Commit Graph

2372 Commits

Author SHA1 Message Date
Glenn Strauss 1836309209 [core] resolve DNS at startup for socket backends
resolve DNS at startup and use the first IP address returned by resolver

Note: use of IP addresses is recommended instead of using DNS names.
If DNS names are used, but DNS is slow or unavailable, then lighttpd
will either appear to hang at startup or will fail to start up.
2017-07-23 19:02:30 -04:00
Glenn Strauss 0beb8b89d8 [core] store sockaddr for socket backend procs
store struct sockaddr for socket backend procs at startup
2017-07-23 19:02:30 -04:00
Glenn Strauss b6d0818762 [core] spread load on socket backend procs
connection attempts in progress count towards proc load so that bursts
of new connections do not all queue for current least busy proc

(makes a difference only for local backends with more than one proc)
2017-07-23 19:02:29 -04:00
Glenn Strauss 45b970e69b [core] shared code for socket backends
common codebase for socket backends, based off mod_fastcgi with
some features added for mod_proxy

(mostly intended to reduce code duplication and enhance code isolation)

mod_fastcgi and mod_scgi can now use fastcgi.balance and scgi.balance
  for similar behavior as proxy.balance, but the balancing is per-host
  and not per-proc.  proxy.balance is also per-host and not per-proc.

mod_proxy and mod_scgi can now use and, similar to

mod_fastcgi behavior change (affects only mod_status):
- statistics tags have been renamed from "fastcgi.*" to "gw.*"
  "fastcgi.backend.*"       -> "gw.backend.*"
  "" -> ""
  ("fastcgi.requests" remains "fastcgi.requests")
  ("proxy.requests" is new)
  ("scgi.requests" is new)

mod_scgi behavior change (likely minor):
- removed scgi_proclist_sort_down() and scgi_proclist_sort_up().
  procs now chosen based on load as measured by num socket connnections

modules using gw_backend.[ch] are currently still independent modules.
If it had been written as a single module with fastcgi, scgi, proxy
implementations, then there would have been a chance of breaking some
existing user configurations where module ordering made a difference
for which module handled a given request, though for most people, this
would have made no difference.

Details about mod_fastcgi code transformations:
unsigned int debug -> int debug
fastcgi_env member removed from plugin_config
renamed "fcgi" and "fastcgi" to "gw", and "FCGI" to "GW"
reorganize routines for high-level and lower-level interfaces
some lower-level internal interfaces changed to use host,proc,debug
  args rather than knowing about higher-level (app) hctx and plugin_data
tabs->spaces and reformatting
2017-07-23 19:02:00 -04:00
Glenn Strauss 81b8fffd31 [mod_fastcgi,mod_scgi] use temp buffer for cgi_env 2017-07-15 22:42:15 -04:00
Glenn Strauss 6e1c02f386 [mod_fastcgi,mod_scgi] parse bin_path at startup 2017-07-15 22:42:15 -04:00
Glenn Strauss 35c4bf5857 [mod_fastcgi,mod_scgi] struct member consistency 2017-07-15 22:42:15 -04:00
Glenn Strauss 3ae7fb1bdd [mod_scgi] remove unused parse_response member 2017-07-15 22:42:15 -04:00
Glenn Strauss c0a9020935 [mod_fastcgi,mod_scgi] consistent connect() error
more consistent connect() error handling

NOTE: behavior change in mod_scgi:
  "disable-time" default is now 1 second (was 60 seconds)
  The new behavior matches the default in mod_fastcgi
  (and is a much saner default disable time).
2017-07-15 22:42:15 -04:00
Glenn Strauss d836c72751 [mod_fastcgi] move delayed connect() into switch()
move delayed connect() handling into switch()
2017-07-15 22:42:15 -04:00
Glenn Strauss d26837d509 [mod_fastcgi] set request_id in fcgi_create_env()
set hctx->request_id in fcgi_create_env()
2017-07-15 22:42:15 -04:00
Glenn Strauss 9cfa9dc3d4 [mod_fastcgi] consolidate connect() error handling 2017-07-15 22:42:15 -04:00
Glenn Strauss b65bdb5540 [mod_fastcgi] slightly simplify counters 2017-07-15 22:42:15 -04:00
Glenn Strauss c7492b6e0a [mod_proxy] store address family at config time 2017-07-15 22:42:15 -04:00
Glenn Strauss 9b9f445a7b [mod_proxy] move data_fastcgi into mod_proxy.c
(data_fastcgi is used only by mod_proxy at this point)
2017-07-15 22:42:15 -04:00
Glenn Strauss f3437fb2f2 [core] add const to reduce .data segment size 2017-07-15 22:42:15 -04:00
Glenn Strauss 91d14acfc3 [core] fdevent_connect_status() shared code 2017-07-15 22:42:15 -04:00
Glenn Strauss 143c6f34f5 [core] continue collecting use of netdb.h
continue collecting use of netdb.h into inet_ntop_cache.[ch]
2017-07-15 22:42:15 -04:00
Glenn Strauss 1002574692 [core] continue collecting use of netdb.h
continue collecting use of netdb.h into inet_ntop_cache.[ch]
2017-07-15 22:42:15 -04:00
Glenn Strauss 6a8de931ec [core] continue collecting use of netdb.h
continue collecting use of netdb.h into inet_ntop_cache.[ch]
2017-07-15 22:42:15 -04:00
Glenn Strauss 5248b46c95 [core] sock_addr_from_str_hints reusable name res
[core] sock_addr_from_str_hints() reusable name resolution func
2017-07-15 22:42:15 -04:00
Glenn Strauss 9e75b81982 [core] reduce exposure of unistd.h, other includes
reduce exposure of unistd.h, and some other include cleanup
2017-07-15 22:42:15 -04:00
Glenn Strauss 6691eb377e [core] add missing include of stdlib.h 2017-07-15 22:42:15 -04:00
Glenn Strauss cafb091cd4 [core] remove unused includes of stat_cache.h 2017-07-15 22:42:15 -04:00
Glenn Strauss 685cab057e [core] rename fd_close_on_exec()
rename fd_close_on_exec() to fdevent_setfd_cloexec()
2017-07-15 22:42:15 -04:00
Glenn Strauss 31011adda9 [core] mv log_error_{open,cycle.close} to server.c 2017-07-15 22:42:15 -04:00
Glenn Strauss a9970fec23 [core] consolidate fork()/execve() code (#1393)
(refactoring work to address issue #1393)

  "access log pipe writer should restart child process if it exits"
2017-07-15 22:42:15 -04:00
Glenn Strauss ddf339569c [core] server.error_handler_404 X-Sendfile ENOENT (#2474)
Better handling if server.error_handler_404 is a dynamic handler which
returns X-Sendfile pointing to a file which does not exist

(server.error_handler_404 historically did not reset con->file_started,
 and for mod_fastcgi, an X-Sendfile failure in the error handler would
 result in an empty response body.)

  "Option to map send-file file-not-found error to normal 404"
2017-07-15 22:42:15 -04:00
Glenn Strauss 55867b5602 [core] get port from sock_addr if AF_INET,AF_INET6
sock_addr_get_port() to get port from sock_addr if AF_INET or AF_INET6,
or else return 0
2017-07-15 22:42:12 -04:00
Glenn Strauss d15ddcb6fa [core] server.socket-perms to set perms on unix (fixes #656)
server.socket-perms = "0770" to set perms on unix domain socket
on which lighttpd listens for requests, e.g. $SERVER["socket"] == "..."

  "Feature request: add server config for setting permissions on Unix domain socket"
2017-06-13 08:56:13 -04:00
Glenn Strauss 6f88c28c44 [core] fix compiler warnings on Mac OS X
(thx wardw)
2017-06-13 08:56:13 -04:00
Glenn Strauss 9fd39690be [mod_openssl] adjust use of is used to send list of valid CA DNs to client for client
cert verification.  If is not specified, then the CAs in are used.

client certs are validated against the set of certs from both and, but issuer of cert provided by
client must be in if is specified.

(certs should not need to be in to both and

(thx m4t)
2017-06-13 08:55:38 -04:00
Glenn Strauss 8af9e71ccc [core] allow earlier plugin init for SSL/TLS
If lighttpd is started privileged, then SSL/TLS modules need to be
initialized prior to chroot (optional) and prior to dropping privileges
in order to be able to read sensitive files such as private certificates

(thx m4t)
2017-05-21 21:31:05 -04:00
Glenn Strauss fb87ae8604 [mod_openssl] safer_X509_NAME_oneline() (fixes #2693)
provide a safer X590_NAME_oneline() with return value semantics similar
to those of snprintf() and use safer_X509_NAME_oneline() to set
SSL_CLIENT_S_DN when client cert is validated.

The manpage for X509_NAME_oneline() says:

    The functions X509_NAME_oneline() and X509_NAME_print() are legacy functions which produce a non standard output form, they don't handle multi character fields and have various quirks and inconsistencies. Their use is strongly discouraged in new applications.

Besides X509_NAME_oneline() function being deprecated, until fairly recently, there was a security issue with the function, too.

    The X509_NAME_oneline function in crypto/x509/x509_obj.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to obtain sensitive information from process stack memory or cause a denial of service (buffer over-read) via crafted EBCDIC ASN.1 data.

github: closes #63, closes #83

2017-05-21 00:32:52 -04:00
Glenn Strauss e29f7d5738 [mod_dirlisting] sort "../" to top of names
sort "../" to top of names and do not emit "../" for docroot
2017-05-20 14:33:56 -04:00
Glenn Strauss b298e2acb0 [mod_extforward] quiet clang compiler warning
It does seem possible for PROXY protocol subelements to be misaligned
and a message has been sent to HAProxy author of the PROXY protocol.

On most modern processors and operating systems, misaligned access has a
cost, but not the outrageous cost that it historical had on processors
and older operating systems such as on SPARC processors running Solaris
prior to Solaris 11.
2017-05-17 21:55:32 -04:00
Glenn Strauss 21081c7b72 [mod_openssl] fix compile with openssl 1.1.0
fix compile with openssl 1.1.0
remove stray tabs from prior commit

(thx gazoo74)
2017-05-17 00:44:55 -04:00
Gaël PORTAY 04d510af20 [mod_openssl] ignore client verification error if not enforced
ignore client verification error if not enforced
  e.g. *not* ssl.verifyclient.enforce = "enable"

github: closes #83

  "ignore client verification error if not enforced"
2017-05-16 22:25:00 -04:00
Glenn Strauss 69aeaf2fad [mod_proxy] fix typo identified by coverity
fix mod_proxy.c typo identified by coverity
silence some warnings checking return values of fcntl() in fdevent.c
2017-05-15 23:59:22 -04:00
Glenn Strauss 0399609ac2 [mod_openssl] (fixes #2694)
(original patch by mackyle)

The option provides independent control of
the "certificate_authorities" field (see RFC 5246 section
7.4.4 Certificate Request) separate from the actual list
of trusted certificate authorities used for client
certificate verification.

It may be necessary to send a hint that includes the DN
of a non-root client CA in order to receive the correct
certificate from the client, but such a non-root CA really
does not belong in the trusted client root CA list.

Signed-off-by: Kyle J. McKay

github: closes #64

  "add support for ssl.cadn-file"
2017-05-15 23:12:36 -04:00
Gaël PORTAY e422ac128a [mod_openssl] for CRL (fixes #2319)
(original patch by binbrain, and updated by flynn)

github: closes #82

  "Support CRLs for client certificate verification"
2017-05-15 22:02:33 -04:00
Glenn Strauss 6f75cdddda [build] autotools use AC_PROG_CC_STDC macro
autotools now use AC_PROG_CC_STDC macro instead of -std=gnu99.
The default in current modern gcc compilers is -std=gnu11

(Note: src/CMakeLists.txt and SConstruct still specify -std=gnu99)
2017-05-15 22:02:33 -04:00
Glenn Strauss 1e8147fc3a [build] -Werror if --enable-extra-warnings=error
enable -Werror if ./configure --enable-extra-warnings=error

   "Fix warnings"
2017-05-15 22:02:33 -04:00
Gaël PORTAY e8498bbfcc [core] silence compiler warnings if !HAVE_FORK
silence compiler warnings if HAVE_FORK is not set

However, if HAVE_FORK is not set, then -Werror was probably passed to
./configure, which is currently a mistake.  lighttpd can successfully
compiles src/ with -Werror on many platforms, but ./configure tests
should not be run with -Werror. [gstrauss]

github: closes #81

   "Fix warnings"
2017-05-15 22:02:33 -04:00
Glenn Strauss 7a27d5eff5 [core] buffer to disk streaming to slow backends
buffer input to disk when streaming request body to slow backends
2017-05-15 22:02:33 -04:00
Glenn Strauss 574fb562f1 [mod_cgi] basic support for Upgrade: websocket
transition to transparent gateway for e.g. Upgrade: websocket


disabled by default
enabled with cgi.upgrade = "enable"
2017-05-15 22:02:33 -04:00
Glenn Strauss b641850376 [core] optional condition in config "else" clause (fixes #1268)
  "condition should be optional in "else" clause in configuration file"
2017-05-15 22:02:33 -04:00
Glenn Strauss 86bb8be2c8 [core] perf: skip redundant strlen() if len known
performance: skip redundant strlen() if length is already known

introduce array_get_element_klen() to take key and klen params
2017-05-15 22:02:33 -04:00
Glenn Strauss 07cde2cf0b [core] set server.max-keep-alive-requests = 100 (fixes #2205)
median webpage in today's day and age contains 75-100 requests per page
so increasing the default server.max-keep-alive-requests in lighttpd
from 16 is more than warranted

  "set server.max-keep-alive-requests = 100"
2017-05-15 22:02:32 -04:00
Glenn Strauss 8913dc4e59 [mod_extforward] compile on OSX
define MSG_DONTWAIT and MSG_NOSIGNAL to be no-ops on platforms
without support.  (fd should already be configured O_NONBLOCK
and SIGPIPE signal is configured to be ignored)

(thx avij and wardw)
2017-05-15 22:02:32 -04:00