(thx manfred)
Basic auth passwd cache might fail to match when it should have
matched (false negative) when comparing an uninitialized byte.
That bug "fails closed" and does not use the cache when it could.
This patch allows for proper match in the cache when it should match.
x-ref:
https://redmine.lighttpd.net/issues/3112
"mod_auth cache password doesn't match"
fix HTTP/2 upload > 64k with server.max-request-size > 0
(regression present only in lighttpd 1.4.60)
(thx SM)
x-ref:
"File upload is broken after upgrade from 1.4.59 to 1.4.60"
https://redmine.lighttpd.net/issues/3108
preserve remote IP until request reset
(historical IP restore in request_done hook was obsoleted by
commit fea5bdc8 in which request plugin context was split from
connection plugin context, and by much older commits which
ensured that request_reset hook was always run)
x-ref:
"Remote address behind reverse proxy not logged"
https://redmine.lighttpd.net/boards/2/topics/10041
Earlier macOS need _DARWIN_C_SOURCE defined for errno_t from sys/types.h
Alternatively, define __STDC_WANT_LIB_EXT1__ >= 1 before include errno.h
x-ref:
"error: unknown type name 'errno_t' (macOS 10.13.6)"
https://redmine.lighttpd.net/issues/3107
(thx helmut)
do not read-ahead past '\0' while url-decoding
lighttpd 1.4.60 could previously have read one byte of potentially
uninitialized data. lighttpd detects the '\0' so there is no exposure
of data. This also can not cause a crash in lighttpd 1.4.60 due to how
lighttpd 1.4.60 allocates memory for buffers in sizes (power-2 + 1),
and typical system malloc alignment of 4- or 8- bytes.
define __attribute_nonnull__(params) with params to match
recent changes in glibc development (targetting glibc 2.35 in Feb 2022)
x-ref:
new __attribute_nonnull__(params) conflicts with third-party
https://sourceware.org/bugzilla/show_bug.cgi?id=28425
chunkqueue_peek_data() experiment to mmap temporary files
(currently disabled in code due to not making measurable difference
in throughput (during a specific microbenchmark load test),
though it does reduce CPU use by ~10% in the same microbenchmark)
enabling this may cause large spikes in RSS mem usage reported by the
system, due to the read-only memory maps of the temporary files,
but this is nothing to be alarmed about, as the memory maps are
file-backed and read-only, so minimally add to memory pressure
allow up to 32k of data frames per stream per round
(previously limited to single max_frame_size (default 16k))
For 8 streams, 32k*8 is 256k, which is current lighttpd MAX_WRITE_LIMIT,
so each stream still gets a chance to write data (unless write queue
not emptied on previous attempt, reducing add limit this round)
cap size of data framed for HTTP/2 response until more data sent to
client
make sure to reschedule connection in job queue if max_bytes reached
and then the entire con->write_queue was flushed to network, or else
there is a chance the request may not get rescheduled (and then will
timeout) if the request is completed from the backend and there is
no other traffic or streams to trigger connection processing.
(check con->write_queue > 8k rather than empty from last round,
since small frames such as connection preface may have been added
this round while processing con->read_queue)
ignore SIGINT, SIGUSR1 in fcgi-responder if HAVE_SIGNAL is defined
(must be defined separately since config.h is not included)
Not required for test framework. Added as an example in the code,
e.g. if code is reused with lighttpd and graceful shutdown or restart.
(backend will be sent SIGTERM when server is ready to restart)
disable streaming response while processing "authorizer" mode
until "authorizer" response 200 OK from the backend is complete
(thx jefftharris)
x-ref:
"FastCGI authorizer hang with server.stream-response-body"
https://redmine.lighttpd.net/boards/2/topics/9969
"FastCGI authorizer hang with server.stream-response-body"
https://redmine.lighttpd.net/issues/3106
r->gw_dechunk->b is not a candidate for using generic chunk buffers.
chunked headers are generally smaller and fit in default 64 byte alloc.
Also, lighttpd limits chunked header to 1k.
Avoid unneeded optimization since HTTP/1.1 use is likely to diminish
over time in favor of HTTP/2 or HTTP/3 or later.
fix edge case for initial chunked data
(bug introduced in lighttpd 1.4.56)
If chunked header received without data before response headers sent,
then initial chunked data might be sent to client without chunked header
if client made an HTTP/1.1 request and the response is Transfer-Encoding
chunked and lighttpd is configured to stream the response (non-zero
value for server.stream-response-body). This might occur if lighttpd
backend is connected via a unix domain socket and the initial chunk is
large and coming from a temporary file. It may be sent in a separate
packet since lighttpd does not use TCP_CORK on unix domain sockets.
x-ref:
"Failure on second request in http proxy backend"
https://redmine.lighttpd.net/issues/3046
"Socket errors after update to version 1.4.56"
https://redmine.lighttpd.net/issues/3044
splice() data from backends to tempfiles (where splice() is available);
reduce copying data to userspace when writing data to tempfiles
Note: splice() on Linux returns EINVAL if target file has O_APPEND set
so lighttpd uses pwrite() (where available) when writing to tempfiles
(instead of lseek() + write(), or O_APPEND and write())
Note: Under _WIN32, serious limitation in Windows APIs:
select() and WSAPoll() operate only on sockets (not pipes)
(directly affects mod_cgi; not currently handled)
remove redundant checks for tempfile chunk reuse
c->file.is_temp is only set if c->type == FILE_CHUNK is also true
The test for (0 == c->offset) is historical. Before the temporary files
were opened O_APPEND (or written to using pwrite()), the file offset may
have changed via lseek() if lighttpd had started reading the file to
send to the client. To avoid this, the (0 == c->offset) check was used
as a quick check to avoid continuing to write to a temporary file that
lighttpd had begun to read.
rename chunkqueue_get_append_tempfile()
-> chunkqueue_get_append_newtempfile()
pull some code from chunkqueue_append_mem_to_tempfile()
into smaller func for (new func) chunkqueue_get_append_tempfile(),
which might call into chunkqueue_get_append_newtempfile()
pull some code from chunkqueue_append_mem_to_tempfile()
into smaller func chunkqueue_append_tempfile_err()
to handle write errors with respect to removing empty chunk
and stepping to next configured tempdir
server.feature-flags += ("server.errorlog-high-precision" => "enable")
Note: if using syslog() for errorlog, modern syslog implementations are
configured separately (by an admin) for high precision timestamps;
server.feature-flags has no effect on syslog-generated timestamps
restructure some of log.c into smaller internal routines
keep a file-scoped global log_stderrh to write to STDERR_FILENO
so that an errh handle is always available for logging errors
fix missing space between timestamp and filename in errorlog output
(missing space in lighttpd 1.4.58 and lighttpd 1.4.59) (fixes #3105)
x-ref:
"missing ( in log lines from mod_auth"
https://redmine.lighttpd.net/issues/3105
Glenn Strauss
Istiak Ferdous