Stefan Bühler f3052d6a5d [asan tests] fix memory leaks 2022-01-06 16:24:32 +01:00
Stefan Bühler 61fa90bbc0 [cmake] add address/undefined sanitize compile options 2022-01-06 16:23:52 +01:00
Stefan Bühler a092235121 [cmake] raise minimum version to 3.7
cmake 3.7.0 was tagged on 2016-11-11
debian stretch (currentyl oldoldstable): 3.7.2
ubuntu bionic (18.04LTS): 3.10.2
2022-01-06 15:49:16 +01:00
Glenn Strauss 8ebe1c5333 [lemon] silence coverity warnings 2022-01-06 05:00:40 -05:00
David Carlier c0f040eae7 [build] Haiku build fix (fixes #3136)
Haiku needs to link to additional lib -lnetwork for socket funcs
(similar to Solaris need for -lsocket -lnsl)

(edited: gstrauss)

  "haiku build fix proposal"
2022-01-06 02:03:31 -05:00
Glenn Strauss 1b11cd7aeb [build] feature consistency between build types 2022-01-05 07:28:21 -05:00
David Carlier b6bd11c15e [core] server.core-files support for solaris (fixes #3135)
server.core-files support for solaris based systems.

- using setpflags and disable process tracing protection for the current process.

(edited: gstrauss)

  "server.core-files support on Solaris based system"
2022-01-05 06:52:24 -05:00
Glenn Strauss 3d0f648948 [core] /dev/null is a symlink on Illumos (fixes #3132)
(thx devnexen)

also fix IPv6 detection on Illumos in CMake

  "Solaris little nit build fix and startup fix"
2022-01-05 03:02:13 -05:00
Glenn Strauss 94a16b2b53 [build] meson crypt and dl detection on *BSD (fixes #3133)
(thx devnexen)

  "netbsd meson build fix"
2022-01-04 21:27:51 -05:00
Glenn Strauss fa1ee081c3 [build] adjust .gitignore for macOS 2022-01-04 21:27:51 -05:00
Glenn Strauss f72de7113f [build] cmake: skip "-Wl,-export-dynamic" Illumos
(thx devnexen)

cmake: do not pass "-Wl,-export-dynamic" to Sun ld on Illumos

  "Solaris build fix proposal"
2022-01-04 21:27:51 -05:00
Glenn Strauss d6741c58ce [build] meson misdetects mempcpy on some platforms
(thx devnexen)

  "Meson misdetects some functions with mingw-w64"
  "Solaris build fix proposal"
  "netbsd meson build fix"
2022-01-04 21:27:51 -05:00