lighty labs

2026-05-11

GS 04:53 Lighttpd Bug #3308: Unbounded file descriptor accumulation in stat_cache_entry->fd under concurrent small-file serving causes EMFILE

> Regarding #7: Our understanding (please correct if wrong) is that the ~1300 FDs per stream results from HTTP/2 stream pipelining outpacing TCP drain. Each connection has 8 streams, but we believe streams complete their HTTP response (h... gstrauss

SV 04:31 Lighttpd Bug #3308: Unbounded file descriptor accumulation in stat_cache_entry->fd under concurrent small-file serving causes EMFILE

Tested the patch from #9 with our workload (5 HTTP/2 clients, 206K small files, stat-cache-engine=disable, server.max-fds=16384).
Results:
- With our production max-fds=16384, lighttpd hits the FD limit and crashes (process exits), c... svanka

2026-05-10

GS 08:13 Lighttpd Bug #3308: Unbounded file descriptor accumulation in stat_cache_entry->fd under concurrent small-file serving causes EMFILE

I think that this patch should mitigate your issue, without using @server.max-workers@, though that would help, too. gstrauss

2026-05-09

GS 05:41 Lighttpd Bug #3308: Unbounded file descriptor accumulation in stat_cache_entry->fd under concurrent small-file serving causes EMFILE

Instead of the patch you posted above, please try this: gstrauss

GS 04:23 Lighttpd Feature #3304: Host selection for sockproxy via SNI

Thank you for testing and confirming. I also tested with and without TLS, with and without TLS SNI, and with HTTP/1.1 and HTTP/2. Things also appear to do the right thing with a lighttpd.conf match like @if $HTTP["host"] == "foo" { soc... gstrauss

2026-05-08

UL 21:51 Lighttpd Feature #3304: Host selection for sockproxy via SNI

gstrauss wrote in #note-11:
> I pushed a new patch here: https://git.lighttpd.net/lighttpd/lighttpd1.4/commit/6104d5155b4e4a071c09503507171bf2c24740ef
I tested the patch and it works fine as far as I can see.
*Thanks a lot! I real... ultimator

GS 08:22 Lighttpd Feature #3304 (Patch Pending): Host selection for sockproxy via SNI

I pushed a new patch here: https://git.lighttpd.net/lighttpd/lighttpd1.4/commit/6104d5155b4e4a071c09503507171bf2c24740ef gstrauss

GS 17:51 Lighttpd Bug #3308: Unbounded file descriptor accumulation in stat_cache_entry->fd under concurrent small-file serving causes EMFILE

> max-connections (#1, #2): With HTTP/2, our 5 clients maintain 5 TCP connections total. server.max-connections does not bound file FD accumulation — we never approach any connection limit. Your model (connections × streams = bounded FDs... gstrauss

GS 16:14 Lighttpd Bug #3308: Unbounded file descriptor accumulation in stat_cache_entry->fd under concurrent small-file serving causes EMFILE

Thank you for adding more details about your use case. I'll look further. gstrauss

SV 08:28 Lighttpd Bug #3308: Unbounded file descriptor accumulation in stat_cache_entry->fd under concurrent small-file serving causes EMFILE

Environment: 5 HTTP/2 clients (one connection each, 5 streams), serving ~206K small files (50-500 bytes, ostree repo objects). Production target: 100+ clients. lighttpd runs as www-data.
OS limits (#4): Confirmed not the issue. /proc/$... svanka

GS 07:53 Lighttpd Bug #3308: Unbounded file descriptor accumulation in stat_cache_entry->fd under concurrent small-file serving causes EMFILE

I should note two additional things:
@server.stat-cache-engine = "disable"@ should disable the stat cache from holding open fds for a caching period when there are not active connections sendings responses using those files. The "dis... gstrauss

GS 07:35 Lighttpd Bug #3308: Unbounded file descriptor accumulation in stat_cache_entry->fd under concurrent small-file serving causes EMFILE

From #3307:
> We configure server.max-fds = 65535 and server.max-connections appropriately. With 5 legitimate clients pulling ~206,000 small static files, lighttpd opens files via stat_cache_get_entry_open() faster than it retires chunks... gstrauss

GS 07:30 Lighttpd Bug #3308: Unbounded file descriptor accumulation in stat_cache_entry->fd under concurrent small-file serving causes EMFILE

1000 HTTP/2 connections each with 8 active streams could have 8000 open file descriptors along with the 1000 sockets to the clients. With the stat cache disabled, that is 9000 open file descriptors (plus a few for lighttpd logs and such... gstrauss

GS 07:21 Lighttpd Bug #3308 (Need Feedback): Unbounded file descriptor accumulation in stat_cache_entry->fd under concurrent small-file serving causes EMFILE

> Under sufficient concurrency, opens always outpace closes, and FDs grow until EMFILE.
As in #3307, configure lighttpd better to your use case.
> ...
If you have a humongous number of resources and this is a problem for you, then disa... gstrauss

SV 06:35 Lighttpd Bug #3308 (Need Feedback): Unbounded file descriptor accumulation in stat_cache_entry->fd under concurrent small-file serving causes EMFILE

lighttpd 1.4.79 holds file descriptors open in stat_cache_entry->fd with reference counting (introduced as a TOC-TOU symlink security mitigation). Under high
concurrency serving many small static files, FDs accumulate unboundedly becaus... svanka

SV 07:21 Lighttpd Bug #3307: http_response_send_file() returns HTTP 403 instead of 503 when open() fails with EMFILE

Thanks for the response. I understand the position on 403 being valid per RFC.
The issue is that in our case, EMFILE is not caused by misconfiguration or attack. It's caused by lighttpd itself accumulating file descriptors internally ... svanka

GS 07:05 Lighttpd Bug #3307 (Invalid): http_response_send_file() returns HTTP 403 instead of 503 when open() fails with EMFILE

> When lighttpd exhausts available file descriptors,
The short answer is: don't do that. Instead, treat running out of file descriptors as either a configuration error or an attack.
If considered an attack, 403 Forbidden is fine.
If ... gstrauss

SV 06:24 Lighttpd Bug #3307 (Invalid): http_response_send_file() returns HTTP 403 instead of 503 when open() fails with EMFILE

When lighttpd exhausts available file descriptors, open() in the static file serving path returns -1 with errno=EMFILE. The error handling in http_response_send_file() does not distinguish EMFILE from permission errors, and falls through... svanka

2026-05-06

GS 19:46 Lighttpd Feature #3304: Host selection for sockproxy via SNI

Thanks for testing. It appears that the detection of TLS Client Hello is not working as I intended. mod_sockproxy is independent of TLS modules, so I need to find a way to detect that the TLS negotiation has completed without mod_sockp... gstrauss

UL 19:13 Lighttpd Feature #3304: Host selection for sockproxy via SNI

ultimator wrote in #note-8:
> gstrauss wrote in #note-7:
> ...
The patch does not work. After the TLS handshake, the server does not pass the request to the backend.
I basically use a config like this for testing: ultimator

UL 18:14 Lighttpd Feature #3304: Host selection for sockproxy via SNI

gstrauss wrote in #note-7:
> > The default backend host can be different, right?
> ...
I will test it and report back. ultimator