diff options
Diffstat (limited to 'www-servers')
6 files changed, 485 insertions, 1 deletions
diff --git a/www-servers/lighttpd/ChangeLog b/www-servers/lighttpd/ChangeLog index ceaaed917bdd..f83467c4a1a8 100644 --- a/www-servers/lighttpd/ChangeLog +++ b/www-servers/lighttpd/ChangeLog @@ -1,6 +1,17 @@ # ChangeLog for www-servers/lighttpd # Copyright 2000-2008 Gentoo Foundation; Distributed under the GPL v2 -# $Header: /var/cvsroot/gentoo-x86/www-servers/lighttpd/ChangeLog,v 1.174 2008/03/26 10:52:30 armin76 Exp $ +# $Header: /var/cvsroot/gentoo-x86/www-servers/lighttpd/ChangeLog,v 1.175 2008/03/26 20:07:54 bangert Exp $ + +*lighttpd-1.4.19-r1 (26 Mar 2008) + + 26 Mar 2008; Thilo Bangert <bangert@gentoo.org> + +files/1.4.19-r1/03_all_lighttpd-1.4.11-errorlog-pipe.diff, + +files/1.4.19-r1/04_all_lighttpd-1.4.13-deprecated-ldap-api.diff, + +files/1.4.19-r1/06_all_lighttpd-1.4.19-closing_foreign_ssl_connections-do + s.diff, + +files/1.4.19-r1/05_all_lighttpd-1.4.19-force_lowercase_filenames_in_mod_u + serdir.diff, +lighttpd-1.4.19-r1.ebuild: + bump - fixes security bug# 214892 26 Mar 2008; Raúl Porcel <armin76@gentoo.org> lighttpd-1.4.19.ebuild: alpha/ia64/sparc stable wrt security #213164 diff --git a/www-servers/lighttpd/files/1.4.19-r1/03_all_lighttpd-1.4.11-errorlog-pipe.diff b/www-servers/lighttpd/files/1.4.19-r1/03_all_lighttpd-1.4.11-errorlog-pipe.diff new file mode 100644 index 000000000000..c168eba74683 --- /dev/null +++ b/www-servers/lighttpd/files/1.4.19-r1/03_all_lighttpd-1.4.11-errorlog-pipe.diff @@ -0,0 +1,179 @@ +diff -ur lighttpd-1.4.11.orig/src/base.h lighttpd-1.4.11/src/base.h +--- lighttpd-1.4.11.orig/src/base.h 2006-01-13 06:51:04.000000000 -0800 ++++ lighttpd-1.4.11/src/base.h 2006-12-17 18:01:39.000000000 -0800 +@@ -505,7 +505,7 @@ + + /* the errorlog */ + int errorlog_fd; +- enum { ERRORLOG_STDERR, ERRORLOG_FILE, ERRORLOG_SYSLOG } errorlog_mode; ++ enum { ERRORLOG_STDERR, ERRORLOG_FILE, ERRORLOG_SYSLOG, ERRORLOG_PIPE } errorlog_mode; + buffer *errorlog_buf; + + fdevents *ev, *ev_ins; +diff -ur lighttpd-1.4.11.orig/src/log.c lighttpd-1.4.11/src/log.c +--- lighttpd-1.4.11.orig/src/log.c 2005-13-07 05:01:35.000000000 -0800 ++++ lighttpd-1.4.11/src/log.c 2006-12-17 18:09:43.000000000 -0800 +@@ -34,10 +34,11 @@ + /** + * open the errorlog + * +- * we have 3 possibilities: ++ * we have 4 possibilities: + * - stderr (default) + * - syslog + * - logfile ++ * - pipe + * + * if the open failed, report to the user and die + * +@@ -57,21 +58,81 @@ + srv->errorlog_mode = ERRORLOG_SYSLOG; + } else if (!buffer_is_empty(srv->srvconf.errorlog_file)) { + const char *logfile = srv->srvconf.errorlog_file->ptr; +- +- if (-1 == (srv->errorlog_fd = open(logfile, O_APPEND | O_WRONLY | O_CREAT | O_LARGEFILE, 0644))) { +- log_error_write(srv, __FILE__, __LINE__, "SSSS", +- "opening errorlog '", logfile, +- "' failed: ", strerror(errno)); +- ++ ++ if (logfile[0] == '|') { ++#ifdef HAVE_FORK ++ /* create write pipe and spawn process */ ++ ++ int to_log_fds[2]; ++ pid_t pid; ++ ++ if (pipe(to_log_fds)) { ++ log_error_write(srv, __FILE__, __LINE__, "ss", ++ "pipe failed: ", strerror(errno)); ++ return -1; ++ } ++ ++ /* fork, execve */ ++ switch (pid = fork()) { ++ case 0: ++ /* child */ ++ ++ close(STDIN_FILENO); ++ dup2(to_log_fds[0], STDIN_FILENO); ++ close(to_log_fds[0]); ++ /* not needed */ ++ close(to_log_fds[1]); ++ ++ /* we don't need the client socket */ ++ for (fd = 3; fd < 256; fd++) { ++ close(fd); ++ } ++ ++ /* exec the log-process (skip the | ) ++ * ++ */ ++ ++ execl("/bin/sh", "sh", "-c", logfile + 1, NULL); ++ ++ log_error_write(srv, __FILE__, __LINE__, "sss", ++ "spawning log-process failed: ", ++ strerror(errno), logfile + 1); ++ ++ exit(-1); ++ break; ++ case -1: ++ /* error */ ++ log_error_write(srv, __FILE__, __LINE__, "ss", "fork failed:", strerror(errno)); ++ break; ++ default: ++ close(to_log_fds[0]); ++ ++ srv->errorlog_fd = to_log_fds[1]; ++ ++ break; ++ } ++ srv->errorlog_mode = ERRORLOG_PIPE; ++#else ++ log_error_write(srv, __FILE__, __LINE__, "SSS", ++ "opening errorlog '", logfile,"' impossible"); + return -1; +- } ++#endif ++ } else { ++ if (-1 == (srv->errorlog_fd = open(logfile, O_APPEND | O_WRONLY | O_CREAT | O_LARGEFILE, 0644))) { ++ log_error_write(srv, __FILE__, __LINE__, "SSSS", ++ "opening errorlog '", logfile, ++ "' failed: ", strerror(errno)); ++ ++ return -1; ++ } ++ srv->errorlog_mode = ERRORLOG_FILE; ++ } + #ifdef FD_CLOEXEC +- /* close fd on exec (cgi) */ +- fcntl(srv->errorlog_fd, F_SETFD, FD_CLOEXEC); ++ /* close fd on exec (cgi) */ ++ fcntl(srv->errorlog_fd, F_SETFD, FD_CLOEXEC); + #endif +- srv->errorlog_mode = ERRORLOG_FILE; +- } +- ++ } ++ + log_error_write(srv, __FILE__, __LINE__, "s", "server started"); + + #ifdef HAVE_VALGRIND_VALGRIND_H +@@ -99,7 +160,7 @@ + */ + + int log_error_cycle(server *srv) { +- /* only cycle if we are not in syslog-mode */ ++ /* only cycle if the error log is a file */ + + if (srv->errorlog_mode == ERRORLOG_FILE) { + const char *logfile = srv->srvconf.errorlog_file->ptr; +@@ -135,6 +196,7 @@ + log_error_write(srv, __FILE__, __LINE__, "s", "server stopped"); + + switch(srv->errorlog_mode) { ++ case ERRORLOG_PIPE: /* fall through */ + case ERRORLOG_FILE: + close(srv->errorlog_fd); + break; +@@ -154,6 +216,7 @@ + va_list ap; + + switch(srv->errorlog_mode) { ++ case ERRORLOG_PIPE: + case ERRORLOG_FILE: + case ERRORLOG_STDERR: + /* cache the generated timestamp */ +@@ -238,6 +301,7 @@ + va_end(ap); + + switch(srv->errorlog_mode) { ++ case ERRORLOG_PIPE: /* fall through */ + case ERRORLOG_FILE: + BUFFER_APPEND_STRING_CONST(srv->errorlog_buf, "\n"); + write(srv->errorlog_fd, srv->errorlog_buf->ptr, srv->errorlog_buf->used - 1); +diff -ur lighttpd-1.4.11.orig/src/mod_cgi.c lighttpd-1.4.11/src/mod_cgi.c +--- lighttpd-1.4.11.orig/src/mod_cgi.c 2006-02-22 05:15:10.000000000 -0800 ++++ lighttpd-1.4.11/src/mod_cgi.c 2006-12-17 18:01:39.000000000 -0800 +@@ -750,7 +750,7 @@ + * + * we feed the stderr of the CGI to our errorlog, if possible + */ +- if (srv->errorlog_mode == ERRORLOG_FILE) { ++ if ((srv->errorlog_mode == ERRORLOG_FILE) || (srv->errorlog_mode == ERRORLOG_PIPE)) { + close(STDERR_FILENO); + dup2(srv->errorlog_fd, STDERR_FILENO); + } +diff -ur lighttpd-1.4.11.orig/src/mod_rrdtool.c lighttpd-1.4.11/src/mod_rrdtool.c +--- lighttpd-1.4.11.orig/src/mod_rrdtool.c 2005-08-21 15:52:24.000000000 -0700 ++++ lighttpd-1.4.11/src/mod_rrdtool.c 2006-12-17 18:01:39.000000000 -0800 +@@ -134,7 +134,7 @@ + + close(STDERR_FILENO); + +- if (srv->errorlog_mode == ERRORLOG_FILE) { ++ if ((srv->errorlog_mode == ERRORLOG_FILE) || (srv->errorlog_mode == ERRORLOG_PIPE)) { + dup2(srv->errorlog_fd, STDERR_FILENO); + close(srv->errorlog_fd); + } diff --git a/www-servers/lighttpd/files/1.4.19-r1/04_all_lighttpd-1.4.13-deprecated-ldap-api.diff b/www-servers/lighttpd/files/1.4.19-r1/04_all_lighttpd-1.4.13-deprecated-ldap-api.diff new file mode 100644 index 000000000000..259ad4b279a5 --- /dev/null +++ b/www-servers/lighttpd/files/1.4.19-r1/04_all_lighttpd-1.4.13-deprecated-ldap-api.diff @@ -0,0 +1,10 @@ +--- lighttpd-1.4.13.old/src/Makefile.am 2006-10-09 12:19:34.000000000 -0400 ++++ lighttpd-1.4.13/src/Makefile.am 2007-03-26 10:10:26.000000000 -0400 +@@ -213,6 +213,7 @@ + mod_auth_la_SOURCES = mod_auth.c http_auth_digest.c http_auth.c + mod_auth_la_LDFLAGS = -module -export-dynamic -avoid-version -no-undefined + mod_auth_la_LIBADD = $(CRYPT_LIB) $(LDAP_LIB) $(LBER_LIB) $(common_libadd) ++mod_auth_la_CFLAGS = -DLDAP_DEPRECATED + + lib_LTLIBRARIES += mod_rewrite.la + mod_rewrite_la_SOURCES = mod_rewrite.c diff --git a/www-servers/lighttpd/files/1.4.19-r1/05_all_lighttpd-1.4.19-force_lowercase_filenames_in_mod_userdir.diff b/www-servers/lighttpd/files/1.4.19-r1/05_all_lighttpd-1.4.19-force_lowercase_filenames_in_mod_userdir.diff new file mode 100644 index 000000000000..9d67afd049ed --- /dev/null +++ b/www-servers/lighttpd/files/1.4.19-r1/05_all_lighttpd-1.4.19-force_lowercase_filenames_in_mod_userdir.diff @@ -0,0 +1,14 @@ +--- lighttpd-1.4.19/src/mod_userdir.c 2008-03-10 22:45:29.000000000 +1100 ++++ lighty-dev/src/mod_userdir.c 2008-03-12 17:44:43.000000000 +1100 +@@ -286,6 +286,11 @@ + + BUFFER_APPEND_SLASH(p->temp_path); + buffer_append_string(p->temp_path, rel_url + 1); /* skip the / */ ++ ++ if (con->conf.force_lowercase_filenames) { ++ buffer_to_lower(p->temp_path); ++ } ++ + buffer_copy_string_buffer(con->physical.path, p->temp_path); + + buffer_reset(p->temp_path); diff --git a/www-servers/lighttpd/files/1.4.19-r1/06_all_lighttpd-1.4.19-closing_foreign_ssl_connections-dos.diff b/www-servers/lighttpd/files/1.4.19-r1/06_all_lighttpd-1.4.19-closing_foreign_ssl_connections-dos.diff new file mode 100644 index 000000000000..7a904e999e1d --- /dev/null +++ b/www-servers/lighttpd/files/1.4.19-r1/06_all_lighttpd-1.4.19-closing_foreign_ssl_connections-dos.diff @@ -0,0 +1,60 @@ +diff -Naur lighttpd-1.4.19.orig/NEWS lighttpd-1.4.19/NEWS +--- lighttpd-1.4.19.orig/NEWS 2008-03-10 22:28:30.000000000 +0100 ++++ lighttpd-1.4.19/NEWS 2008-03-26 20:45:16.000000000 +0100 +@@ -8,6 +8,7 @@ + * added support for If-Range: <date> (#1346) + * added support for matching $HTTP["scheme"] in configs + * fixed initgroups() called after chroot (#1384) ++ * Fix #285 again: read error after SSL_shutdown (thx marton.illes@balabit.com) and clear the error queue before some other calls + * fixed case-sensitive check for Auth-Method (#1456) + * execute fcgi app without /bin/sh if used as argument to spawn-fcgi (#1428) + * fixed a bug that made /-prefixed extensions being handled also when +diff -Naur lighttpd-1.4.19.orig/src/connections.c lighttpd-1.4.19/src/connections.c +--- lighttpd-1.4.19.orig/src/connections.c 2008-02-28 00:41:35.000000000 +0100 ++++ lighttpd-1.4.19/src/connections.c 2008-03-26 20:45:16.000000000 +0100 +@@ -199,6 +199,7 @@ + + /* don't resize the buffer if we were in SSL_ERROR_WANT_* */ + ++ ERR_clear_error(); + do { + if (!con->ssl_error_want_reuse_buffer) { + b = buffer_init(); +@@ -1669,13 +1670,16 @@ + #ifdef USE_OPENSSL + if (srv_sock->is_ssl) { + int ret; ++ ERR_clear_error(); + switch ((ret = SSL_shutdown(con->ssl))) { + case 1: + /* ok */ + break; + case 0: +- SSL_shutdown(con->ssl); +- break; ++ ERR_clear_error(); ++ if ((ret = SSL_shutdown(con->ssl)) == 1) break; ++ ++ // fall through + default: + log_error_write(srv, __FILE__, __LINE__, "sds", "SSL:", + SSL_get_error(con->ssl, ret), +diff -Naur lighttpd-1.4.19.orig/src/network_openssl.c lighttpd-1.4.19/src/network_openssl.c +--- lighttpd-1.4.19.orig/src/network_openssl.c 2008-02-26 17:20:26.000000000 +0100 ++++ lighttpd-1.4.19/src/network_openssl.c 2008-03-26 20:45:16.000000000 +0100 +@@ -85,6 +85,7 @@ + * + */ + ++ ERR_clear_error(); + if ((r = SSL_write(ssl, offset, toSend)) <= 0) { + unsigned long err; + +@@ -187,6 +188,7 @@ + + close(ifd); + ++ ERR_clear_error(); + if ((r = SSL_write(ssl, s, toSend)) <= 0) { + unsigned long err; + diff --git a/www-servers/lighttpd/lighttpd-1.4.19-r1.ebuild b/www-servers/lighttpd/lighttpd-1.4.19-r1.ebuild new file mode 100644 index 000000000000..7b6cf2b6c1a7 --- /dev/null +++ b/www-servers/lighttpd/lighttpd-1.4.19-r1.ebuild @@ -0,0 +1,210 @@ +# Copyright 1999-2008 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/www-servers/lighttpd/lighttpd-1.4.19-r1.ebuild,v 1.1 2008/03/26 20:07:54 bangert Exp $ + +WANT_AUTOCONF=latest +WANT_AUTOMAKE=latest +inherit eutils autotools depend.php + +DESCRIPTION="Lightweight high-performance web server" +HOMEPAGE="http://www.lighttpd.net/" +SRC_URI="http://www.lighttpd.net/download/${P}.tar.bz2" + +LICENSE="BSD" +SLOT="0" +KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~mips ~ppc ~ppc64 ~sh ~sparc ~sparc-fbsd ~x86 ~x86-fbsd" +IUSE="bzip2 doc fam fastcgi gdbm ipv6 ldap lua minimal memcache mysql pcre php rrdtool ssl test webdav xattr" + +RDEPEND=">=sys-libs/zlib-1.1 + bzip2? ( app-arch/bzip2 ) + fam? ( virtual/fam ) + gdbm? ( sys-libs/gdbm ) + ldap? ( >=net-nds/openldap-2.1.26 ) + lua? ( >=dev-lang/lua-5.1 ) + memcache? ( dev-libs/libmemcache ) + mysql? ( >=virtual/mysql-4.0 ) + pcre? ( >=dev-libs/libpcre-3.1 ) + php? ( virtual/httpd-php ) + rrdtool? ( net-analyzer/rrdtool ) + ssl? ( >=dev-libs/openssl-0.9.7 ) + webdav? ( + dev-libs/libxml2 + >=dev-db/sqlite-3 + sys-fs/e2fsprogs + ) + xattr? ( kernel_linux? ( sys-apps/attr ) )" + +DEPEND="${RDEPEND} + doc? ( dev-python/docutils ) + test? ( + virtual/perl-Test-Harness + dev-libs/fcgi + )" + +# update certain parts of lighttpd.conf based on conditionals +update_config() { + local config="/etc/lighttpd/lighttpd.conf" + + # enable php/mod_fastcgi settings + use php && \ + dosed 's|#.*\(include.*fastcgi.*$\)|\1|' ${config} + + # enable stat() caching + use fam && \ + dosed 's|#\(.*stat-cache.*$\)|\1|' ${config} +} + +# remove non-essential stuff (for USE=minimal) +remove_non_essential() { + local libdir="${D}/usr/$(get_libdir)/${PN}" + + # text docs + use doc || rm -fr "${D}"/usr/share/doc/${PF}/txt + + # non-essential modules + rm -f \ + ${libdir}/mod_{compress,evhost,expire,proxy,scgi,secdownload,simple_vhost,status,setenv,trigger*,usertrack}.* + + # allow users to keep some based on USE flags + use pcre || rm -f ${libdir}/mod_{ssi,re{direct,write}}.* + use webdav || rm -f ${libdir}/mod_webdav.* + use mysql || rm -f ${libdir}/mod_mysql_vhost.* + use lua || rm -f ${libdir}/mod_{cml,magnet}.* + use rrdtool || rm -f ${libdir}/mod_rrdtool.* + + if ! use fastcgi ; then + rm -f ${libdir}/mod_fastcgi.* "${D}"/usr/bin/spawn-fcgi \ + "${D}"/usr/share/man/man1/spawn-fcgi.* + fi +} + +pkg_setup() { + if ! use pcre ; then + ewarn "It is highly recommended that you build ${PN}" + ewarn "with perl regular expressions support via USE=pcre." + ewarn "Otherwise you lose support for some core options such" + ewarn "as conditionals and modules such as mod_re{write,direct}" + ewarn "and mod_ssi." + ebeep 5 + fi + + use php && require_php_with_use cgi + + enewgroup lighttpd + enewuser lighttpd -1 -1 /var/www/localhost/htdocs lighttpd +} + +src_unpack() { + unpack ${A} + cd "${S}" + + EPATCH_SUFFIX="diff" EPATCH_OPTS="-l" epatch "${FILESDIR}"/"${PVR}" || die "Patching failed!" + + eautoreconf || die + + # dev-python/docutils installs rst2html.py not rst2html + sed -i -e 's|\(rst2html\)|\1.py|g' doc/Makefile.in || \ + die "sed doc/Makefile.in failed" + + # fix typo + sed -i -e 's|\(output_content\)_\(type\)|\1\2|' doc/cml.txt || \ + die "sed doc/cml.txt failed" +} + +src_compile() { + econf --libdir=/usr/$(get_libdir)/${PN} \ + --enable-lfs \ + $(use_enable ipv6) \ + $(use_with bzip2) \ + $(use_with fam) \ + $(use_with gdbm) \ + $(use_with lua) \ + $(use_with ldap) \ + $(use_with memcache) \ + $(use_with mysql) \ + $(use_with pcre) \ + $(use_with ssl openssl) \ + $(use_with webdav webdav-props) \ + $(use_with webdav webdav-locks) \ + $(use_with xattr attr) \ + || die "econf failed" + + emake || die "emake failed" + + if use doc ; then + einfo "Building HTML documentation" + cd doc + emake html || die "failed to build HTML documentation" + fi +} + +src_install() { + make DESTDIR="${D}" install || die "make install failed" + + # init script stuff + newinitd "${FILESDIR}"/lighttpd.initd-1.4.13-r3 lighttpd || die + newconfd "${FILESDIR}"/lighttpd.confd lighttpd || die + use fam && has_version app-admin/fam && \ + sed -i 's/after famd/need famd/g' "${D}"/etc/init.d/lighttpd + + if use php || use fastcgi ; then + newinitd "${FILESDIR}"/spawn-fcgi.initd spawn-fcgi || die + newconfd "${FILESDIR}"/spawn-fcgi.confd spawn-fcgi || die + fi + + # configs + insinto /etc/lighttpd + doins "${FILESDIR}"/conf/lighttpd.conf + doins "${FILESDIR}"/conf/mime-types.conf + doins "${FILESDIR}"/conf/mod_cgi.conf + newins "${FILESDIR}"/conf/mod_fastcgi.conf-1.4.13-r2 mod_fastcgi.conf + # Secure directory for fastcgi sockets + keepdir /var/run/lighttpd/ + fperms 0750 /var/run/lighttpd/ + fowners lighttpd:lighttpd /var/run/lighttpd/ + + # update lighttpd.conf directives based on conditionals + update_config + + # docs + dodoc AUTHORS README NEWS ChangeLog doc/*.sh + newdoc doc/lighttpd.conf lighttpd.conf.distrib + + use doc && dohtml -r doc/* + + docinto txt + dodoc doc/*.txt + + # logrotate + insinto /etc/logrotate.d + newins "${FILESDIR}"/lighttpd.logrotate lighttpd || die + + keepdir /var/l{ib,og}/lighttpd /var/www/localhost/htdocs + fowners lighttpd:lighttpd /var/l{ib,og}/lighttpd + fperms 0750 /var/l{ib,og}/lighttpd + + use minimal && remove_non_essential +} + +pkg_postinst () { + echo + if [[ -f ${ROOT}etc/conf.d/spawn-fcgi.conf ]] ; then + einfo "spawn-fcgi is now included with lighttpd" + einfo "spawn-fcgi's init script configuration is now located" + einfo "at /etc/conf.d/spawn-fcgi." + echo + fi + + if [[ -f ${ROOT}etc/lighttpd.conf ]] ; then + ewarn "As of lighttpd-1.4.1, Gentoo has a customized configuration," + ewarn "which is now located in /etc/lighttpd. Please migrate your" + ewarn "existing configuration." + ebeep 5 + fi + + if use fam ; then + einfo "Remember to re-emerge lighttpd should you switch from" + einfo "app-admin/famd to app-admin/gamin or vice versa." + fi + echo +} |