Thema: Mini/Test/DHCP/Webserver und Tools diverses

[SiLæncer]

Changelog

Security: when using HTTP/2 a client might cause excessive memory consumption (CVE-2018-16843) and CPU usage (CVE-2018-16844).
Security: processing of a specially crafted mp4 file with the ngx_http_mp4_module might result in worker process memory disclosure (CVE-2018-16845).
Feature: the "proxy_socket_keepalive", "fastcgi_socket_keepalive", "grpc_socket_keepalive", "memcached_socket_keepalive", "scgi_socket_keepalive", and "uwsgi_socket_keepalive" directives.
Bugfix: if nginx was built with OpenSSL 1.1.0 and used with OpenSSL 1.1.1, the TLS 1.3 protocol was always enabled.
Bugfix: working with gRPC backends might result in excessive memory consumption.

[close]

http://nginx.org/

[SiLæncer]

Changelog

[mysql] MySQL 8 deprecates my_bool
[core] typo in trace
[build] Fix unportable test(1) operator
[core] perf: call connection_reset() fewer times
[core] perf: array_reset_data_strings()
[core] perf: buffer_free_ptr() attribute cold
[core] perf: one-element cache for host normalize
[core] perf: buffer_copy_string_len()
[core] perf: skip redundant prepare copy calls
[core] perf: buffer_align_size() identity if align
[core] perf: size write buffers for reuse
[core] perf: prepend headers directly into write q
[core] perf: copy small strings; better buf reuse
[core] perf: copy small strings; extend last chunk
[core] perf: specialized func for array sorting
[core] perf: append response directly into write q
[core] perf: better buf reuse reading from backend
[core] chunk.c code reuse
[multiple] perf: write headers to backend write cq
[multiple] perf: power-2 alloc large headers
[multiple] perf: use larger initial backend buffer
[core] permit env vars to be set with blank value
[mod_fastcgi] perf: reduce data copies
[mod_fastcgi] perf: reduce data copies
[core] perf: chunk.c chunk pool
[multiple] perf: reuse large buffers w/ backend
[multiple] better packing of struct chunk
[core] perf: inline buffer_append_string_buffer()
[core] slightly simpler flag append to string
[mod_cgi] perf: reuse buffers for creating CGI env
[mod_fastcgi,mod_scgi] perf: env accumulation
[core] Don’t call RAND_cleanup with OpenSSL 1.1.x
[mod_openssl] move SSL_shutdown() to separate func
[mod_openssl] SSL_read before second SSL_shutdown
[mod_cgi] perf: use stat_cache for cgi handler
[mod_openssl] prefer using TLS_server_method()
[mod_webdav] return 403 if file should exist
[core] perf: chunkqueue buffers already sized up
[core] perf: simpler buffer_string_space()
[multiple] dynamic handlers hint backend header sz
[core] use chunk_buf_sz instead of hard-coded num
[multiple] perf: simplify chunkqueue_get_memory()
[mod_wstunnel] perf: reuse large buffers
[mod_cgi] perf: cache getenv() results at start up
[core] fix 301 → 302 overwrite with Location (fixes #2918)
[core] fix setting of headers previously reset (fixes #2919)
[mod_webdav] quiet coverity false positive
[core] server.compat-module-load = “disable”
[core] server.chunkqueue-chunk-sz = 4096
[core] perf: simpler buffer_string_space() (fixed)
[core] perf: faster HTTP pipelined requests
[core] perf: simpler buffer_string_space() (tests)
[mod_cgi] reset reused buffer on internal redir
[core] clear chunk buffer upon release
[mod_fastcgi] minor: copy packet without padding
[mod_redirect,mod_rewrite] use server_name
[mod_fastcgi] transfer chunks minus packet padding
[core] separate func to reset FILE_CHUNK
[core] perf: simple, quick buffer_clear()
[core] perf: small improvement to encoding CGI var
[core] perf: small improvement buffer_string_space
[core] simpler physical path concatenation
[mod_webdav] fix LOCK on incorrect URI path
[mod_webdav] one fewer buffer copy for COPY,MOVE
[core] perf: simplify buffer_move()
[mod_cml] parse query string without modifying it
[core] perf: buffer optimizations
[mod_wstunnel] use buffer_string_length()
[core] perf: inline buffer_copy_buffer()
[core] cygwin helper func for getcwd
[core] cygwin sample to run lighttpd under NSSM
[core] limit con→uri.authority < 1024 octets
[mod_webdav] separate func for each request method
[core] reject decoded url-path without leading ‘/’
[multiple] validate UTF-8 in url-decoded paths
[mod_proxy] silence coverity false positive
[core] fix typo
[core] buffer_append_path_len()
[core] quiet indexfile warning if mod not loaded

[close]

http://www.lighttpd.net/

[SiLæncer]

Abyss Web Server is a full-featured web server with a small footprint. It supports HTTP/1.1, dynamic content generation through CGI/1.1 scripts, ISAPI extensions, Server Side Includes (SSI), custom error pages, password protection, IP address control, anti-leeching, and bandwidth throttling. It also features also automatic anti-hacking as well as a multilingual remote web management interface that makes its configuration as easy as browsing a web site.

License: Freeware

Changelog

New Features

    Integrated support for automatically requesting, fetching, and installing free SSL/TLS certificates from ACME certification authorities such as Let's Encrypt®. No third party script or tool is required for this feature which is fully controllable using the Web-based console of Abyss Web Server.
    The reverse-proxy feature now supports HTTPS and WebSocket back-ends.
    Added support for dual hosting on both HTTP and HTTPS in the free personal edition X1. This feature was previously only available in the professional edition X2.
    Added a new field Debugging Label to URL rewriting rules. Such a label, if defined, will be added in the URL rewriting log to help locate the rules as they are listed and reported.
    Added support for Linux distributions based on a systemd init system. The autostart-setup script has been updated accordingly and will now install Abyss Web Server as a service on almost any Linux distribution.

Improved macOS support

The new version improves macOS support in numerous ways:

    Abyss Web Server features support for the new Dark Mode on macOS 10.14 (Mojave.)
    Abyss Web Server is now conformant with modern macOS GateKeeper and integrated firewall thanks to its signature.
    Abyss Web Server will run on the latest macOS 10.14 (Mojave) down to Mac OS X 10.4 (Lion).
    Abyss Web Server ships as a 3-architecture Universal Binary. Inside its application, there are three native executables side by side, each for a different architecture. Abyss Web Server will run natively on modern 64-bit Intel Macs (x86_64), on legacy 32-bit Intel Macs (i386) and on legacy PowerPC Macs (ppc.)

Native PowerPC support as well as Mac OS X 10.4 as a minimum requirement makes Abyss Web Server one of the rare modern day software that continues to be compatible with Macs built 1999 onward. This is part of our effort to help our users and customers maintain their old computers and continue using them effectively. Most legacy computers have enough power and speed to handle Web service tasks without any issues.

[close]

http://www.aprelium.com/abyssws/

[SiLæncer]

Changelog

*) Feature: the $upstream_bytes_sent variable.
Thanks to Piotr Sikora.
*) Feature: new directives in vim syntax highlighting scripts.
Thanks to Gena Makhomed.
*) Bugfix: in the "proxy_cache_background_update" directive.
*) Bugfix: in the "geo" directive when using unix domain listen sockets.
*) Workaround: the "ignoring stale global SSL error ... bad length" alerts might appear in logs when using the "ssl_early_data" directive with OpenSSL.
*) Bugfix: in nginx/Windows.
*) Bugfix: in the ngx_http_autoindex_module on 32-bit platforms.

[close]

http://nginx.org/

[SiLæncer]

Serva is an easy-to-use server package supporting a variety of protocols including Web, FTP, TFTP client/server, DHCP and Proxy DHCP (PXE Service), DNS, SNTP, BINL and SYSLOG. Focused on the quick deployment of a stable platform running as many server protocol engines as possible, the program doesn't aim compete on with other server tools in terms of speed or security.

Serva also allows you to setup a server which you can use to install Windows over a network without Microsoft's RIS/WDS/WAIK suites.

License: Free for personal use only

Changelog

170N - ALL Development migrated to MS VS 2017; Serva binaries run on Windows XP SP3 and up
160N - BINL Support for pxeserva.0/efi menus with more than 99 entries per level
158N - TFTP Client RFC 7440 GET_RQ and PUT_RQ support
157N - TFTP Server RFC 7440 PUT_RQ support
156N - TFTP Client Pick file dialog box
155N - TFTP Enforced Windowed mode replaced by RFC 7440
154N - TFTP Error simulation engine delay capabilities
153N - HTTP Autoindex Nginx style automatically offered to Curl and Wget HTTP clients
152F - HTTP Vulnerability (DoS) https://www.exploit-db.com/exploits/40905/
151F - TFTP Client malformed error messages
150F - TFTP Client not initialized under certain conditions
140F - FTP FTP Server Registered user root directory pick dialog box
139F - ALL MessageBox() center alignment

[close]

http://www.vercot.com/~serva/

[SiLæncer]

Changelog

  *) mod_ssl: Clear retry flag before aborting client-initiated renegotiation.
     PR 63052 [Joe Orton]

  *) mod_negotiation: Treat LanguagePriority as case-insensitive to match
     AddLanguage behavior and HTTP specification. PR 39730 [Christophe Jaillet]
 
  *) mod_md: incorrect behaviour when synchronizing ongoing ACME challenges
     have been fixed. [Michael Kaufmann, Stefan Eissing]
 
  *) mod_setenvif: We can have expressions that become true if a regex pattern
     in the expression does NOT match. In this case val is NULL
     and we should just set the value for the environment variable
     like in the pattern case. [Ruediger Pluem]

  *) mod_session: Always decode session attributes early. [Hank Ibell]

  *) core: Incorrect values for environment variables are substituted when
     multiple environment variables are specified in a directive. [Hank Ibell]

  *) mod_rewrite: Only create the global mutex used by "RewriteMap prg:" when
     this type of map is present in the configuration.  PR62311. 
     [Hank Ibell <hwibell gmail.com>]

  *) mod_dav: Fix invalid Location header when a resource is created by
     passing an absolute URI on the request line [Jim Jagielski]

  *) mod_session_cookie: avoid duplicate Set-Cookie header in the response.
     [Emmanuel Dreyfus <manu@netbsd.org>, Luca Toscano]

  *) mod_ssl: clear *SSL errors before loading certificates and checking
     afterwards. Otherwise errors are reported when other SSL using modules
     are in play. Fixes PR 62880. [Michael Kaufmann]

  *) mod_ssl: Fix the error code returned in an error path of
     'ssl_io_filter_handshake()'. This messes-up error handling performed
     in 'ssl_io_filter_error()' [Yann Ylavic]

  *) mod_ssl: Fix $HTTPS definition for "SSLEngine optional" case, and fix
     authz provider so "Require ssl" works correctly in HTTP/2.
     PR 61519, 62654.  [Joe Orton, Stefan Eissing]

  *) mod_proxy: If ProxyPassReverse is used for reverse mapping of relative
     redirects, subsequent ProxyPassReverse statements, whether they are
     relative or absolute, may fail.  PR 60408.  [Peter Haworth <pmh1wheel gmail.com>]
 
  *) mod_lua: Now marked as a stable module [https://s.apache.org/Xnh1]

[close]

http://httpd.apache.org/

[SiLæncer]

Changelog

[mod_cml,mod_flv_streaming] fix NULL ptr deref
[mod_simple_vhost] t/test_mod_simple_vhost
[mod_evhost] split uri handler func for testing
[mod_evhost] restructure for unit tests
[mod_evhost] t/test_mod_evhost
[mod_access] restructure for unit tests
[mod_access] t/test_mod_access
[tests] include first.h and NDEBUG early
[core] use kill_signal for gw_proc_kill()
[tests] t/test_keyvalue
[tests] some test config cleanup
[tests] update skip count in mod-fastcgi.t
[multiple] reduce initial buffer sz if large POST (fixes #2922)
[mod_fastcgi] fix NULL ptr deref from bugfix #2922 (fixes #2923)
[tests] more test config cleanup
[core] perf: incremental hash of pathname w/o copy
[core] perf: reuse buffer to redirect to directory
[core] do not free() reused buffer
[core] use connected sock port in dir redirect
[core] http_response_buffer_append_authority()
[core] use con→server_name for dir redir
[core] memeq compare rounded to 64, not next 1M
[core] define MD5_DIGEST_LENGTH 16
[mod_auth] permit additional auth backends to load
[core] send Connection: close if reqbody not read (fixes #2924)
[core] cache rev DNS for localhost for dir redir
[doc/conf] resolve some mime type conflicts from debian buster, regenerate mime.conf
[core] move winsock init to network_init()
[core] move /dev/stdin graceful restart handling
[core] network_srv_sockets_append() shared code
[core] systemd socket activation support
[build] autotools: try mysqlclient.pc and mariadb.pc (fixes #2925)
[mod_expire] look up expire fallback „“ explicitly
[multiple] calloc match ptr type (clang —analyze)
[multiple] quiet clang —analyze where trivial
[mod_webdav] compare COPY, MOVE Destination scheme
[core] con→uri.scheme is maintained lowercase
[mod_openssl] ALPN and acme-tls/1 (fixes #2931)
[core] Fix recursive include_shell invocations
[mod_openssl] ssl.privkey directive (optional)

[close]

http://www.lighttpd.net/

[SiLæncer]

Whats new:>>

Bugfix: Directory traversal when AllowDotFiles is enabled.

http://www.hiawatha-webserver.org/

[SiLæncer]

Changelog

Feature: variables support in the "ssl_certificate" and
"ssl_certificate_key" directives.
Feature: the "poll" method is now available on Windows when using
Windows Vista or newer.
Bugfix: if the "select" method was used on Windows and an error
occurred while establishing a backend connection, nginx waited for
the connection establishment timeout to expire.
Bugfix: the "proxy_upload_rate" and "proxy_download_rate" directives
in the stream module worked incorrectly when proxying UDP datagrams.

[close]

http://nginx.org/

[SiLæncer]

Whats new:>>

Change: when using a hostname in the "listen" directive nginx now creates listening sockets for all addresses the host name solves to (previously, only the first address was used).
Feature: port ranges in the "listen" directive.
Feature: loading of SSL certificates and secret keys from variables.
Workaround: the $ssl_server_name variable might be empty when using OpenSSL 1.1.1.
Bugfix: nginx/Windows could not be built with Visual Studio 2015 or newer; the bug had appeared in 1.15.9.

http://nginx.org/

[SiLæncer]

Changelog

FEATURE IMPROVEMENTS:

Update dictionary.cisco.
Update sqlippool to allow for stored procedures with PostgreSQL. This increases performance substantially Patch from Nathan Ward. Fixes #2540.
Re-added "show client config" command to radmin.
Cleaned up mods-available/sql example so that it is easier to understand.
Added pfSense dictionary. Closes #2581.
Update dictionary.h3c Closes #2592.
Update elasticsearch/logstash config for v6.7.0.
EAP-PWD security fixes from Mathy Vanhoef. See http://freeradius.org/security/.

BUG FIXES:

Update dynamic_client module and server core so that the functionality works. This has been broken since at least v2.
Fix crash in sqlippool due to escaping changes Patch from Nathan Ward. Fixes #2532, #2533.
Fix systemd notify, watchdog and unit files Fixes #2541, #2499.
Fix erroneous length check in EAP-FAST.
Update documentation to remove old "ignore_null" configuration. Fixes #2578.
Fix default POD port. Should be 3799. Fixes #2591.
Correctly encode vendor-specific "encrypted" attributes Fixes #2600.

[close]

http://freeradius.org/

[SiLæncer]

Whats new:>>

Bugfix: a segmentation fault might occur in a worker process if variables were used in the "ssl_certificate" or "ssl_certificate_key" directives and OCSP stapling was enabled.

http://nginx.org/

[SiLæncer]

Whats new:>>

nginx-1.16.0 stable version has been released, incorporating new features and bug fixes from the 1.15.x mainline branch - including UDP proxying improvements in the stream module, random load balancing method, support for TLS 1.3 early data, dynamic loading of SSL certificates, and more.

http://nginx.org/

[SiLæncer]

Changelog

    *) Feature: variables support in the "limit_rate" and "limit_rate_after"
       directives.

    *) Feature: variables support in the "proxy_upload_rate" and
       "proxy_download_rate" directives in the stream module.

    *) Change: minimum supported OpenSSL version is 0.9.8.

    *) Change: now the postpone filter is always built.

    *) Bugfix: the "include" directive did not work inside the "if" and
       "limit_except" blocks.

    *) Bugfix: in byte ranges processing.

[close]

http://nginx.org/

[SiLæncer]

Whats new:>>

behavior change: strict URL parsing and normalization (configurable)
performance enhancements, bug fixes

http://www.lighttpd.net/