[arch-commits] Commit in lighttpd/repos (3 files)

Pierre Schmitz pierre at archlinux.org
Tue Feb 2 05:06:04 UTC 2010


    Date: Tuesday, February 2, 2010 @ 00:06:03
  Author: pierre
Revision: 66922

Merged revisions 66920 via svnmerge from 
svn+ssh://gerolde.archlinux.org/srv/svn-packages/lighttpd/trunk

........
  r66920 | pierre | 2010-02-02 06:04:02 +0100 (Di, 02 Feb 2010) | 2 lines
  
  upgpkg: lighttpd 1.4.25-2
      fix CVE-2010-0295
........

Added:
  lighttpd/repos/extra-x86_64/fix_slow_request_dos.patch
    (from rev 66920, lighttpd/trunk/fix_slow_request_dos.patch)
Modified:
  lighttpd/repos/extra-x86_64/	(properties)
  lighttpd/repos/extra-x86_64/PKGBUILD

----------------------------+
 PKGBUILD                   |   11 +-
 fix_slow_request_dos.patch |  223 +++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 231 insertions(+), 3 deletions(-)


Property changes on: lighttpd/repos/extra-x86_64
___________________________________________________________________
Modified: svnmerge-integrated
   - /lighttpd/trunk:1-59366
   + /lighttpd/trunk:1-66921

Modified: extra-x86_64/PKGBUILD
===================================================================
--- extra-x86_64/PKGBUILD	2010-02-02 05:04:48 UTC (rev 66921)
+++ extra-x86_64/PKGBUILD	2010-02-02 05:06:03 UTC (rev 66922)
@@ -3,7 +3,7 @@
 
 pkgname=lighttpd
 pkgver=1.4.25
-pkgrel=1
+pkgrel=2
 pkgdesc='a secure, fast, compliant and very flexible web-server'
 license=('custom')
 arch=('i686' 'x86_64')
@@ -17,14 +17,19 @@
 backup=('etc/lighttpd/lighttpd.conf' 'etc/logrotate.d/lighttpd')
 options=('!libtool' 'emptydirs')
 source=("http://download.lighttpd.net/lighttpd/releases-1.4.x/lighttpd-${pkgver}.tar.bz2"
-        'lighttpd.rc.d' 'lighttpd.logrotate.d')
+        'lighttpd.rc.d' 'lighttpd.logrotate.d'
+        'fix_slow_request_dos.patch')
 md5sums=('2027c49fb46530e45338c5e2da13c02f'
          '789ed1b4521e72e591e09d5dfb99235a'
-         '857e174643fd7761a2f0d8431a679f6c')
+         '857e174643fd7761a2f0d8431a679f6c'
+         '3643f60ff8805ee249050df25f10eda7')
 
 build() {
 	cd $srcdir/$pkgname-$pkgver
 
+	# see http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2010_01.txt
+	patch -p1 -i ${srcdir}/fix_slow_request_dos.patch || return 1
+
 	./configure --prefix=/usr \
 		--libexecdir=/usr/lib/lighttpd/modules \
 		--sysconfdir=/etc/lighttpd \

Copied: lighttpd/repos/extra-x86_64/fix_slow_request_dos.patch (from rev 66920, lighttpd/trunk/fix_slow_request_dos.patch)
===================================================================
--- extra-x86_64/fix_slow_request_dos.patch	                        (rev 0)
+++ extra-x86_64/fix_slow_request_dos.patch	2010-02-02 05:06:03 UTC (rev 66922)
@@ -0,0 +1,223 @@
+Author: Stefan Bühler <stbuehler at web.de>
+Date:   Wed Jan 6 17:07:19 2010 +0100
+
+    Append to previous buffer in con read (fixes #2147, found by liming, CVE-2010-0295)
+    
+     * Remove ssl_error_want_reuse_buffer for SSL_read:
+       Although the manual states we have to use the same arguments in the
+       next call after SSL_ERROR_WANT_*, it has been running without this
+       in 1.5 for a long time now.
+     * As POST-data chunks get copied to the next queue, we reuse chunks
+       there as well.
+
+diff --git a/src/base.h b/src/base.h
+index d14c090..4243bd2 100644
+--- a/src/base.h
++++ b/src/base.h
+@@ -431,7 +431,6 @@ typedef struct {
+ 
+ #ifdef USE_OPENSSL
+ 	SSL *ssl;
+-	buffer *ssl_error_want_reuse_buffer;
+ # ifndef OPENSSL_NO_TLSEXT
+ 	buffer *tlsext_server_name;
+ # endif
+diff --git a/src/chunk.c b/src/chunk.c
+index 0cc26da..7583db6 100644
+--- a/src/chunk.c
++++ b/src/chunk.c
+@@ -197,8 +197,6 @@ int chunkqueue_append_buffer(chunkqueue *cq, buffer *mem) {
+ int chunkqueue_append_buffer_weak(chunkqueue *cq, buffer *mem) {
+ 	chunk *c;
+ 
+-	if (mem->used == 0) return 0;
+-
+ 	c = chunkqueue_get_unused_chunk(cq);
+ 	c->type = MEM_CHUNK;
+ 	c->offset = 0;
+diff --git a/src/connections.c b/src/connections.c
+index 58843e7..c499664 100644
+--- a/src/connections.c
++++ b/src/connections.c
+@@ -192,40 +192,42 @@ static void dump_packet(const unsigned char *data, size_t len) {
+ 
+ static int connection_handle_read_ssl(server *srv, connection *con) {
+ #ifdef USE_OPENSSL
+-	int r, ssl_err, len, count = 0;
++	int r, ssl_err, len, count = 0, read_offset, toread;
+ 	buffer *b = NULL;
+ 
+ 	if (!con->conf.is_ssl) return -1;
+ 
+-	/* don't resize the buffer if we were in SSL_ERROR_WANT_* */
+-
+ 	ERR_clear_error();
+ 	do {
+-		if (!con->ssl_error_want_reuse_buffer) {
+-			b = buffer_init();
+-			buffer_prepare_copy(b, SSL_pending(con->ssl) + (16 * 1024)); /* the pending bytes + 16kb */
++		if (NULL != con->read_queue->last) {
++			b = con->read_queue->last->mem;
++		}
++
++		if (NULL == b || b->size - b->used < 1024) {
++			b = chunkqueue_get_append_buffer(con->read_queue);
++			len = SSL_pending(con->ssl);
++			if (len < 4*1024) len = 4*1024; /* always alloc >= 4k buffer */
++			buffer_prepare_copy(b, len + 1);
+ 
+ 			/* overwrite everything with 0 */
+ 			memset(b->ptr, 0, b->size);
+-		} else {
+-			b = con->ssl_error_want_reuse_buffer;
+ 		}
+ 
+-		len = SSL_read(con->ssl, b->ptr, b->size - 1);
+-		con->ssl_error_want_reuse_buffer = NULL; /* reuse it only once */
++		read_offset = (b->used > 0) ? b->used - 1 : 0;
++		toread = b->size - 1 - read_offset;
++
++		len = SSL_read(con->ssl, b->ptr + read_offset, toread);
+ 
+ 		if (len > 0) {
+-			b->used = len;
++			if (b->used > 0) b->used--;
++			b->used += len;
+ 			b->ptr[b->used++] = '\0';
+ 
+-		       	/* we move the buffer to the chunk-queue, no need to free it */
++			con->bytes_read += len;
+ 
+-			chunkqueue_append_buffer_weak(con->read_queue, b);
+ 			count += len;
+-			con->bytes_read += len;
+-			b = NULL;
+ 		}
+-	} while (len > 0 && count < MAX_READ_LIMIT);
++	} while (len == toread && count < MAX_READ_LIMIT);
+ 
+ 
+ 	if (len < 0) {
+@@ -234,11 +236,11 @@ static int connection_handle_read_ssl(server *srv, connection *con) {
+ 		case SSL_ERROR_WANT_READ:
+ 		case SSL_ERROR_WANT_WRITE:
+ 			con->is_readable = 0;
+-			con->ssl_error_want_reuse_buffer = b;
+ 
+-			b = NULL;
++			/* the manual says we have to call SSL_read with the same arguments next time.
++			 * we ignore this restriction; no one has complained about it in 1.5 yet, so it probably works anyway.
++			 */
+ 
+-			/* we have to steal the buffer from the queue-queue */
+ 			return 0;
+ 		case SSL_ERROR_SYSCALL:
+ 			/**
+@@ -297,16 +299,11 @@ static int connection_handle_read_ssl(server *srv, connection *con) {
+ 
+ 		connection_set_state(srv, con, CON_STATE_ERROR);
+ 
+-		buffer_free(b);
+-
+ 		return -1;
+ 	} else if (len == 0) {
+ 		con->is_readable = 0;
+ 		/* the other end close the connection -> KEEP-ALIVE */
+ 
+-		/* pipelining */
+-		buffer_free(b);
+-
+ 		return -2;
+ 	}
+ 
+@@ -321,26 +318,41 @@ static int connection_handle_read_ssl(server *srv, connection *con) {
+ static int connection_handle_read(server *srv, connection *con) {
+ 	int len;
+ 	buffer *b;
+-	int toread;
++	int toread, read_offset;
+ 
+ 	if (con->conf.is_ssl) {
+ 		return connection_handle_read_ssl(srv, con);
+ 	}
+ 
++	b = (NULL != con->read_queue->last) ? con->read_queue->last->mem : NULL;
++
++	/* default size for chunks is 4kb; only use bigger chunks if FIONREAD tells
++	 *  us more than 4kb is available
++	 * if FIONREAD doesn't signal a big chunk we fill the previous buffer
++	 *  if it has >= 1kb free
++	 */
+ #if defined(__WIN32)
+-	b = chunkqueue_get_append_buffer(con->read_queue);
+-	buffer_prepare_copy(b, 4 * 1024);
+-	len = recv(con->fd, b->ptr, b->size - 1, 0);
+-#else
+-	if (ioctl(con->fd, FIONREAD, &toread) || toread == 0) {
++	if (NULL == b || b->size - b->used < 1024) {
+ 		b = chunkqueue_get_append_buffer(con->read_queue);
+ 		buffer_prepare_copy(b, 4 * 1024);
++	}
++
++	read_offset = (b->used == 0) ? 0 : b->used - 1;
++	len = recv(con->fd, b->ptr + read_offset, b->size - 1 - read_offset, 0);
++#else
++	if (ioctl(con->fd, FIONREAD, &toread) || toread == 0 || toread <= 4*1024) {
++		if (NULL == b || b->size - b->used < 1024) {
++			b = chunkqueue_get_append_buffer(con->read_queue);
++			buffer_prepare_copy(b, 4 * 1024);
++		}
+ 	} else {
+ 		if (toread > MAX_READ_LIMIT) toread = MAX_READ_LIMIT;
+ 		b = chunkqueue_get_append_buffer(con->read_queue);
+ 		buffer_prepare_copy(b, toread + 1);
+ 	}
+-	len = read(con->fd, b->ptr, b->size - 1);
++
++	read_offset = (b->used == 0) ? 0 : b->used - 1;
++	len = read(con->fd, b->ptr + read_offset, b->size - 1 - read_offset);
+ #endif
+ 
+ 	if (len < 0) {
+@@ -374,7 +386,8 @@ static int connection_handle_read(server *srv, connection *con) {
+ 		con->is_readable = 0;
+ 	}
+ 
+-	b->used = len;
++	if (b->used > 0) b->used--;
++	b->used += len;
+ 	b->ptr[b->used++] = '\0';
+ 
+ 	con->bytes_read += len;
+@@ -850,13 +863,6 @@ int connection_reset(server *srv, connection *con) {
+ 	/* The cond_cache gets reset in response.c */
+ 	/* config_cond_cache_reset(srv, con); */
+ 
+-#ifdef USE_OPENSSL
+-	if (con->ssl_error_want_reuse_buffer) {
+-		buffer_free(con->ssl_error_want_reuse_buffer);
+-		con->ssl_error_want_reuse_buffer = NULL;
+-	}
+-#endif
+-
+ 	con->header_len = 0;
+ 	con->in_error_handler = 0;
+ 
+@@ -1128,8 +1134,15 @@ found_header_end:
+ 			} else {
+ 				buffer *b;
+ 
+-				b = chunkqueue_get_append_buffer(dst_cq);
+-				buffer_copy_string_len(b, c->mem->ptr + c->offset, toRead);
++				if (dst_cq->last &&
++				    dst_cq->last->type == MEM_CHUNK) {
++					b = dst_cq->last->mem;
++				} else {
++					b = chunkqueue_get_append_buffer(dst_cq);
++					/* prepare buffer size for remaining POST data; is < 64kb */
++					buffer_prepare_copy(b, con->request.content_length - dst_cq->bytes_in + 1);
++				}
++				buffer_append_string_len(b, c->mem->ptr + c->offset, toRead);
+ 			}
+ 
+ 			c->offset += toRead;




More information about the arch-commits mailing list