The release of the lightweight http server lighttpd 1.4.74 has been published, aiming to combine high performance, security, standard compliance, and configuration flexibility. Lighttpd is suitable for use in high-load systems and is focused on low memory and CPU resource consumption. The project's code is written in C and is distributed under the BSD license.
In the new version:
- The behavior of data logging using syslog has been changed (enabled by the parameter 'server.errorlog-use-syslog = ‘enable'') — previously, all messages were sent only with the priority LOG_ERROR, and now the priority is chosen depending on the type of message (LOG_WARNING, LOG_DEBUG).
- In systems with the Musl C library, the sendfile() call is supported.
- An option 'dir-listing.sort' has been added to the mod_dirlisting module to determine the sort order of output.
- In mod_deflate, the setting 'deflate.allowed-encodings' is enabled, and the bzip2 algorithm has been assigned the lowest selection priority.
- Support for the 'if', 'elif', 'elsif', 'elseif', and 'else if' operators has been added to the configuration file.
- mod_openssl and mod_gnutls now include a check for support of TLS implementation at the Linux kernel level (kTLS).
- Compatibility with the DragonflyBSD operating system has been ensured.
The next release is planned to introduce several changes that break compatibility. A more secure set of ciphers for TLS will be enabled by default, providing session compromise protection in case of interception of long-term keys (forward secrecy) and using authenticated encryption (AEAD). The set 'EECDH+AESGCM:AES256+EECDH:CHACHA20:!SHA1:!SHA256:!SHA384' is planned to be replaced with 'EECDH+AESGCM:CHACHA20:!PSK:!DHE'.
The second future compatibility change will be a modification in mod_redirect, which applies to HTTP/1.1 redirection codes, changing it from 301 (Moved Permanently) to 308 (Permanent Redirect), unless the 'url.redirect-code' parameter is explicitly set. In 2025, TLSv1.3 is planned to be enabled by default (the MinProtocol parameter will be changed to TLSv1.3).
Source: opennet.ru
