Patch and revbump for security; bug 211230

Package-Manager: portage-2.1.4.4

diff --git a/www-servers/lighttpd/Manifest b/www-servers/lighttpd/Manifest
index 51ab7ed43be1c2366ad3daa1d9d414e7ffd2e3c5..9b53931bcc0d60d3c15e1253fa3cc71b0c137e00 100644 (file)
--- a/www-servers/lighttpd/Manifest
+++ b/www-servers/lighttpd/Manifest
@@ -1,5 +1,8 @@
 AUX 1.4.16/03_all_lighttpd-1.4.11-errorlog-pipe.diff 5267 RMD160 c23c816fcddbc99758a0426fc11f70677dbc06e9 SHA1 22e0d05d49cecb652d1250ac66de13fdf228cce4 SHA256 b37042549247ca2d83581aa3bcd1a5356c37015000711cecafda05aa6d6a15c4
 AUX 1.4.16/04_all_lighttpd-1.4.13-deprecated-ldap-api.diff 502 RMD160 a10372a6cdfce349c6221f5038f2fda699f5f74e SHA1 12c39cd4ca731509256e271daf4aaac8a62e82c4 SHA256 0a7f3626e23291b3859e953bcc1762117a1585c2717adc065ccbb0ccf2f3577a
+AUX 1.4.18-r1/03_all_lighttpd-1.4.11-errorlog-pipe.diff 5267 RMD160 c23c816fcddbc99758a0426fc11f70677dbc06e9 SHA1 22e0d05d49cecb652d1250ac66de13fdf228cce4 SHA256 b37042549247ca2d83581aa3bcd1a5356c37015000711cecafda05aa6d6a15c4
+AUX 1.4.18-r1/04_all_lighttpd-1.4.13-deprecated-ldap-api.diff 502 RMD160 a10372a6cdfce349c6221f5038f2fda699f5f74e SHA1 12c39cd4ca731509256e271daf4aaac8a62e82c4 SHA256 0a7f3626e23291b3859e953bcc1762117a1585c2717adc065ccbb0ccf2f3577a
+AUX 1.4.18-r1/05_all_lighttpd-fix-DoS.diff 1007 RMD160 dab1a6736c6c6002b3b177b84645bc6cf5a3eec2 SHA1 43d8e9a63cebd90f3696220ace9bb85f2d26db51 SHA256 62db49652888f7ce3d6bb97fd826a40055b6b00ddac9207081a93dd7aa501197
 AUX 1.4.18/03_all_lighttpd-1.4.11-errorlog-pipe.diff 5267 RMD160 c23c816fcddbc99758a0426fc11f70677dbc06e9 SHA1 22e0d05d49cecb652d1250ac66de13fdf228cce4 SHA256 b37042549247ca2d83581aa3bcd1a5356c37015000711cecafda05aa6d6a15c4
 AUX 1.4.18/04_all_lighttpd-1.4.13-deprecated-ldap-api.diff 502 RMD160 a10372a6cdfce349c6221f5038f2fda699f5f74e SHA1 12c39cd4ca731509256e271daf4aaac8a62e82c4 SHA256 0a7f3626e23291b3859e953bcc1762117a1585c2717adc065ccbb0ccf2f3577a
 AUX conf/lighttpd.conf 8182 RMD160 450cf40f4ec517331f8932618a3c492cb566e4f3 SHA1 16922786a79807fa3233d1af105a99582d3486a5 SHA256 c0f6951e00d4e8c928f1799a84976ab8bb536bd59a104c13ca9d1d3661d8cebd
@@ -16,6 +19,7 @@ AUX spawn-fcgi.initd 1398 RMD160 3fd0fa41d100629e85960034237abc0866ec3d38 SHA1 9
 DIST lighttpd-1.4.16.tar.bz2 592540 RMD160 185948bb05f5e667d604a5e9c6db4f0d64526ba4 SHA1 8f137ff71f629fe24a745c758b72dce24a8669f2 SHA256 568a6ce34d0a185b3164be99bce88011201957952f4ac817f7e7101bc526b59f
 DIST lighttpd-1.4.18.tar.bz2 600227 RMD160 9fcd5e09ee2b1b517868d8843883228cd8b4145f SHA1 a53a8f8ae8d42d036f0b5129764b822e943cc778 SHA256 d59123850f3dd4a10f067d9a0c527324a70203cd3f82f70f0e44b8cb8068db43
 EBUILD lighttpd-1.4.16.ebuild 5834 RMD160 7826a08df78c8b984f4a9b90717a33406c690bfe SHA1 ac288cf249eca1acdaab29e52d7f05a1f5b16c90 SHA256 febee4a940469873d46063f479bfe788af2f2556c587d78caa4a315c67521a29
+EBUILD lighttpd-1.4.18-r1.ebuild 5847 RMD160 63d0ec62cf7fc21780076241b00b1d8dca649abd SHA1 058e27948e56ca954796d826077b8f92cadf2b66 SHA256 3c8377198bf4fb8d30d48669e03c2f2b18f0c01cc8b1e073a08579c1fa6634d5
 EBUILD lighttpd-1.4.18.ebuild 5835 RMD160 fa429054db8803c73cf20dd216db57d20a43efc3 SHA1 7b2019a39a552e7bf7d3035462e572b0f90aa486 SHA256 2cb1bdd319a8c2c785fe6d71032cb800ffe0a1747af0ee0e2f652cd2cc05cee2
-MISC ChangeLog 36561 RMD160 ce14517e76232b4ff7f2d77825b2338cab543f4b SHA1 64f6e751fa36168a9db31cabc97db171877274de SHA256 ba45a9c97a8e4f12988f772c063b5e093a092081152c3071e8abd749681a8c59
+MISC ChangeLog 36879 RMD160 2b354a8f8bae6cc9a9becf38e0a57b1ad369c67d SHA1 df15e402ef38da6f20c86db40cf613d0cddec17f SHA256 a633d9b914cb8268bcf1231ae841f167133ed4847ac5c1b845c061164f33465f
 MISC metadata.xml 633 RMD160 f53110608c976ad01e089359eb60da7b8d1d8812 SHA1 f072b189d3973eb56e8bb059197ef2b1683d2790 SHA256 ec78010aee8ea37993d032389ba33c1a00488d0c658e4b25cf096556af8f962e

diff --git a/www-servers/lighttpd/files/1.4.18-r1/03_all_lighttpd-1.4.11-errorlog-pipe.diff b/www-servers/lighttpd/files/1.4.18-r1/03_all_lighttpd-1.4.11-errorlog-pipe.diff
new file mode 100644 (file)
index 0000000..c168eba
--- /dev/null
+++ b/www-servers/lighttpd/files/1.4.18-r1/03_all_lighttpd-1.4.11-errorlog-pipe.diff
@@ -0,0 +1,179 @@
+diff -ur lighttpd-1.4.11.orig/src/base.h lighttpd-1.4.11/src/base.h
+--- lighttpd-1.4.11.orig/src/base.h    2006-01-13 06:51:04.000000000 -0800
++++ lighttpd-1.4.11/src/base.h 2006-12-17 18:01:39.000000000 -0800
+@@ -505,7 +505,7 @@
+       
+       /* the errorlog */
+       int errorlog_fd;
+-      enum { ERRORLOG_STDERR, ERRORLOG_FILE, ERRORLOG_SYSLOG } errorlog_mode;
++      enum { ERRORLOG_STDERR, ERRORLOG_FILE, ERRORLOG_SYSLOG, ERRORLOG_PIPE } errorlog_mode;
+       buffer *errorlog_buf;
+       
+       fdevents *ev, *ev_ins;
+diff -ur lighttpd-1.4.11.orig/src/log.c lighttpd-1.4.11/src/log.c
+--- lighttpd-1.4.11.orig/src/log.c     2005-13-07 05:01:35.000000000 -0800
++++ lighttpd-1.4.11/src/log.c  2006-12-17 18:09:43.000000000 -0800
+@@ -34,10 +34,11 @@
+ /** 
+  * open the errorlog
+  * 
+- * we have 3 possibilities:
++ * we have 4 possibilities:
+  * - stderr (default)
+  * - syslog 
+  * - logfile
++ * - pipe
+  * 
+  * if the open failed, report to the user and die
+  * 
+@@ -57,21 +58,81 @@
+               srv->errorlog_mode = ERRORLOG_SYSLOG;
+       } else if (!buffer_is_empty(srv->srvconf.errorlog_file)) {
+               const char *logfile = srv->srvconf.errorlog_file->ptr;
+-              
+-              if (-1 == (srv->errorlog_fd = open(logfile, O_APPEND | O_WRONLY | O_CREAT | O_LARGEFILE, 0644))) {
+-                      log_error_write(srv, __FILE__, __LINE__, "SSSS", 
+-                                      "opening errorlog '", logfile,
+-                                      "' failed: ", strerror(errno));
+-                      
++
++              if (logfile[0] == '|') {
++#ifdef HAVE_FORK
++                      /* create write pipe and spawn process */
++
++                      int to_log_fds[2];
++                      pid_t pid;
++
++                      if (pipe(to_log_fds)) {
++                              log_error_write(srv, __FILE__, __LINE__, "ss",
++                              "pipe failed: ", strerror(errno));
++                              return -1;
++                      }
++
++                      /* fork, execve */
++                      switch (pid = fork()) {
++                      case 0:
++                              /* child */
++
++                              close(STDIN_FILENO);
++                              dup2(to_log_fds[0], STDIN_FILENO);
++                              close(to_log_fds[0]);
++                              /* not needed */
++                              close(to_log_fds[1]);
++
++                              /* we don't need the client socket */
++                              for (fd = 3; fd < 256; fd++) {
++                                      close(fd);
++                              }
++
++                              /* exec the log-process (skip the | )
++                               *
++                               */
++
++                              execl("/bin/sh", "sh", "-c", logfile + 1, NULL);
++                              
++                              log_error_write(srv, __FILE__, __LINE__, "sss",
++                                      "spawning log-process failed: ",
++                                      strerror(errno), logfile + 1);
++
++                              exit(-1);
++                              break;
++                      case -1:
++                              /* error */
++                              log_error_write(srv, __FILE__, __LINE__, "ss", "fork failed:", strerror(errno));
++                              break;
++                      default:
++                              close(to_log_fds[0]);
++
++                              srv->errorlog_fd = to_log_fds[1];
++
++                              break;
++                      }
++                      srv->errorlog_mode = ERRORLOG_PIPE;
++#else
++                      log_error_write(srv, __FILE__, __LINE__, "SSS",
++                              "opening errorlog '", logfile,"' impossible");
+                       return -1;
+-              }
++#endif
++              } else {
++                      if (-1 == (srv->errorlog_fd = open(logfile, O_APPEND | O_WRONLY | O_CREAT | O_LARGEFILE, 0644))) {
++                              log_error_write(srv, __FILE__, __LINE__, "SSSS",
++                                      "opening errorlog '", logfile,
++                                      "' failed: ", strerror(errno));
++  
++                              return -1;
++                      }
++                      srv->errorlog_mode = ERRORLOG_FILE;
++              }
+ #ifdef FD_CLOEXEC
+-              /* close fd on exec (cgi) */
+-              fcntl(srv->errorlog_fd, F_SETFD, FD_CLOEXEC);
++              /* close fd on exec (cgi) */
++              fcntl(srv->errorlog_fd, F_SETFD, FD_CLOEXEC);
+ #endif
+-              srv->errorlog_mode = ERRORLOG_FILE;
+-      }
+-      
++      }
++  
+       log_error_write(srv, __FILE__, __LINE__, "s", "server started");
+       
+ #ifdef HAVE_VALGRIND_VALGRIND_H
+@@ -99,7 +160,7 @@
+  */
+ 
+ int log_error_cycle(server *srv) {
+-      /* only cycle if we are not in syslog-mode */
++      /* only cycle if the error log is a file */
+       
+       if (srv->errorlog_mode == ERRORLOG_FILE) {
+               const char *logfile = srv->srvconf.errorlog_file->ptr;
+@@ -135,6 +196,7 @@
+       log_error_write(srv, __FILE__, __LINE__, "s", "server stopped");
+       
+       switch(srv->errorlog_mode) {
++      case ERRORLOG_PIPE: /* fall through */
+       case ERRORLOG_FILE:
+               close(srv->errorlog_fd);
+               break;
+@@ -154,6 +216,7 @@
+       va_list ap;
+       
+       switch(srv->errorlog_mode) {
++      case ERRORLOG_PIPE:
+       case ERRORLOG_FILE:
+       case ERRORLOG_STDERR:
+               /* cache the generated timestamp */
+@@ -238,6 +301,7 @@
+       va_end(ap);
+       
+       switch(srv->errorlog_mode) {
++      case ERRORLOG_PIPE: /* fall through */
+       case ERRORLOG_FILE:
+               BUFFER_APPEND_STRING_CONST(srv->errorlog_buf, "\n");
+               write(srv->errorlog_fd, srv->errorlog_buf->ptr, srv->errorlog_buf->used - 1);
+diff -ur lighttpd-1.4.11.orig/src/mod_cgi.c lighttpd-1.4.11/src/mod_cgi.c
+--- lighttpd-1.4.11.orig/src/mod_cgi.c 2006-02-22 05:15:10.000000000 -0800
++++ lighttpd-1.4.11/src/mod_cgi.c      2006-12-17 18:01:39.000000000 -0800
+@@ -750,7 +750,7 @@
+                *
+                * we feed the stderr of the CGI to our errorlog, if possible
+                */
+-              if (srv->errorlog_mode == ERRORLOG_FILE) {
++              if ((srv->errorlog_mode == ERRORLOG_FILE) || (srv->errorlog_mode == ERRORLOG_PIPE)) {
+                       close(STDERR_FILENO);
+                       dup2(srv->errorlog_fd, STDERR_FILENO);
+               }
+diff -ur lighttpd-1.4.11.orig/src/mod_rrdtool.c lighttpd-1.4.11/src/mod_rrdtool.c
+--- lighttpd-1.4.11.orig/src/mod_rrdtool.c     2005-08-21 15:52:24.000000000 -0700
++++ lighttpd-1.4.11/src/mod_rrdtool.c  2006-12-17 18:01:39.000000000 -0800
+@@ -134,7 +134,7 @@
+               
+               close(STDERR_FILENO);
+               
+-              if (srv->errorlog_mode == ERRORLOG_FILE) {
++              if ((srv->errorlog_mode == ERRORLOG_FILE) || (srv->errorlog_mode == ERRORLOG_PIPE)) {
+                       dup2(srv->errorlog_fd, STDERR_FILENO);
+                       close(srv->errorlog_fd);
+               }

diff --git a/www-servers/lighttpd/files/1.4.18-r1/04_all_lighttpd-1.4.13-deprecated-ldap-api.diff b/www-servers/lighttpd/files/1.4.18-r1/04_all_lighttpd-1.4.13-deprecated-ldap-api.diff
new file mode 100644 (file)
index 0000000..259ad4b
--- /dev/null
+++ b/www-servers/lighttpd/files/1.4.18-r1/04_all_lighttpd-1.4.13-deprecated-ldap-api.diff
@@ -0,0 +1,10 @@
+--- lighttpd-1.4.13.old/src/Makefile.am        2006-10-09 12:19:34.000000000 -0400
++++ lighttpd-1.4.13/src/Makefile.am    2007-03-26 10:10:26.000000000 -0400
+@@ -213,6 +213,7 @@
+ mod_auth_la_SOURCES = mod_auth.c http_auth_digest.c http_auth.c
+ mod_auth_la_LDFLAGS = -module -export-dynamic -avoid-version -no-undefined
+ mod_auth_la_LIBADD = $(CRYPT_LIB) $(LDAP_LIB) $(LBER_LIB) $(common_libadd)
++mod_auth_la_CFLAGS = -DLDAP_DEPRECATED
+ 
+ lib_LTLIBRARIES += mod_rewrite.la
+ mod_rewrite_la_SOURCES = mod_rewrite.c

diff --git a/www-servers/lighttpd/files/1.4.18-r1/05_all_lighttpd-fix-DoS.diff b/www-servers/lighttpd/files/1.4.18-r1/05_all_lighttpd-fix-DoS.diff
new file mode 100644 (file)
index 0000000..4f63be3
--- /dev/null
+++ b/www-servers/lighttpd/files/1.4.18-r1/05_all_lighttpd-fix-DoS.diff
@@ -0,0 +1,25 @@
+diff -ur lighttpd-1.4.18.orig/src/fdevent_solaris_devpoll.c lighttpd-1.4.18/src/fdevent_solaris_devpoll.c
+--- lighttpd-1.4.18.orig/src/fdevent_solaris_devpoll.c 2006-10-04 14:26:23.000000000 +0100
++++ lighttpd-1.4.18/src/fdevent_solaris_devpoll.c      2008-02-24 15:41:13.000000000 +0000
+@@ -67,7 +67,7 @@
+       int ret;
+ 
+       dopoll.dp_timeout = timeout_ms;
+-      dopoll.dp_nfds = ev->maxfds;
++      dopoll.dp_nfds = ev->maxfds - 1;
+       dopoll.dp_fds = ev->devpollfds;
+ 
+       ret = ioctl(ev->devpoll_fd, DP_POLL, &dopoll);
+diff -ur lighttpd-1.4.18.orig/src/server.c lighttpd-1.4.18/src/server.c
+--- lighttpd-1.4.18.orig/src/server.c  2007-09-05 11:39:56.000000000 +0100
++++ lighttpd-1.4.18/src/server.c       2008-02-24 15:40:38.000000000 +0000
+@@ -697,9 +697,6 @@
+                       }
+               }
+ 
+-              /* #372: solaris need some fds extra for devpoll */
+-              if (rlim.rlim_cur > 10) rlim.rlim_cur -= 10;
+-
+               if (srv->event_handler == FDEVENT_HANDLER_SELECT) {
+                       srv->max_fds = rlim.rlim_cur < FD_SETSIZE - 200 ? rlim.rlim_cur : FD_SETSIZE - 200;
+               } else {