* [gentoo-commits] gentoo-x86 commit in www-servers/lighttpd/files/1.4.19-r2: 03_all_lighttpd-1.4.11-errorlog-pipe.diff 04_all_lighttpd-1.4.13-deprecated-ldap-api.diff 05_all_lighttpd-1.4.19-force_lowercase_filenames_in_mod_userdir.diff 07_all_lighttpd-1.4.19-closing_foreign_ssl_connections-dos-taketwo.diff
@ 2008-03-31 6:15 Thilo Bangert (bangert)
0 siblings, 0 replies; only message in thread
From: Thilo Bangert (bangert) @ 2008-03-31 6:15 UTC (permalink / raw
To: gentoo-commits
bangert 08/03/31 06:15:17
Added: 03_all_lighttpd-1.4.11-errorlog-pipe.diff
04_all_lighttpd-1.4.13-deprecated-ldap-api.diff
05_all_lighttpd-1.4.19-force_lowercase_filenames_in_mod_userdir.diff
07_all_lighttpd-1.4.19-closing_foreign_ssl_connections-dos-taketwo.diff
Log:
new patch for ssl issue in bug 214892
(Portage version: 2.1.4.4)
(Unsigned Manifest commit)
Revision Changes Path
1.1 www-servers/lighttpd/files/1.4.19-r2/03_all_lighttpd-1.4.11-errorlog-pipe.diff
file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/www-servers/lighttpd/files/1.4.19-r2/03_all_lighttpd-1.4.11-errorlog-pipe.diff?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/www-servers/lighttpd/files/1.4.19-r2/03_all_lighttpd-1.4.11-errorlog-pipe.diff?rev=1.1&content-type=text/plain
Index: 03_all_lighttpd-1.4.11-errorlog-pipe.diff
===================================================================
diff -ur lighttpd-1.4.11.orig/src/base.h lighttpd-1.4.11/src/base.h
--- lighttpd-1.4.11.orig/src/base.h 2006-01-13 06:51:04.000000000 -0800
+++ lighttpd-1.4.11/src/base.h 2006-12-17 18:01:39.000000000 -0800
@@ -505,7 +505,7 @@
/* the errorlog */
int errorlog_fd;
- enum { ERRORLOG_STDERR, ERRORLOG_FILE, ERRORLOG_SYSLOG } errorlog_mode;
+ enum { ERRORLOG_STDERR, ERRORLOG_FILE, ERRORLOG_SYSLOG, ERRORLOG_PIPE } errorlog_mode;
buffer *errorlog_buf;
fdevents *ev, *ev_ins;
diff -ur lighttpd-1.4.11.orig/src/log.c lighttpd-1.4.11/src/log.c
--- lighttpd-1.4.11.orig/src/log.c 2005-13-07 05:01:35.000000000 -0800
+++ lighttpd-1.4.11/src/log.c 2006-12-17 18:09:43.000000000 -0800
@@ -34,10 +34,11 @@
/**
* open the errorlog
*
- * we have 3 possibilities:
+ * we have 4 possibilities:
* - stderr (default)
* - syslog
* - logfile
+ * - pipe
*
* if the open failed, report to the user and die
*
@@ -57,21 +58,81 @@
srv->errorlog_mode = ERRORLOG_SYSLOG;
} else if (!buffer_is_empty(srv->srvconf.errorlog_file)) {
const char *logfile = srv->srvconf.errorlog_file->ptr;
-
- if (-1 == (srv->errorlog_fd = open(logfile, O_APPEND | O_WRONLY | O_CREAT | O_LARGEFILE, 0644))) {
- log_error_write(srv, __FILE__, __LINE__, "SSSS",
- "opening errorlog '", logfile,
- "' failed: ", strerror(errno));
-
+
+ if (logfile[0] == '|') {
+#ifdef HAVE_FORK
+ /* create write pipe and spawn process */
+
+ int to_log_fds[2];
+ pid_t pid;
+
+ if (pipe(to_log_fds)) {
+ log_error_write(srv, __FILE__, __LINE__, "ss",
+ "pipe failed: ", strerror(errno));
+ return -1;
+ }
+
+ /* fork, execve */
+ switch (pid = fork()) {
+ case 0:
+ /* child */
+
+ close(STDIN_FILENO);
+ dup2(to_log_fds[0], STDIN_FILENO);
+ close(to_log_fds[0]);
+ /* not needed */
+ close(to_log_fds[1]);
+
+ /* we don't need the client socket */
+ for (fd = 3; fd < 256; fd++) {
+ close(fd);
+ }
+
+ /* exec the log-process (skip the | )
+ *
+ */
+
+ execl("/bin/sh", "sh", "-c", logfile + 1, NULL);
+
+ log_error_write(srv, __FILE__, __LINE__, "sss",
+ "spawning log-process failed: ",
+ strerror(errno), logfile + 1);
+
+ exit(-1);
+ break;
+ case -1:
+ /* error */
+ log_error_write(srv, __FILE__, __LINE__, "ss", "fork failed:", strerror(errno));
+ break;
+ default:
+ close(to_log_fds[0]);
+
+ srv->errorlog_fd = to_log_fds[1];
+
+ break;
+ }
+ srv->errorlog_mode = ERRORLOG_PIPE;
+#else
+ log_error_write(srv, __FILE__, __LINE__, "SSS",
+ "opening errorlog '", logfile,"' impossible");
return -1;
- }
+#endif
+ } else {
+ if (-1 == (srv->errorlog_fd = open(logfile, O_APPEND | O_WRONLY | O_CREAT | O_LARGEFILE, 0644))) {
+ log_error_write(srv, __FILE__, __LINE__, "SSSS",
+ "opening errorlog '", logfile,
+ "' failed: ", strerror(errno));
+
+ return -1;
+ }
+ srv->errorlog_mode = ERRORLOG_FILE;
+ }
#ifdef FD_CLOEXEC
- /* close fd on exec (cgi) */
- fcntl(srv->errorlog_fd, F_SETFD, FD_CLOEXEC);
+ /* close fd on exec (cgi) */
+ fcntl(srv->errorlog_fd, F_SETFD, FD_CLOEXEC);
#endif
- srv->errorlog_mode = ERRORLOG_FILE;
- }
-
+ }
+
log_error_write(srv, __FILE__, __LINE__, "s", "server started");
#ifdef HAVE_VALGRIND_VALGRIND_H
@@ -99,7 +160,7 @@
*/
int log_error_cycle(server *srv) {
- /* only cycle if we are not in syslog-mode */
+ /* only cycle if the error log is a file */
if (srv->errorlog_mode == ERRORLOG_FILE) {
const char *logfile = srv->srvconf.errorlog_file->ptr;
@@ -135,6 +196,7 @@
log_error_write(srv, __FILE__, __LINE__, "s", "server stopped");
switch(srv->errorlog_mode) {
+ case ERRORLOG_PIPE: /* fall through */
case ERRORLOG_FILE:
close(srv->errorlog_fd);
break;
@@ -154,6 +216,7 @@
va_list ap;
switch(srv->errorlog_mode) {
+ case ERRORLOG_PIPE:
case ERRORLOG_FILE:
case ERRORLOG_STDERR:
/* cache the generated timestamp */
@@ -238,6 +301,7 @@
va_end(ap);
switch(srv->errorlog_mode) {
+ case ERRORLOG_PIPE: /* fall through */
case ERRORLOG_FILE:
BUFFER_APPEND_STRING_CONST(srv->errorlog_buf, "\n");
write(srv->errorlog_fd, srv->errorlog_buf->ptr, srv->errorlog_buf->used - 1);
diff -ur lighttpd-1.4.11.orig/src/mod_cgi.c lighttpd-1.4.11/src/mod_cgi.c
--- lighttpd-1.4.11.orig/src/mod_cgi.c 2006-02-22 05:15:10.000000000 -0800
+++ lighttpd-1.4.11/src/mod_cgi.c 2006-12-17 18:01:39.000000000 -0800
@@ -750,7 +750,7 @@
*
* we feed the stderr of the CGI to our errorlog, if possible
*/
- if (srv->errorlog_mode == ERRORLOG_FILE) {
+ if ((srv->errorlog_mode == ERRORLOG_FILE) || (srv->errorlog_mode == ERRORLOG_PIPE)) {
close(STDERR_FILENO);
dup2(srv->errorlog_fd, STDERR_FILENO);
}
diff -ur lighttpd-1.4.11.orig/src/mod_rrdtool.c lighttpd-1.4.11/src/mod_rrdtool.c
--- lighttpd-1.4.11.orig/src/mod_rrdtool.c 2005-08-21 15:52:24.000000000 -0700
+++ lighttpd-1.4.11/src/mod_rrdtool.c 2006-12-17 18:01:39.000000000 -0800
@@ -134,7 +134,7 @@
close(STDERR_FILENO);
- if (srv->errorlog_mode == ERRORLOG_FILE) {
+ if ((srv->errorlog_mode == ERRORLOG_FILE) || (srv->errorlog_mode == ERRORLOG_PIPE)) {
dup2(srv->errorlog_fd, STDERR_FILENO);
close(srv->errorlog_fd);
}
1.1 www-servers/lighttpd/files/1.4.19-r2/04_all_lighttpd-1.4.13-deprecated-ldap-api.diff
file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/www-servers/lighttpd/files/1.4.19-r2/04_all_lighttpd-1.4.13-deprecated-ldap-api.diff?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/www-servers/lighttpd/files/1.4.19-r2/04_all_lighttpd-1.4.13-deprecated-ldap-api.diff?rev=1.1&content-type=text/plain
Index: 04_all_lighttpd-1.4.13-deprecated-ldap-api.diff
===================================================================
--- lighttpd-1.4.13.old/src/Makefile.am 2006-10-09 12:19:34.000000000 -0400
+++ lighttpd-1.4.13/src/Makefile.am 2007-03-26 10:10:26.000000000 -0400
@@ -213,6 +213,7 @@
mod_auth_la_SOURCES = mod_auth.c http_auth_digest.c http_auth.c
mod_auth_la_LDFLAGS = -module -export-dynamic -avoid-version -no-undefined
mod_auth_la_LIBADD = $(CRYPT_LIB) $(LDAP_LIB) $(LBER_LIB) $(common_libadd)
+mod_auth_la_CFLAGS = -DLDAP_DEPRECATED
lib_LTLIBRARIES += mod_rewrite.la
mod_rewrite_la_SOURCES = mod_rewrite.c
1.1 www-servers/lighttpd/files/1.4.19-r2/05_all_lighttpd-1.4.19-force_lowercase_filenames_in_mod_userdir.diff
file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/www-servers/lighttpd/files/1.4.19-r2/05_all_lighttpd-1.4.19-force_lowercase_filenames_in_mod_userdir.diff?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/www-servers/lighttpd/files/1.4.19-r2/05_all_lighttpd-1.4.19-force_lowercase_filenames_in_mod_userdir.diff?rev=1.1&content-type=text/plain
Index: 05_all_lighttpd-1.4.19-force_lowercase_filenames_in_mod_userdir.diff
===================================================================
--- lighttpd-1.4.19/src/mod_userdir.c 2008-03-10 22:45:29.000000000 +1100
+++ lighty-dev/src/mod_userdir.c 2008-03-12 17:44:43.000000000 +1100
@@ -286,6 +286,11 @@
BUFFER_APPEND_SLASH(p->temp_path);
buffer_append_string(p->temp_path, rel_url + 1); /* skip the / */
+
+ if (con->conf.force_lowercase_filenames) {
+ buffer_to_lower(p->temp_path);
+ }
+
buffer_copy_string_buffer(con->physical.path, p->temp_path);
buffer_reset(p->temp_path);
1.1 www-servers/lighttpd/files/1.4.19-r2/07_all_lighttpd-1.4.19-closing_foreign_ssl_connections-dos-taketwo.diff
file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/www-servers/lighttpd/files/1.4.19-r2/07_all_lighttpd-1.4.19-closing_foreign_ssl_connections-dos-taketwo.diff?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/www-servers/lighttpd/files/1.4.19-r2/07_all_lighttpd-1.4.19-closing_foreign_ssl_connections-dos-taketwo.diff?rev=1.1&content-type=text/plain
Index: 07_all_lighttpd-1.4.19-closing_foreign_ssl_connections-dos-taketwo.diff
===================================================================
diff -r ade3eead0e8d -r 82c24356bcd0 NEWS
--- a/NEWS Fri Mar 28 16:30:14 2008 +0100
+++ b/NEWS Fri Mar 28 17:45:28 2008 +0100
@@ -8,6 +8,7 @@
* added support for If-Range: <date> (#1346)
* added support for matching $HTTP["scheme"] in configs
* fixed initgroups() called after chroot (#1384)
+ * Fix #285 again: read error after SSL_shutdown (thx marton.illes@balabit.com) and clear the error queue before some other calls
* fixed case-sensitive check for Auth-Method (#1456)
* execute fcgi app without /bin/sh if used as argument to spawn-fcgi (#1428)
* fixed a bug that made /-prefixed extensions being handled also when
diff -r ade3eead0e8d -r 82c24356bcd0 src/connections.c
--- a/src/connections.c Fri Mar 28 16:30:14 2008 +0100
+++ b/src/connections.c Fri Mar 28 17:45:28 2008 +0100
@@ -199,6 +199,7 @@
/* don't resize the buffer if we were in SSL_ERROR_WANT_* */
+ ERR_clear_error();
do {
if (!con->ssl_error_want_reuse_buffer) {
b = buffer_init();
@@ -1668,21 +1669,51 @@
}
#ifdef USE_OPENSSL
if (srv_sock->is_ssl) {
- int ret;
+ int ret, ssl_r;
+ unsigned long err;
+ ERR_clear_error();
switch ((ret = SSL_shutdown(con->ssl))) {
case 1:
/* ok */
break;
case 0:
- SSL_shutdown(con->ssl);
- break;
+ ERR_clear_error();
+ if (-1 != (ret = SSL_shutdown(con->ssl))) break;
+
+ // fall through
default:
- log_error_write(srv, __FILE__, __LINE__, "sds", "SSL:",
- SSL_get_error(con->ssl, ret),
- ERR_error_string(ERR_get_error(), NULL));
- return -1;
+
+ switch ((ssl_r = SSL_get_error(con->ssl, ret))) {
+ case SSL_ERROR_WANT_WRITE:
+ case SSL_ERROR_WANT_READ:
+ break;
+ case SSL_ERROR_SYSCALL:
+ /* perhaps we have error waiting in our error-queue */
+ if (0 != (err = ERR_get_error())) {
+ do {
+ log_error_write(srv, __FILE__, __LINE__, "sdds", "SSL:",
+ ssl_r, ret,
+ ERR_error_string(err, NULL));
+ } while((err = ERR_get_error()));
+ } else {
+ log_error_write(srv, __FILE__, __LINE__, "sddds", "SSL (error):",
+ ssl_r, r, errno,
+ strerror(errno));
+ }
+
+ break;
+ default:
+ while((err = ERR_get_error())) {
+ log_error_write(srv, __FILE__, __LINE__, "sdds", "SSL:",
+ ssl_r, ret,
+ ERR_error_string(err, NULL));
+ }
+
+ break;
+ }
}
}
+ ERR_clear_error();
#endif
switch(con->mode) {
diff -r ade3eead0e8d -r 82c24356bcd0 src/network_openssl.c
--- a/src/network_openssl.c Fri Mar 28 16:30:14 2008 +0100
+++ b/src/network_openssl.c Fri Mar 28 17:45:28 2008 +0100
@@ -85,6 +85,7 @@
*
*/
+ ERR_clear_error();
if ((r = SSL_write(ssl, offset, toSend)) <= 0) {
unsigned long err;
@@ -187,6 +188,7 @@
close(ifd);
+ ERR_clear_error();
if ((r = SSL_write(ssl, s, toSend)) <= 0) {
unsigned long err;
--
gentoo-commits@lists.gentoo.org mailing list
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2008-03-31 6:15 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2008-03-31 6:15 [gentoo-commits] gentoo-x86 commit in www-servers/lighttpd/files/1.4.19-r2: 03_all_lighttpd-1.4.11-errorlog-pipe.diff 04_all_lighttpd-1.4.13-deprecated-ldap-api.diff 05_all_lighttpd-1.4.19-force_lowercase_filenames_in_mod_userdir.diff 07_all_lighttpd-1.4.19-closing_foreign_ssl_connections-dos-taketwo.diff Thilo Bangert (bangert)
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox