new patch for ssl issue in bug 214892

(Portage version: 2.1.4.4)
 (Unsigned Manifest commit)

4 files changed, 303 insertions, 0 deletions

diff --git a/www-servers/lighttpd/files/1.4.19-r2/03_all_lighttpd-1.4.11-errorlog-pipe.diff b/www-servers/lighttpd/files/1.4.19-r2/03_all_lighttpd-1.4.11-errorlog-pipe.diff
new file mode 100644
index 000000000000..c168eba74683
--- /dev/null
+++ b/www-servers/lighttpd/files/1.4.19-r2/03_all_lighttpd-1.4.11-errorlog-pipe.diff
@@ -0,0 +1,179 @@
+diff -ur lighttpd-1.4.11.orig/src/base.h lighttpd-1.4.11/src/base.h
+--- lighttpd-1.4.11.orig/src/base.h	2006-01-13 06:51:04.000000000 -0800
++++ lighttpd-1.4.11/src/base.h	2006-12-17 18:01:39.000000000 -0800
+@@ -505,7 +505,7 @@
+ 	
+ 	/* the errorlog */
+ 	int errorlog_fd;
+-	enum { ERRORLOG_STDERR, ERRORLOG_FILE, ERRORLOG_SYSLOG } errorlog_mode;
++	enum { ERRORLOG_STDERR, ERRORLOG_FILE, ERRORLOG_SYSLOG, ERRORLOG_PIPE } errorlog_mode;
+ 	buffer *errorlog_buf;
+ 	
+ 	fdevents *ev, *ev_ins;
+diff -ur lighttpd-1.4.11.orig/src/log.c lighttpd-1.4.11/src/log.c
+--- lighttpd-1.4.11.orig/src/log.c	2005-13-07 05:01:35.000000000 -0800
++++ lighttpd-1.4.11/src/log.c	2006-12-17 18:09:43.000000000 -0800
+@@ -34,10 +34,11 @@
+ /** 
+  * open the errorlog
+  * 
+- * we have 3 possibilities:
++ * we have 4 possibilities:
+  * - stderr (default)
+  * - syslog 
+  * - logfile
++ * - pipe
+  * 
+  * if the open failed, report to the user and die
+  * 
+@@ -57,21 +58,81 @@
+ 		srv->errorlog_mode = ERRORLOG_SYSLOG;
+ 	} else if (!buffer_is_empty(srv->srvconf.errorlog_file)) {
+ 		const char *logfile = srv->srvconf.errorlog_file->ptr;
+-		
+-		if (-1 == (srv->errorlog_fd = open(logfile, O_APPEND | O_WRONLY | O_CREAT | O_LARGEFILE, 0644))) {
+-			log_error_write(srv, __FILE__, __LINE__, "SSSS", 
+-					"opening errorlog '", logfile,
+-					"' failed: ", strerror(errno));
+-			
++
++		if (logfile[0] == '|') {
++#ifdef HAVE_FORK
++			/* create write pipe and spawn process */
++
++			int to_log_fds[2];
++			pid_t pid;
++
++			if (pipe(to_log_fds)) {
++				log_error_write(srv, __FILE__, __LINE__, "ss",
++				"pipe failed: ", strerror(errno));
++				return -1;
++			}
++
++			/* fork, execve */
++			switch (pid = fork()) {
++			case 0:
++				/* child */
++
++				close(STDIN_FILENO);
++				dup2(to_log_fds[0], STDIN_FILENO);
++				close(to_log_fds[0]);
++				/* not needed */
++				close(to_log_fds[1]);
++
++				/* we don't need the client socket */
++				for (fd = 3; fd < 256; fd++) {
++					close(fd);
++				}
++
++				/* exec the log-process (skip the | )
++				 *
++				 */
++
++				execl("/bin/sh", "sh", "-c", logfile + 1, NULL);
++				
++				log_error_write(srv, __FILE__, __LINE__, "sss",
++					"spawning log-process failed: ",
++					strerror(errno), logfile + 1);
++
++				exit(-1);
++				break;
++			case -1:
++				/* error */
++				log_error_write(srv, __FILE__, __LINE__, "ss", "fork failed:", strerror(errno));
++				break;
++			default:
++				close(to_log_fds[0]);
++
++				srv->errorlog_fd = to_log_fds[1];
++
++				break;
++			}
++			srv->errorlog_mode = ERRORLOG_PIPE;
++#else
++			log_error_write(srv, __FILE__, __LINE__, "SSS",
++				"opening errorlog '", logfile,"' impossible");
+ 			return -1;
+-		}
++#endif
++		} else {
++			if (-1 == (srv->errorlog_fd = open(logfile, O_APPEND | O_WRONLY | O_CREAT | O_LARGEFILE, 0644))) {
++				log_error_write(srv, __FILE__, __LINE__, "SSSS",
++  					"opening errorlog '", logfile,
++  					"' failed: ", strerror(errno));
++  
++				return -1;
++			}
++			srv->errorlog_mode = ERRORLOG_FILE;
++  		}
+ #ifdef FD_CLOEXEC
+-		/* close fd on exec (cgi) */
+-		fcntl(srv->errorlog_fd, F_SETFD, FD_CLOEXEC);
++  		/* close fd on exec (cgi) */
++  		fcntl(srv->errorlog_fd, F_SETFD, FD_CLOEXEC);
+ #endif
+-		srv->errorlog_mode = ERRORLOG_FILE;
+-	}
+-	
++  	}
++  
+ 	log_error_write(srv, __FILE__, __LINE__, "s", "server started");
+ 	
+ #ifdef HAVE_VALGRIND_VALGRIND_H
+@@ -99,7 +160,7 @@
+  */
+ 
+ int log_error_cycle(server *srv) {
+-	/* only cycle if we are not in syslog-mode */
++	/* only cycle if the error log is a file */
+ 	
+ 	if (srv->errorlog_mode == ERRORLOG_FILE) {
+ 		const char *logfile = srv->srvconf.errorlog_file->ptr;
+@@ -135,6 +196,7 @@
+ 	log_error_write(srv, __FILE__, __LINE__, "s", "server stopped");
+ 	
+ 	switch(srv->errorlog_mode) {
++	case ERRORLOG_PIPE: /* fall through */
+ 	case ERRORLOG_FILE:
+ 		close(srv->errorlog_fd);
+ 		break;
+@@ -154,6 +216,7 @@
+ 	va_list ap;
+ 	
+ 	switch(srv->errorlog_mode) {
++	case ERRORLOG_PIPE:
+ 	case ERRORLOG_FILE:
+ 	case ERRORLOG_STDERR:
+ 		/* cache the generated timestamp */
+@@ -238,6 +301,7 @@
+ 	va_end(ap);
+ 	
+ 	switch(srv->errorlog_mode) {
++	case ERRORLOG_PIPE: /* fall through */
+ 	case ERRORLOG_FILE:
+ 		BUFFER_APPEND_STRING_CONST(srv->errorlog_buf, "\n");
+ 		write(srv->errorlog_fd, srv->errorlog_buf->ptr, srv->errorlog_buf->used - 1);
+diff -ur lighttpd-1.4.11.orig/src/mod_cgi.c lighttpd-1.4.11/src/mod_cgi.c
+--- lighttpd-1.4.11.orig/src/mod_cgi.c	2006-02-22 05:15:10.000000000 -0800
++++ lighttpd-1.4.11/src/mod_cgi.c	2006-12-17 18:01:39.000000000 -0800
+@@ -750,7 +750,7 @@
+ 		 *
+ 		 * we feed the stderr of the CGI to our errorlog, if possible
+ 		 */
+-		if (srv->errorlog_mode == ERRORLOG_FILE) {
++		if ((srv->errorlog_mode == ERRORLOG_FILE) || (srv->errorlog_mode == ERRORLOG_PIPE)) {
+ 			close(STDERR_FILENO);
+ 			dup2(srv->errorlog_fd, STDERR_FILENO);
+ 		}
+diff -ur lighttpd-1.4.11.orig/src/mod_rrdtool.c lighttpd-1.4.11/src/mod_rrdtool.c
+--- lighttpd-1.4.11.orig/src/mod_rrdtool.c	2005-08-21 15:52:24.000000000 -0700
++++ lighttpd-1.4.11/src/mod_rrdtool.c	2006-12-17 18:01:39.000000000 -0800
+@@ -134,7 +134,7 @@
+ 		
+ 		close(STDERR_FILENO);
+ 		
+-		if (srv->errorlog_mode == ERRORLOG_FILE) {
++		if ((srv->errorlog_mode == ERRORLOG_FILE) || (srv->errorlog_mode == ERRORLOG_PIPE)) {
+ 			dup2(srv->errorlog_fd, STDERR_FILENO);
+ 			close(srv->errorlog_fd);
+ 		}
diff --git a/www-servers/lighttpd/files/1.4.19-r2/04_all_lighttpd-1.4.13-deprecated-ldap-api.diff b/www-servers/lighttpd/files/1.4.19-r2/04_all_lighttpd-1.4.13-deprecated-ldap-api.diff
new file mode 100644
index 000000000000..259ad4b279a5
--- /dev/null
+++ b/www-servers/lighttpd/files/1.4.19-r2/04_all_lighttpd-1.4.13-deprecated-ldap-api.diff
@@ -0,0 +1,10 @@
+--- lighttpd-1.4.13.old/src/Makefile.am	2006-10-09 12:19:34.000000000 -0400
++++ lighttpd-1.4.13/src/Makefile.am	2007-03-26 10:10:26.000000000 -0400
+@@ -213,6 +213,7 @@
+ mod_auth_la_SOURCES = mod_auth.c http_auth_digest.c http_auth.c
+ mod_auth_la_LDFLAGS = -module -export-dynamic -avoid-version -no-undefined
+ mod_auth_la_LIBADD = $(CRYPT_LIB) $(LDAP_LIB) $(LBER_LIB) $(common_libadd)
++mod_auth_la_CFLAGS = -DLDAP_DEPRECATED
+ 
+ lib_LTLIBRARIES += mod_rewrite.la
+ mod_rewrite_la_SOURCES = mod_rewrite.c
diff --git a/www-servers/lighttpd/files/1.4.19-r2/05_all_lighttpd-1.4.19-force_lowercase_filenames_in_mod_userdir.diff b/www-servers/lighttpd/files/1.4.19-r2/05_all_lighttpd-1.4.19-force_lowercase_filenames_in_mod_userdir.diff
new file mode 100644
index 000000000000..9d67afd049ed
--- /dev/null
+++ b/www-servers/lighttpd/files/1.4.19-r2/05_all_lighttpd-1.4.19-force_lowercase_filenames_in_mod_userdir.diff
@@ -0,0 +1,14 @@
+--- lighttpd-1.4.19/src/mod_userdir.c	2008-03-10 22:45:29.000000000 +1100
++++ lighty-dev/src/mod_userdir.c	2008-03-12 17:44:43.000000000 +1100
+@@ -286,6 +286,11 @@
+ 
+ 	BUFFER_APPEND_SLASH(p->temp_path);
+ 	buffer_append_string(p->temp_path, rel_url + 1); /* skip the / */
++
++    if (con->conf.force_lowercase_filenames) {
++        buffer_to_lower(p->temp_path);
++    }
++
+ 	buffer_copy_string_buffer(con->physical.path, p->temp_path);
+ 
+ 	buffer_reset(p->temp_path);
diff --git a/www-servers/lighttpd/files/1.4.19-r2/07_all_lighttpd-1.4.19-closing_foreign_ssl_connections-dos-taketwo.diff b/www-servers/lighttpd/files/1.4.19-r2/07_all_lighttpd-1.4.19-closing_foreign_ssl_connections-dos-taketwo.diff
new file mode 100644
index 000000000000..d2f3801f7c30
--- /dev/null
+++ b/www-servers/lighttpd/files/1.4.19-r2/07_all_lighttpd-1.4.19-closing_foreign_ssl_connections-dos-taketwo.diff
@@ -0,0 +1,100 @@
+diff -r ade3eead0e8d -r 82c24356bcd0 NEWS
+--- a/NEWS	Fri Mar 28 16:30:14 2008 +0100
++++ b/NEWS	Fri Mar 28 17:45:28 2008 +0100
+@@ -8,6 +8,7 @@
+   * added support for If-Range: <date> (#1346)
+   * added support for matching $HTTP["scheme"] in configs
+   * fixed initgroups() called after chroot (#1384)
++  * Fix #285 again: read error after SSL_shutdown (thx marton.illes@balabit.com) and clear the error queue before some other calls
+   * fixed case-sensitive check for Auth-Method (#1456)
+   * execute fcgi app without /bin/sh if used as argument to spawn-fcgi (#1428)
+   * fixed a bug that made /-prefixed extensions being handled also when
+diff -r ade3eead0e8d -r 82c24356bcd0 src/connections.c
+--- a/src/connections.c	Fri Mar 28 16:30:14 2008 +0100
++++ b/src/connections.c	Fri Mar 28 17:45:28 2008 +0100
+@@ -199,6 +199,7 @@
+ 
+ 	/* don't resize the buffer if we were in SSL_ERROR_WANT_* */
+ 
++	ERR_clear_error();
+ 	do {
+ 		if (!con->ssl_error_want_reuse_buffer) {
+ 			b = buffer_init();
+@@ -1668,21 +1669,51 @@
+ 			}
+ #ifdef USE_OPENSSL
+ 			if (srv_sock->is_ssl) {
+-				int ret;
++				int ret, ssl_r;
++				unsigned long err;
++				ERR_clear_error();
+ 				switch ((ret = SSL_shutdown(con->ssl))) {
+ 				case 1:
+ 					/* ok */
+ 					break;
+ 				case 0:
+-					SSL_shutdown(con->ssl);
+-					break;
++					ERR_clear_error();
++					if (-1 != (ret = SSL_shutdown(con->ssl))) break;
++
++					// fall through
+ 				default:
+-					log_error_write(srv, __FILE__, __LINE__, "sds", "SSL:",
+-							SSL_get_error(con->ssl, ret),
+-							ERR_error_string(ERR_get_error(), NULL));
+-					return -1;
++
++					switch ((ssl_r = SSL_get_error(con->ssl, ret))) {
++					case SSL_ERROR_WANT_WRITE:
++					case SSL_ERROR_WANT_READ:
++						break;
++					case SSL_ERROR_SYSCALL:
++						/* perhaps we have error waiting in our error-queue */
++						if (0 != (err = ERR_get_error())) {
++							do {
++								log_error_write(srv, __FILE__, __LINE__, "sdds", "SSL:",
++										ssl_r, ret,
++										ERR_error_string(err, NULL));
++							} while((err = ERR_get_error()));
++						} else {
++							log_error_write(srv, __FILE__, __LINE__, "sddds", "SSL (error):",
++									ssl_r, r, errno,
++									strerror(errno));
++						}
++	
++						break;
++					default:
++						while((err = ERR_get_error())) {
++							log_error_write(srv, __FILE__, __LINE__, "sdds", "SSL:",
++									ssl_r, ret,
++									ERR_error_string(err, NULL));
++						}
++	
++						break;
++					}
+ 				}
+ 			}
++			ERR_clear_error();
+ #endif
+ 
+ 			switch(con->mode) {
+diff -r ade3eead0e8d -r 82c24356bcd0 src/network_openssl.c
+--- a/src/network_openssl.c	Fri Mar 28 16:30:14 2008 +0100
++++ b/src/network_openssl.c	Fri Mar 28 17:45:28 2008 +0100
+@@ -85,6 +85,7 @@
+ 			 *
+ 			 */
+ 
++			ERR_clear_error();
+ 			if ((r = SSL_write(ssl, offset, toSend)) <= 0) {
+ 				unsigned long err;
+ 
+@@ -187,6 +188,7 @@
+ 
+ 				close(ifd);
+ 
++				ERR_clear_error();
+ 				if ((r = SSL_write(ssl, s, toSend)) <= 0) {
+ 					unsigned long err;
+