[mod_compress] remove mod_compress

[mod_deflate] Brotli support

configuration option: ./configure --with-brotli

[mod_authn_dbi] authn backend employing DBI

[mod_nss] NSS option for TLS (fixes #1218)

(experimental)

WARNING: EXPERIMENTAL code sketch; mod_nss is INCOMPLETE and UNTESTED

mod_nss supports most ssl.* config options supported by mod_openssl

[mod_nss] NSS option for TLS (fixes #1218)

(experimental)

WARNING: EXPERIMENTAL code sketch; mod_nss is INCOMPLETE and UNTESTED

mod_nss supports most ssl.* config options supported by mod_openssl

x-ref:
"alternate ssl backend"
https://redmine.lighttpd.net/issues/1218

show more ...

[mod_gnutls] GnuTLS option for TLS (fixes #109)

(experimental)

mod_gnutls supports most ssl.* config options supported by mod_openssl

x-ref:
"GnuTLS support for the mod_ssl"
https://redmine.li

[mod_gnutls] GnuTLS option for TLS (fixes #109)

(experimental)

mod_gnutls supports most ssl.* config options supported by mod_openssl

x-ref:
"GnuTLS support for the mod_ssl"
https://redmine.lighttpd.net/issues/109

show more ...

[mod_mbedtls] mbedTLS option for TLS

(experimental)

mod_mbedtls supports most ssl.* config options supported by mod_openssl

thx Ward Willats for the initial discussion and attempt in the comments

[mod_mbedtls] mbedTLS option for TLS

(experimental)

mod_mbedtls supports most ssl.* config options supported by mod_openssl

thx Ward Willats for the initial discussion and attempt in the comments
https://redmine.lighttpd.net/boards/3/topics/7029

show more ...

[core] isolate data_config.c, vector.c

isolate data_config.c, vector.c to lighttpd executable, not modules

[core] prefer uint32_t to size_t in base.h

even 2 billion is way larger than even extreme operating values
expected for the members in base.h

include some structs directly in struct server, rather

[core] prefer uint32_t to size_t in base.h

even 2 billion is way larger than even extreme operating values
expected for the members in base.h

include some structs directly in struct server, rather than by ptr

show more ...

[mod_maxminddb] MaxMind GeoIP2 support

[scons] adjustment for static build under CentOS

x-ref:
"Trying to compile under CentOS 6.10"
https://redmine.lighttpd.net/boards/2/topics/8572

[mod_auth] HTTP Auth Digest algorithm=SHA-256

(also support Digest algorithm=SHA-512-256 if library support present)

enable additional algorithms by configuring lighttpd.conf auth.require
with new

[mod_auth] HTTP Auth Digest algorithm=SHA-256

(also support Digest algorithm=SHA-512-256 if library support present)

enable additional algorithms by configuring lighttpd.conf auth.require
with new optional keyword "algorithm" => "MD5|SHA-256"

default algorithm remains MD5 if "algorithm" not specified

Tested with: curl --digest -u "user:pass" ... (which supports SHA-256)

x-ref:
"HTTP Digest Access Authentication"
https://tools.ietf.org/html/rfc7616

show more ...

[build] SCons support for wolfSSL

[build] put request.c in common src

put request.c in common src for CMake, SCons, and meson builds
(request.c is already in common source list in Makefile.am)

[core] inline status_counter routines

[mod_sockproxy] add to build

(experimental)

[mod_authn_pam] mod_auth PAM support (fixes #688)

x-ref:
"auth via pam"
https://redmine.lighttpd.net/issues/688

[core] abstraction layer for HTTP header manip

http_header.[ch]
convert existing calls to manip request/response headers
convert existing calls to manip environment array (often header-related)

[core] server.http-parseopts URL normalization opt (fixes #1720)

server.http-parseopts = ( ... ) URL normalization options

Note: *not applied* to CONNECT method

Note: In a future release, URL norm

[core] server.http-parseopts URL normalization opt (fixes #1720)

server.http-parseopts = ( ... ) URL normalization options

Note: *not applied* to CONNECT method

Note: In a future release, URL normalization likely enabled by default
(normalize URL, reject control chars, remove . and .. path segments)
To prepare for this change, lighttpd.conf configurations should
explicitly select desired behavior by enabling or disabling:
server.http-parseopts = ( "url-normalize" => "enable", ... )
server.http-parseopts = ( "url-normalize" => "disable" )

x-ref:
"lighttpd ... compares URIs to patterns in the (1) url.redirect and (2) url.rewrite configuration settings before performing URL decoding, which might allow remote attackers to bypass intended access restrictions, and obtain sensitive information or possibly modify data."
https://www.cvedetails.com/cve/CVE-2008-4359/
"Rewrite/redirect rules and URL encoding"
https://redmine.lighttpd.net/issues/1720

show more ...

[core] remove proc_open.[ch], reduce stdio.h use

[core] http_kv.[ch] method, status, version str

move method, status, version strings from keyvalue.[ch] to http_kv.[ch]

[scons] fix various python2/3 incompatibilities

[mod_authn_sasl] SASL auth (new) (fixes #2275)

(experimental)

HTTP Basic authentication using saslauthd

server.modules += ( "mod_auth" )
server.modules += ( "mod_authn_sasl" )
auth.backend = "sasl

[mod_authn_sasl] SASL auth (new) (fixes #2275)

(experimental)

HTTP Basic authentication using saslauthd

server.modules += ( "mod_auth" )
server.modules += ( "mod_authn_sasl" )
auth.backend = "sasl"
auth.backend.sasl.opts = ( "pwcheck_method" => "saslauthd" ) # default

x-ref:
"SASL auth like libapache2-mod-authn-sasl"
https://redmine.lighttpd.net/issues/2275

show more ...

[core] consolidate backend network write handlers

network_write.[ch] isolates various write, writev, sendfile wrappers

[core] isolate sock_addr manipulation

[scons] don't screw env[LIBS]

- copy() when collecting dependencies for static module linking
- copy() when following operations append to it and we don't reset it to
an empty list
- use autoadd =

[scons] don't screw env[LIBS]

- copy() when collecting dependencies for static module linking
- copy() when following operations append to it and we don't reset it to
an empty list
- use autoadd = 0 for many functions to prevent modifying env[LIBS] in
the first place
- append to env[LIBS] manually to make it explicit (fam and rt)

show more ...