tag:www.lighttpd.net,2008:mephisto/ Mephisto Noh-Varr 2008-03-24T15:07:23Z darix tag:www.lighttpd.net,2008-03-10:614 2008-03-10T23:44:00Z 2008-03-24T15:07:23Z <p>Long time no see.</p> <p> It has been almost half a year since 1.4.18. 6months. Jan has been working on many interesting features for 1.5. [<a href="#f1">1</a>] Currently he ports it to <a href="http://blog.lighttpd.net/articles/2008/02/19/project-glib-it-compiles-mostly">glib2</a>. </p> <p> But back to 1.4.19. Yes again the release date was nailed down by a few security bugs. *cough* Nevertheless we got a ton of other nice bugfixes. All praise our new lighttpd hero Stefan B&uuml;hler. Big thank you from my side. (darix) </p> <ul> <li> <a href="/security/lighttpd_sa_2008_01.txt">lighttpd_sa_2008_01.txt</a> (patch: <a href="/security/lighttpd-1.4.x_high_load_dos.patch">lighttpd-1.4.x_high_load_dos.patch</a>)</li> <li> <a href="/security/lighttpd_sa_2008_02.txt">lighttpd_sa_2008_02.txt</a> (patch: <a href="/security/lighttpd-1.4.x_mod_cgi_disclosure.patch">lighttpd-1.4.x_mod_cgi_disclosure.patch</a>) </li> <li> <a href="/security/lighttpd_sa_2008_03.txt">lighttpd_sa_2008_03.txt</a> (patch: <a href="/security/lighttpd-1.4.x_mod_userdir_disclosure.patch">lighttpd-1.4.x_mod_userdir_disclosure.patch</a>) </li> </ul> <h2>Download</h2> <ul> <li> <a href="/download/lighttpd-1.4.19.tar.gz">lighttpd-1.4.19.tar.gz</a><br /> (<code>sha1sum: 79e2d61dd9017c3c50c0fe98b2289cae5c1255ee<br /> md5sum: cede410e7adee3ea14206749190a8b5d</code> ) </li> <li> <a href="/download/lighttpd-1.4.19.tar.bz2">lighttpd-1.4.19.tar.bz2</a><br /> (<code>sha1sum: fd4450e7faae55ebe0905114722995b0c57397cc<br /> md5sum: d787374e4e4aaa09d5cfa9ab9d23ad40</code>) </li> </ul> <h2>Changes</h2> <ul> <li>added support for If-Range: &lt;date&gt; (<a href="http://trac.lighttpd.net/trac/ticket/1346">#1346</a>)</li> <li>added support for matching $HTTP["scheme"] in configs</li> <li>fixed initgroups() called after chroot (<a href="http://trac.lighttpd.net/trac/ticket/1384">#1384</a>)</li> <li>fixed case-sensitive check for Auth-Method (<a href="http://trac.lighttpd.net/trac/ticket/1456">#1456</a>)</li> <li>execute fcgi app without /bin/sh if used as argument to spawn-fcgi (<a href="http://trac.lighttpd.net/trac/ticket/1428">#1428</a>)</li> <li>fixed a bug that made /-prefixed extensions being handled also when matching the end of the uri in fcgi,scgi and proxy modules (<a href="http://trac.lighttpd.net/trac/ticket/1489">#1489</a>)</li> <li>print error if X-LIGHTTPD-send-file cannot be done; reset header Content-Length for send-file. Patches by Stefan Buehler</li> <li>prevent crash in certain php-fcgi configurations (<a href="http://trac.lighttpd.net/trac/ticket/841">#841</a>)</li> <li>add IdleServers and Scoreboard directives in ?auto mode for mod_status (<a href="http://trac.lighttpd.net/trac/ticket/1507">#1507</a>)</li> <li>open log immediately after daemonizing, fixes SIGPIPEs on startup (<a href="http://trac.lighttpd.net/trac/ticket/165">#165</a>)</li> <li>HTTPS env var should be "on" when using mod_extforward and the X-Forwarded-Proto header is set. (<a href="http://trac.lighttpd.net/trac/ticket/1499">#1499</a>)</li> <li>generate ETag and Last-Modified headers for mod_ssi based on newest modified include (<a href="http://trac.lighttpd.net/trac/ticket/1491">#1491</a>)</li> <li>support letterhomes in mod_userdir (<a href="http://trac.lighttpd.net/trac/ticket/1473">#1473</a>)</li> <li>support chained proxies in mod_extforward (<a href="http://trac.lighttpd.net/trac/ticket/1528">#1528</a>)</li> <li>fixed bogus "cgi died ?" if we kill the CGI process on shutdown</li> <li>fixed ECONNRESET handling in network-openssl</li> <li>fixed handling of EAGAIN in network-linux-sendfile (<a href="http://trac.lighttpd.net/trac/ticket/657">#657</a>)</li> <li>reset conditional cache (<a href="http://trac.lighttpd.net/trac/ticket/1164">#1164</a>)</li> <li>create directories in mod_compress (was broken with alias/userdir) (<a href="http://trac.lighttpd.net/trac/ticket/1027">#1027</a>)</li> <li>fixed out of range access in fd array (<a href="http://trac.lighttpd.net/trac/ticket/1562">#1562</a>, <a href="http://trac.lighttpd.net/trac/ticket/372">#372</a>) (<a href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0983">CVE-2008-0983</a>)</li> <li>mod_compress should check if the request is already handled, e.g. by fastcgi (<a href="http://trac.lighttpd.net/trac/ticket/1565">#1565</a>)</li> <li>remove broken workaround for buggy Opera version with ssl/chunked encoding (<a href="http://trac.lighttpd.net/trac/ticket/285">#285</a>)</li> <li>generate etag/last-modified header for on-the-fly-compressed files (<a href="http://trac.lighttpd.net/trac/ticket/1171">#1171</a>)</li> <li>req-method OPTIONS: do not insert default response if request was denied, do not deny OPTIONS by default (<a href="http://trac.lighttpd.net/trac/ticket/1324">#1324</a>)</li> <li>fixed memory leak on windows (<a href="http://trac.lighttpd.net/trac/ticket/1347">#1347</a>)</li> <li>fixed building outside of the src dir (<a href="http://trac.lighttpd.net/trac/ticket/1349">#1349</a>)</li> <li>fixed including of stdint.h/inttypes.h in etag.c (<a href="http://trac.lighttpd.net/trac/ticket/1413">#1413</a>)</li> <li>do not add Accept-Ranges header if range-request is disabled (<a href="http://trac.lighttpd.net/trac/ticket/1449">#1449</a>)</li> <li>log the ip of failed auth tries in error.log (enhancement <a href="http://trac.lighttpd.net/trac/ticket/1544">#1544</a>)</li> <li>fixed RoundRobin in mod_proxy (<a href="http://trac.lighttpd.net/trac/ticket/516">#516</a>)</li> <li>check for symlinks after successful pathinfo matching (<a href="http://trac.lighttpd.net/trac/ticket/1574">#1574</a>)</li> <li>fixed mod-proxy.t to run with a builddir outside of the src dir</li> <li>do not suppress content on "307 Temporary Redirect" (<a href="http://trac.lighttpd.net/trac/ticket/1412">#1412</a>)</li> <li>fixed Content-Length header if response body gets removed in connections.c (<a href="http://trac.lighttpd.net/trac/ticket/1412">#1412</a>, part 2)</li> <li>do not generate a "Content-Length: 0" header for HEAD requests, added test too</li> <li>remove compress cache file if compression or write failed (<a href="http://trac.lighttpd.net/trac/ticket/1150">#1150</a>)</li> <li>fixed body handling of status 300 requests </li> <li>spawn-fcgi: only try to connect to unix socket (not tcp) before spawning (<a href="http://trac.lighttpd.net/trac/ticket/1575">#1575</a>)</li> <li>fix sending source of cgi script instead of 500 error if fork fails (<a href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1111">CVE-2008-1111</a>)</li> <li>fix min-procs handling in mod_scgi.c, just set to max-procs (patch from <a href="http://trac.lighttpd.net/trac/ticket/623">#623</a>)</li> <li>fix sending "408 - Timeout" instead of "410 - Gone" for timedout urls in mod_secdownload (<a href="http://trac.lighttpd.net/trac/ticket/1440">#1440</a>)</li> <li>workaround <a href="http://trac.lighttpd.net/trac/ticket/1587">#1587</a>: require userdir.path to be set to enable mod_userdir (empty string allowed) (<a href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1270">CVE-2008-1270</a>)</li> <li>make configure checks for --with-pcre, --with-zlib and --with-bzip2 failing if the headers aren't found</li> <li>fixed handling of waitpid() == EINTR mod_ssi on solaris </li> </ul> <p>[<a>1</a>] No. We don't have a release date for it. Especially not with all the big changes going on.<br /></p> jan tag:www.lighttpd.net,2008-01-23:607 2008-01-23T16:49:00Z 2008-01-23T17:05:50Z <p><a href="http://www.reggieburnett.com">Reggie</a> pointed me to the <a href="http://www.mono-project.com/FastCGI">FastCGI support for Mono</a>. For our lighttpd they have a <a href="http://www.mono-project.com/FastCGI_Lighttpd">full featured page</a> that should cover all possible configuration needs.</p> <p>Feel free to try it out and comment on this article if it works as expected.</p> jan tag:www.lighttpd.net,2007-10-28:596 2007-10-28T10:50:00Z 2007-10-28T13:35:06Z

<p>Weekend time is hacking time. This weekend it is about getting 1.5.0 running nicely on Solaris and making sure lighttpd is a first class citizen there.</p> <pre><code>All tests successful (1 subtest UNEXPECTEDLY SUCCEEDED), 88 subtests skipped. Files=22, Tests=324, 60 wallclock secs ( 1.98 cusr + 1.03 csys = 3.01 CPU) </code></pre>

<p>Weekend time is hacking time. This weekend it is about getting 1.5.0 running nicely on Solaris and making sure lighttpd is a first class citizen there.</p> <pre><code>All tests successful (1 subtest UNEXPECTEDLY SUCCEEDED), 88 subtests skipped. Files=22, Tests=324, 60 wallclock secs ( 1.98 cusr + 1.03 csys = 3.01 CPU) </code></pre> <p>The over all situation hasn't changed: I still don't have a solaris box here for development here and I think that's a good thing. Instead I run Nexenta (aka gnu/solaris) in a VMware on WinXP/x64. And use ssh to log into it :)</p> <p>I would like to do the same with my MacOSX too. Up to now I use the MacMini (the old, PPC one) and only log in via ssh for compiling too. Turning it into a vmware image I can start up when needed would be a lot better as it doesn't require me to start another load, power-consuming box.</p> <p>But back solaris:</p> <ul> <li>compiles cleanly on solaris 11 with GCC</li> <li>runs test-suite cleanly</li> <li>detects special features and uses them (sendfilev, /dev/poll)</li> </ul> <p>This should make the current trunk/ running nicely on Solaris. So, give it a try please so we can push out 1.5.0 soon.</p> jan tag:www.lighttpd.net,2007-04-04:278 2007-04-04T06:44:00Z 2007-04-04T07:09:13Z <p><code>lighttpd</code> is used by many well-known sites. The typical scenario is using lighttpd as off-load server to <a href="http://lighttpd.net/benchmark">push out static content</a> and leave to complex work to another server. </p> <ul> <li><a href="http://news.netcraft.com/archives/2007/04/02/april_2007_web_server_survey.html">Lighttpd enters the Top5</a></li> <li><a href="http://blog.lighttpd.net/articles/2006/12/28/lighttpd-powers-5-alexa-top-250-sites">Lighttpd powers 5 Alexa Top 250 sites</a></li> </ul> <p>One example is <a href="http://youtube.com/">YouTube</a>. They have a farm of servers which push out the thumbnails you see before you see the movies:</p> <pre> $ curl -I http://sjl-static16.sjl.youtube.com/vi/TgF_eRkfqEY/2.jpg HTTP/1.1 200 OK Content-Type: image/jpeg ETag: "983726135810477085" Accept-Ranges: bytes Last-Modified: Fri, 03 Feb 2006 04:32:53 GMT Content-Length: 3495 Date: Wed, 04 Apr 2007 06:49:51 GMT Server: lighttpd-aio/1.4.11.8 </pre> <p>As you see in the name-scheme, there are some more of those servers pushing out content.</p> <p>On wikipedia they run at least 2 servers with lighttpd:</p> <ul> <li>upload.wikimedia.org</li> <li>download.wikimedia.org</li> </ul> <p>While <code>download</code> is used to distribute the SQL dumps of the database when tend to grow above the magic 4GByte border, upload is used to push out all the images and resize them when necessary.</p> <pre> $ curl -I http://upload.wikimedia.org/wikipedia/commons/thumb/2/21/Mandel_zoom_00_mandelbrot_set.jpg/250px-Mandel_zoom_00_mandelbrot_set.jpg HTTP/1.0 200 OK Content-Type: image/jpeg ETag: "6460328581220324712" Accept-Ranges: bytes Last-Modified: Mon, 04 Dec 2006 22:24:53 GMT Content-Length: 5973 Date: Wed, 14 Mar 2007 11:16:19 GMT Server: lighttpd/1.4.13 X-Cache: HIT from sq13.wikimedia.org X-Cache-Lookup: HIT from sq13.wikimedia.org:3128 X-Cache: HIT from knsq12.knams.wikimedia.org X-Cache-Lookup: HIT from knsq12.knams.wikimedia.org:3128 Age: 6265 X-Cache: HIT from knsq10.knams.wikimedia.org X-Cache-Lookup: HIT from knsq10.knams.wikimedia.org:80 Via: 1.0 sq13.wikimedia.org:3128 (squid/2.6.STABLE12), 1.0 knsq12.knams.wikimedia.org:3128 (squid/2.6.STABLE12), 1.0 knsq10.knams.wikimedia.org:80 (squid/2.6.STABLE12) Connection: close </pre>