lighty's life

lighttpd.net moved to new host

jan — Mon, 15 Feb 2010 18:15:33 +0100

In case you havn’t noticed: lighttpd.net moved to a new home. After several years running on sponsored hardware, we now run on our “own” server. Now including IPv6.

The transition went very smoothly thanks to the wonderful team. If you notice some issues, please ping us on IRC.

BTW, all your donations get used to keep the domain and server running. Thanks to all that make this possible. hint More support is always welcome.

lighttpd 1.4.26 released

stbuehler — Sun, 07 Feb 2010 20:56:00 +0100

Just in case you didn’t see the announcement on the main page: click

Please head over there for more information.

If you want to get the latest source for any branch, you can get it from our svn repository.
Documentation to do so can be obtained from this page:
http://redmine.lighttpd.net/projects/lighttpd/wiki/DevelSubversion
Bug reports or feature requests can be filed in our ticket system:
http://redmine.lighttpd.net/projects/lighttpd/issues/new
Please make sure to check if there isn’t a ticket already here:
http://redmine.lighttpd.net/projects/lighttpd/issues

Thank you for flying light.

PRE-RELEASE: lighttpd 1.4.26rc1-r2710

stbuehler — Wed, 03 Feb 2010 21:29:00 +0100

We would like to draw your attention to the latest pre-release of the stable 1.4 branch of lighttpd.

You can get the pre-release from these urls:
http://download.lighttpd.net/lighttpd/snapshots-1.4.x/lighttpd-1.4.26rc1-r2710.tar.gz
http://download.lighttpd.net/lighttpd/snapshots-1.4.x/lighttpd-1.4.26rc1-r2710.tar.bz2
SHA1 checksums:
http://download.lighttpd.net/lighttpd/snapshots-1.4.x/lighttpd-1.4.26rc1-r2710.sha1sum

Please test it as much as possible and provide us with feedback.
A lot of testing ensures a good release.

There have been some important bug fixes (request parser handling for splitted header data, a fd leak in mod_cgi, a segfault with broken configs in mod_rewrite/mod_redirect and of course the latest security issue with an OOM vulnerability)

If no showstoppers are encountered, there will be a final release soon.

PS: As it is often asked in the comments: We don’t plan to release 1.5, as we are working on 2.0; we can’t support too many different versions, so while we are still trying to keep 1.5 working, our main efforts will be keeping 1.4 stable and working on 2.0 for now.

Changelog since 1.4.25:

Fix request parser to handle packets with splitted \r\n\r\n (fixes #2105)
Remove dependency on automake >= 1.11 with m4_ifdef check
mod_accesslog: support %e (fixes #2113, thx presbrey)
Fix mod_cgi cgi.execute-x-only option in global block
mod_fastcgi: x-sendfile2 parse error debugging
Fix mod_proxy dead host detection if connect() fails
Fix fd leaks in mod_cgi (fds not closed on pipe/fork failures, found by Rodrigo, fixes #2158, #2159)
Fix segfault with broken rewrite/redirect patterns (fixes #2140, found by crypt)
Append to previous buffer in con read, fix DoS/OOM vulnerability (fixes #2147, found by liming, CVE-2010-0295)

Thank you for flying light.

lighttpd 1.4.25 released

icy — Sat, 21 Nov 2009 15:57:00 +0100

Just in case you didn’t see the announcement on the main page: click

Please head over there for more information.

We also started a public directory listing with all the releases, snapshots and security announcements of our projects under http://download.lighttpd.net

Thank you for flying light.

PRE-RELEASE: lighttpd 1.4.25rc1-r2692

stbuehler — Sun, 08 Nov 2009 12:20:00 +0100

We would like to draw your attention to the latest pre-release of the stable 1.4 branch of lighttpd.

You can get the pre-release from these urls:
http://www.lighttpd.net/download/lighttpd-1.4.25rc1-r2692.tar.gz
http://www.lighttpd.net/download/lighttpd-1.4.25rc1-r2692.tar.bz2
SHA1 checksums:
http://www.lighttpd.net/download/lighttpd-1.4.25rc1-r2692.sha1sum

Please test it as much as possible and provide us with feedback.
A lot of testing ensures a good release.

We did some important bug fixes (some of them new since 1.4.24, and some older bugs). Only 2 small new features: traceback for lua errors and the SSL_CLIENT_* vars export for ssl client cert validation.

If no showstoppers are encountered, there will be a final release soon.

Changelog since 1.4.24:

mod_magnet: fix pairs() for normal tables and strings (fixes #1307)
mod_magnet: add traceback for printing lua errors
mod_rewrite: fix compile error if compiled without pcre
disable warning “CLOSE-read” (fixes #2091)
mod_rrdtool: fix creating file if it doesn’t exist (#1788)
reset tlsext_server_name in connection_reset – fixes random hostnames in the $HTTP[“host”] conditional
export some SSL_CLIENT_* vars for client cert validation (fixes #1288, thx presbrey)
mod_fastcgi: fix mod_fastcgi packet parsing
mod_fastcgi: Don’t reconnect after connect() succeeded (fixes #2096)

Thank you for flying light.

lighttpd 1.4.24 released

stbuehler — Sun, 25 Oct 2009 19:37:00 +0100

Just in case you didn’t see the announcement on the main page: click

Please head over there for more information.

Thank you for flying light.

PRE-RELEASE: lighttpd 1.4.24rc2-r2668

stbuehler — Sat, 17 Oct 2009 14:21:00 +0200

We would like to draw your attention to the latest pre-release of the stable 1.4 branch of lighttpd.

You can get the pre-release from these urls:
http://www.lighttpd.net/download/lighttpd-1.4.24rc2-r2668.tar.gz
http://www.lighttpd.net/download/lighttpd-1.4.24rc2-r2668.tar.bz2
SHA1 checksums:
http://www.lighttpd.net/download/lighttpd-1.4.24rc2-r2668.sha1sum

Please test it as much as possible and provide us with feedback.
A lot of testing ensures a good release.

Since rc1 we fixed another fastcgi bug, escape accesslog data and fixed a crash in webdav (which got introduced in rc1)

Already in rc1: We have made many changes, especially regarding the core of our connection state machine (hopefully fixing the lingering socket close, which should fix pipelining), and the FastCGI internals (it should recover from crashing FastCGI applications)
There are two new features for SSL too: TLS SNI and client certificate validation.

If no showstoppers are encountered, there will be a final release soon.

Changelog since 1.4.23:

Add T_CONFIG_INT for bigger integers from the config (needed for #1966)
Use unsigned int (and T_CONFIG_INT) for max_request_size
Use unsigned int for secdownload.timeout (fixes #1966)
Keep url/host values from connection to display information while keep-alive in mod_status (fixes #1202 /issues/show/1202)
Add server.breakagelog, a “special” stderr (fixes #1863)
Fix config evaluation for debug.log-timeouts option (#1529)
Add “cgi.execute-x-only” to mod_cgi, requires +x for cgi scripts (fixes #2013)
Fix FD_SETSIZE comparision warnings
Add “lua-5.1” to searched pkg-config names for lua
Fix unused function webdav_lockdiscovery in mod_webdav
cmake: Fix crypt lib check
cmake: Add -export-dynamic to link flags, fixes build on FreeBSD
Set FD_CLOEXEC for bound sockets before pipe-logger forks (fixes #2026)
Reset ignored signals to SIG_DFL before exec() in fastcgi/scgi (fixes #2029)
Show “no uri specified -> 400” error only when “debug.log-request-header-on-error” is enabled (fixes #2030)
Fix hanging connection in mod_scgi (fixes #2024)
Allow digits in hostnames in more places (fixes #1148)
Use connection_reset instead of handle_request_done for cleanup callbacks
Change mod_expire to append Cache-Control instead of overwriting it (fixes #1997)
Allow all comparisons for $SERVER[“socket”] – only bind for ”==”
Remove strptime failed message (fixes #2031)
Fix issues found with clang analyzer
Try to fix server.tag issue with localized svnversion
Fix handling network-write return values (#2024)
Use disable-time in fastcgi for all disables after errors, default is 1sec (fixes #2040)
Remove adaptive spawning code from fastcgi (was disabled for a long time)
Allow mod_mysql_vhost to use stored procedures (fixes #2011, thx Ben Brown)
Fix ipv6 in mod_proxy (fixes #2043)
Print errors from include_shell to stderr
Set tm.tm_isdst = 0 before mktime() (fixes #2047)
Use linux-epoll by default if available (fixes #2021, thx Olaf van der Spek)
Print an error if you use too many captures in a regex pattern (fixes #2059)
Combine Cache-Control header value in mod_expire to existing HTTP header if header already added by other modules (fixes #2068)
Remember keep-alive-idle in separate variable (fixes #1988)
Fix header inclusion order, always include “config.h” before any system header
mod_webdav: Patch to skip login information for domain part of Destination field (fixes #1793)
mod_webdav: Delete old properties before updating new for MOVE (fixes #1317)
Read hostname from absolute uris in the request line (fixes #1937)
mod_fastcgi: don’t disable backend if disable-time is 0 (fixes #1825)
mod_compress: match partial+full content-type (fixes #1552)
mod_fastcgi: fix is_local detection, respawn backends if bin-path is set (fixes #897)
Fix linger-on-close behaviour to avoid rare failure conditions (was r2636, fixes #657)
mod_fastcgi: restart local procs immediately after they terminated, fix local procs handling
Fix segfault on invalid config “duplicate else conditions” (fixes #2065)
mod_usertrack: Use T_CONFIG_INT for max-age, solves range problem (#1455)
mod_accesslog: configurable timestamp logging (fixes #1479)
always define _GNU_SOURCE
Add some iterators for mod_magnet (fixes #1307)
Fix close_timeout_ts trigger (should finally fix lingering close)
mod_rewrite: add url.rewrite-[repeat-]if-not-file to rewrite if file doesn’t exist or is not a regular file (fixes #985, thx lucas aerbeydt)
Add TLS servername indication (SNI) support (fixes #386, thx Peter Colberg )
Add SSL Client Certificate verification (#1288)
mod_fastcgi: Fix host->active_procs counter, return 503 if connect wasn’t successful after 5 tries (fixes #1825)
mod_accesslog: escape special characters (fixes #1551, thx icy)
fix mod_webdav crash from #1793 (fixes #2084, thx hiroya)
Don’t print ssl error if client didn’t support TLS SNI

Thank you for flying light.

PRE-RELEASE: lighttpd 1.4.24rc1-r2656

stbuehler — Wed, 14 Oct 2009 19:24:00 +0200

We would like to draw your attention to the latest pre-release of the stable 1.4 branch of lighttpd.

You can get the pre-release from these urls:
http://www.lighttpd.net/download/lighttpd-1.4.24rc1-r2656.tar.gz
http://www.lighttpd.net/download/lighttpd-1.4.24rc1-r2656.tar.bz2
SHA1 checksums:
http://www.lighttpd.net/download/lighttpd-1.4.24rc1-r2656.sha1sum

Please test it as much as possible and provide us with feedback.
A lot of testing ensures a good release.

We have made many changes, especially regarding the core of our connection state machine (hopefully fixing the lingering socket close, which should fix pipelining), and the FastCGI internals (it should recover from crashing FastCGI applications)
There are two new features for SSL too: TLS SNI and client certificate validation.

If no showstoppers are encountered, there will be a final release soon.

Changelog since 1.4.23:

Add T_CONFIG_INT for bigger integers from the config (needed for #1966)
Use unsigned int (and T_CONFIG_INT) for max_request_size
Use unsigned int for secdownload.timeout (fixes #1966)
Keep url/host values from connection to display information while keep-alive in mod_status (fixes #1202 /issues/show/1202)
Add server.breakagelog, a “special” stderr (fixes #1863)
Fix config evaluation for debug.log-timeouts option (#1529)
Add “cgi.execute-x-only” to mod_cgi, requires +x for cgi scripts (fixes #2013)
Fix FD_SETSIZE comparision warnings
Add “lua-5.1” to searched pkg-config names for lua
Fix unused function webdav_lockdiscovery in mod_webdav
cmake: Fix crypt lib check
cmake: Add -export-dynamic to link flags, fixes build on FreeBSD
Set FD_CLOEXEC for bound sockets before pipe-logger forks (fixes #2026)
Reset ignored signals to SIG_DFL before exec() in fastcgi/scgi (fixes #2029)
Show “no uri specified -> 400” error only when “debug.log-request-header-on-error” is enabled (fixes #2030)
Fix hanging connection in mod_scgi (fixes #2024)
Allow digits in hostnames in more places (fixes #1148)
Use connection_reset instead of handle_request_done for cleanup callbacks
Change mod_expire to append Cache-Control instead of overwriting it (fixes #1997)
Allow all comparisons for $SERVER[“socket”] – only bind for ”==”
Remove strptime failed message (fixes #2031)
Fix issues found with clang analyzer
Try to fix server.tag issue with localized svnversion
Fix handling network-write return values (#2024)
Use disable-time in fastcgi for all disables after errors, default is 1sec (fixes #2040)
Remove adaptive spawning code from fastcgi (was disabled for a long time)
Allow mod_mysql_vhost to use stored procedures (fixes #2011, thx Ben Brown)
Fix ipv6 in mod_proxy (fixes #2043)
Print errors from include_shell to stderr
Set tm.tm_isdst = 0 before mktime() (fixes #2047)
Use linux-epoll by default if available (fixes #2021, thx Olaf van der Spek)
Print an error if you use too many captures in a regex pattern (fixes #2059)
Combine Cache-Control header value in mod_expire to existing HTTP header if header already added by other modules (fixes #2068)
Remember keep-alive-idle in separate variable (fixes #1988)
Fix header inclusion order, always include “config.h” before any system header
mod_webdav: Patch to skip login information for domain part of Destination field (fixes #1793)
mod_webdav: Delete old properties before updating new for MOVE (fixes #1317)
Read hostname from absolute uris in the request line (fixes #1937)
mod_fastcgi: don’t disable backend if disable-time is 0 (fixes #1825)
mod_compress: match partial+full content-type (fixes #1552)
mod_fastcgi: fix is_local detection, respawn backends if bin-path is set (fixes #897)
Fix linger-on-close behaviour to avoid rare failure conditions (was r2636, fixes #657)
mod_fastcgi: restart local procs immediately after they terminated, fix local procs handling
Fix segfault on invalid config “duplicate else conditions” (fixes #2065)
mod_usertrack: Use T_CONFIG_INT for max-age, solves range problem (#1455)
mod_accesslog: configurable timestamp logging (fixes #1479)
always define _GNU_SOURCE
Add some iterators for mod_magnet (fixes #1307)
Fix close_timeout_ts trigger (should finally fix lingering close)
mod_rewrite: add url.rewrite-[repeat-]if-not-file to rewrite if file doesn’t exist or is not a regular file (fixes #985, thx lucas aerbeydt)
Add TLS servername indication (SNI) support (fixes #386, thx Peter Colberg )
Add SSL Client Certificate verification (#1288)

Thank you for flying light.

spawn-fcgi 1.6.3 released

stbuehler — Wed, 23 Sep 2009 13:58:00 +0200

Just in case you didn’t see the announcement here

Please head over there for more information.

Downloads

http://www.lighttpd.net/download/spawn-fcgi-1.6.3.tar.gz
- SHA256: 7507a822995731629149040ee5686279b7582ae46f0296efd64b542ef052a90e
- SHA1: 2b97ea57d9d79745fe8d6051d830fa507b421169
- MD5: 6d75f9e9435056fa1e574d836d823cd0
http://www.lighttpd.net/download/spawn-fcgi-1.6.3.tar.bz2
- SHA256: e6721dc0fa59bb00e05f160406815d53c95e81ac28f7e52fbd36497584f846cd
- SHA1: 95e668079fa9ec144e3d014a50cc978a2d93eb9f
- MD5: 787ed2f88d2204bf1fe4fbd6e509d1d7
SHA256 checksums: http://www.lighttpd.net/download/spawn-fcgi-1.6.3.sha256sum
SHA1 checksums: http://www.lighttpd.net/download/spawn-fcgi-1.6.3.sha1sum
MD5 checksums: http://www.lighttpd.net/download/spawn-fcgi-1.6.3.md5sum

Changes

Fix unix socket mode change to work without specifying user/group for socket
Add some ./run script examples for use with daemontools or runit
Fix Invalid Argument in chmod if mode=-1 (fixes 2033)
Add deprecated and /bin/sh info for -f option; wrap syntax output (fixes #2044)
Add run script examples in automake dist build

Meanwhile...

icy — Sat, 12 Sep 2009 19:45:00 +0200

Hey folks,

back in december, we posted about a new lighty branch and opened up our project to the public: http://redmine.lighttpd.net/wiki/lighttpd-sandbox

It’s still not in a fully useable state yet, but we have been very busy and made huge progress meanwhile. Look what we had last time:

Dec 08:

the config handling is pretty complete
basic connection handling including throttling and keep-alive/IO timeouts works
error logging works (introducing multiple error log levels and targets)
module/plugin interface mostly done
completely multithreaded
serves static files

Apart from some minor features we can now say the core is almost done with just small changes or optimizations to it. We now start to add functionality to the core via modules and following ones already work pretty well:

mod_accesslog
mod_auth (auth-basic with plaintext files working)
mod_dirlist
mod_expire
mod_fastcgi (working pretty well already, giving usability a big boost!)
mod_openssl (ssl functionality provided through openssl)
mod_redirect (more powerful than in 1.x)
mod_rewrite (also more powerful than in 1.x)
mod_status
mod_vhost (virtual hosts, plenty of options and possibilities; combines mod_simple_vhost and mod_evhost plus more)

Performance seems to be really great so far. Thanks to being fully multithreaded, lighty 2.0 scales nicely with multicore CPUs.
It can handle several hundred thousand requests per second on a new Intel i7 (for really small static files, on localhost, not a great benchmark :P).

Let me tell you, alot has changed! And of course you’re welcome to test and have a look at its current state. But – just like last time – the forum as well as ticket/issue tracking is still disabled for it because we are not capable of providing any support as well as getting things done within a reasonable amount of time – so we focus on getting things done. :)

Some people might already be able to do basic stuff like serving static files, maybe play with fastcgi a little. As the config and design completely differs from 1.x you might already want to take a look or “test ride”. Remember: No support at the moment. :-)

We can’t (and really don’t want to) provide any specific release date but hope to have 2.0 in a usable state by the end of the year. Remember we do this in our free time for fun.

As for lighty 1.4 and 1.5: everything will continue like before – no worries.

This is it for today.

Thanks for flying light.