Thema: Mini/Test/DHCP/Webserver und Tools diverses

[SiLæncer]

ApHeMo (Apache Health Monitoring) is a Health Monitoring analyzer for Apache HTTP Server. ApHeMo makes administrators able to improve security, reliability and to easily detect attacks from hackers (scans, potential backdoors).

Freemium

Whats new:>>

[Refactoring] Code signing certificate renewal (Kyle_Katarn)
[New Feature] Capacity to remove licence (Kyle_Katarn)
[Refactoring] Update ICS library to 8.65 and OpenSSL to 1.1.1i (Kyle_Katarn)
[Refactoring] Updated Dutch translation (Kyle_Katarn)
[Refactoring] Updated Spanish translation (Kyle_Katarn)

https://www.kcsoftwares.com/?aphemo

[SiLæncer]

Changelog

    Change: the default value of the "keepalive_requests" directive was
    changed to 1000.
    Feature: the "keepalive_time" directive.
    Feature: the $connection_time variable.
    Workaround: "gzip filter failed to use preallocated memory" alerts
    appeared in logs when using zlib-ng.

[close]

http://nginx.org/

[SiLæncer]

Release Notes

nginx-1.20.0 stable version has been released, incorporating new features and bug fixes from the 1.19.x mainline branch  — including OCSP validation of client SSL certificates, the ssl_reject_handshake and ssl_conf_command directives, simplified and improved handling of HTTP/2 connections with the lingering_close, keepalive_timeout, and keepalive_requests directives, the keepalive_time directive, stricter handling of upstream server responses, cookie flags handling, cache clearing based on the minimum amount of free space, PROXY protocol support from clients and to backend servers in the mail proxy, proxying SMTP authentication, the set directive in the stream module, and more.

[close]

http://nginx.org/

[SiLæncer]

Release Notes

    Security: 1-byte memory overwrite might occur during DNS server response processing if the "resolver" directive was used, allowing an attacker who is able to forge UDP packets from the DNS server to cause worker process crash or, potentially, arbitrary code execution (CVE-2021-23017.
    Feature: variables support in the "proxy_ssl_certificate", "proxy_ssl_certificate_key" "grpc_ssl_certificate", "grpc_ssl_certificate_key", "uwsgi_ssl_certificate", and "uwsgi_ssl_certificate_key" directives.
    Feature: the "max_errors" directive in the mail proxy module.
    Feature: the mail proxy module supports POP3 and IMAP pipelining.
    Feature: the "fastopen" parameter of the "listen" directive in the stream module. Thanks to Anbang Wen.
    Bugfix: special characters were not escaped during automatic redirect with appended trailing slash.
    Bugfix: connections with clients in the mail proxy module might be closed unexpectedly when using SMTP pipelining.

[close]

http://nginx.org/

[SiLæncer]

Changelog

    Change: now nginx always returns an error for the CONNECT method.
    Change: now nginx always returns an error if both "Content-Length" and "Transfer-Encoding" header lines are present in the request.
    Change: now nginx always returns an error if spaces or control characters are used in the request line.
    Change: now nginx always returns an error if spaces or control characters are used in a header name.
    Change: now nginx always returns an error if spaces or control characters are used in the "Host" request header line.
    Change: optimization of configuration testing when using many listening sockets.
    Bugfix: nginx did not escape """, "<", ">", "", "^", "`", "{", "|", and "}" characters when proxying with changed URI.
    Bugfix: SSL variables might be empty when used in logs; the bug had appeared in 1.19.5.
    Bugfix: keepalive connections with gRPC backends might not be closed after receiving a GOAWAY frame.
    Bugfix: reduced memory consumption for long-lived requests when proxying with more than 64 buffers.

[close]

http://nginx.org/

[SiLæncer]

Changelog

    Change: now nginx rejects HTTP/1.0 requests with the "Transfer-Encoding" header line.
    Change: export ciphers are no longer supported.
    Feature: OpenSSL 3.0 compatibility.
    Feature: the "Auth-SSL-Protocol" and "Auth-SSL-Cipher" header lines are now passed to the mail proxy authentication server. Thanks to Rob Mueller.
    Feature: request body filters API now permits buffering of the data being processed.
    Bugfix: backend SSL connections in the stream module might hang after an SSL handshake.
    Bugfix: the security level, which is available in OpenSSL 1.1.0 or newer, did not affect loading of the server certificates when set with "@SECLEVEL=N" in the "ssl_ciphers" directive.
    Bugfix: SSL connections with gRPC backends might hang if select, poll, or /dev/poll methods were used.
    Bugfix: when using HTTP/2 client request body was always written to disk if the "Content-Length" header line was not present in the request.

[close]

http://nginx.org/

[SiLæncer]

Changelog

    Change: optimization of client request body reading when using
    HTTP/2.
    *) Bugfix: in request body filters internal API when using HTTP/2 and
    Buffering of the data being processed.

[close]

http://nginx.org/

[SiLæncer]

Changelog

Important changes

    improve performance, reduce memory use, bugfixes

Highlights

    HTTP/2 smoother and lower memory use (in general)
    HTTP/2 tuning to better handle aggressive client initial requests
    reduce memory footprint; workaround poor glibc behavior; jemalloc is better
    mod_magnet lua performance improvements
    mod_dirlisting performance improvements and new caching option
    memory constraints for extreme edge cases in mod_dirlisting, mod_ssi, mod_webdav
    connect(), write(), read() time limits on backends (separate from client timeouts)
    lighttpd restarts if large discontinuity in time occurs (embedded systems)
    RFC7233 Range support for all non-streaming responses, not only static files

[close]

http://www.lighttpd.net/

[SiLæncer]

Whats new:>>

    [Refactoring] Update ICS library to 8.66 and OpenSSL to 1.1.1k (Kyle_Katarn)
    [Refactoring] Updated Turkish translation (Kyle_Katarn)
    [Refactoring] Updated Slovenian translation (Kyle_Katarn)
    [Bug] Windows 11 is identified as a Windows 10 (Kyle_Katarn)

https://www.kcsoftwares.com/?aphemo

[SiLæncer]

Changelog

    [core] define __BEGIN_DECLS, __END_DECLS if needed
    [core] Y2038: error log high-precision timestamps
    [multiple] attribute_nonnull now takes params
    [core] bounds check while url-decoding
    [mod_magnet] prefer lua_newuserdatauv() w/ lua 5.4
    [core] earlier macOS need define for errno_t (fixes #3107)
    [tests] force POSIX::WNOHANG
    [mod_dirlisting] sort ?../? to top (fixes #3109)
    [tests] force Fcntl::F_SETFD() autovivification (#3110)
    [core] avoid repeated typedef for fdlog_st
    [doc] update INSTALL
    [mod_extforward] keep remote IP thru request reset
    [core] fix HTTP/2 upload > 64k w/ max-request-size (fixes #3108)
    [mod_auth] fix Basic auth passwd cache (fixes #3112)
    [mod_ajp13,mod_fastcgi] comment: no response body
    [mod_webdav] ignore PROPFIND Depth for files
    [core] add comment to ck_memeq_const_time()
    [core] accept up to 5 digit port num in host cond
    [core] expose chunkqueue_remove_empty_chunks()
    [core] short-circuit if response body recv w/ hdrs (fixes #3111)
    [core] resched HTTP/2 streams w/ pending data (#3111)
    [core] separate func for gw_authorizer_ok()
    [core] make ck_memeq_const_time() more generic (#3112)
    [mod_auth] revert adjustment to auth passwd cache (#3112)
    [core] thwart h2c smuggling when Upgrade enabled
    [core] separate funcs to check for valid chars
    [core] thwart h2 request tunnelling
    [core] clear shared log buffer after writes
    [mod_nss] quiet trace for PR_END_OF_FILE_ERROR
    [core] allow debug.log-state-handling in condition
    [core] combine more dup header processing code
    [mod_ajp13,mod_fastcgi] check resp w/ content len
    [mod_proxy] Length Req if proxy forcing HTTP/1.0
    [core] restart dead proc on connect error if local
    [mod_ajp13,mod_fastcgi] recv_parse smaller funcs
    [multiple] warn deprecated mods slated for removal
    [core] remove redundant checks in same context
    [core] tighten chunkqueue_steal* code; better asm
    [build] check for preadv(), pwritev()
    [core] pwritev w/ chunkqueue_steal_with_tempfiles
    [core] tighten chunkqueue_mark_written; better asm
    [doc] uncomment mod_auth load in conf.d/auth.conf
    [core] tighten chunkqueue_small_resp_optim()
    [core] chunkqueue_small_resp_optim if resp < 16k
    [mod_auth] clear crypt() output if len >= 13
    [multiple] add assert after malloc in two spots
    [core] add HTTP/2 check resp finished w/ empty cq (#3111)
    [core] chunkqueue_small_resp_optim() comment

[close]

http://www.lighttpd.net/

[SiLæncer]

Changelog

Change:

Support for NPN instead of ALPN to establish HTTP/2 connections has been removed.
Now nginx rejects SSL connections if ALPN is used by the client, but no supported protocols can be negotiated.
The default value of the "sendfile_max_chunk" directive was changed to 2 megabytes.

Feature:

The "proxy_half_close" directive in the stream module.
The "ssl_alpn" directive in the stream module.
The $ssl_alpn_protocol variable.
Support for SSL_sendfile() when using OpenSSL 3.0.
The "mp4_start_key_frame" directive in thengx_http_mp4_module.

Bugfix:

In the $content_length variable when using chunked transfer encoding.
After receiving a response with incorrect length from a
Proxied backend nginx might nevertheless cache the connection.invalid headers from backends were logged at the "info" level instead of "error"; the bug had appeared in 1.21.1.
Requests might hang when using HTTP/2 and the "aio_write" directive.

[close]

http://nginx.org/

[SiLæncer]

Changelog

    [mod_alias] fix use-after-free bug (fixes #3114)
    [core] clean up fdlog_st and log_error_st decls
    [core] ‘struct log_error_st’ ? ‘log_error_st’
    [core] remove redundant asserts
    [core] explicitly include sys/cdefs.h
    [tests] t/test_mod_ssi
    [core] fdevent_socket_nb_cloexec_init()
    [core] fdevent_impl.c separate from fdevent.c
    [core] merge fdevent impls into fdevent_impl.c
    [core] fdevent_fdnode.c separate from fdevent.c
    [core] close backend socket fds more quickly
    [core] use TCP_CORK w/ TLS if cq length > 16k
    [core] warn if dynamic modules before mod_auth
    [mod_cgi] check fd-to-cgi not -1 before close
    [core] libev EV_ERROR conflicts with kqueue
    [tests] disable test_mod_ssi in cmake (temporary)
    [tests] disable test_mod_ssi in cmake (temporary)
    [tests] reenable test_mod_ssi in cmake
    [core] run plugin cleanup hooks in reverse
    [core] fix removal of server.pid-file when testing (fixes #3115)
    [doc] improve sample configs
    [doc] expand vhosts.template
    [doc] improve sample configs
    [core] use ck_assert() in vector.[ch]
    [tests] mod_ssi tests moved to src/t/test_mod_ssi
    [mod_ssi] 0-init ssi_val_t in ssi_ctx_t
    [mod_ssi] fix ancient bugs; replace cond parser
    [mod_ssi] remove mod_ssi parser generator file
    [mod_ssi] merge mod_ssi_expr.c into mod_ssi.c
    [core] uint_fast32_t tweaks
    [core] better asm for binary num to ascii string
    [tests] t/test_mod now runs all t/test_mod_*.c
    [tests] t/test_mod_alias.c
    [tests] remove unused mod from tests/lighttpd.conf
    [mod_evasive] smaller funcs for testing
    [tests] t/test_mod_evasive.c
    [mod_evasive] update comment to add references
    [tests] combine tests into test_common.c
    [core] get_http_method_key() tweak
    [mod_dirlisting] check for disabled cache at start
    [core] buffer_append_string_encoded_json()
    [mod_dirlisting] (experimental) json (disabled)
    [tests] t/test_mod needs -ldl on Debian
    [core] save config regex captures only if used
    [core] save pcre result state in config_pcre_match
    [core] use stack w/ pcre_exec unless save captures
    [core] extend pcre_keyvalue_ctx to pass more state
    [core] pcre2 support (—with-pcre2)
    [core] allocate one fewer cond_match_t, if needed
    [core] allocate pcre output vector on demand
    [build] configure.ac with AC_PROG_CC_C99 (fixes #3116)
    [build] CI builds now use pcre2 (upgrade pcre)
    [core] fix compiler warning in 32-bit build
    [build] fix CMake pcre2 detection
    [mod_auth] RFC7616 HTTP Digest username* userhash
    [mod_dirlisting] fix bug not showing HEADER.txt
    [tests] t/test_mod_ssi adjust to follow symlinks
    [mod_auth] quiet coverity warning
    [doc] refresh/update dependency lists in doc
    [core] fix crash when using lighttpd -1 with pipes (fixes #3117)

[close]

http://www.lighttpd.net/

[SiLæncer]

Whats new:>>

    [core] import xxHash v0.8.1
    [core] isolate use of sys/filio.h
    [core] fix reqpool mem corruption in 1.4.62

http://www.lighttpd.net/

[SiLæncer]

Changelog

    Change: now nginx is built with the PCRE2 library by default.
    Change: now nginx always uses sendfile(SF_NODISKIO) on FreeBSD.
    Feature: support for sendfile(SF_NOCACHE) on FreeBSD.
    Feature: the $ssl_curve variable.
    Bugfix: connections might hang when using HTTP/2 without SSL with the "sendfile" and "aio" directives.

[close]

http://nginx.org/

[SiLæncer]

Serva is an easy-to-use server package supporting a variety of protocols including Web, FTP, TFTP client/server, DHCP and Proxy DHCP (PXE Service), DNS, SNTP, BINL and SYSLOG. Focused on the quick deployment of a stable platform running as many server protocol engines as possible, the program doesn't aim compete on with other server tools in terms of speed or security.

Serva also allows you to setup a server which you can use to install Windows over a network without Microsoft's RIS/WDS/WAIK suites.

License: Free for personal use only

Whats new:>>

TFTP Vulnerability (DoS) https://nvd.nist.gov/vuln/detail/CVE-2021-44429

http://www.vercot.com/~serva/