Bump bozohttpd version to today for mobile-friendly directory listing

add some missing changes and bump the version.

branches: 1.54.2;
fix various typos in comments and messages.

bozohttpd: remove obsolete .bzdirect handling

OK mrg@

fix typos in comments, mainly s/extention/extension/ and s/sufficent/sufficient/

extend the list of available ciphers to include most of the
openssl "HIGH" with some additional disables. retain the current
list of bad options. should deal with PR#51278.

implement tls minimum version setting.

mostly from sunil@nimmagadda.net in PR#55830, though i moved the
member into the main http structure, so that it doesn't trigger
sslinfo being allocated via command line without the rest of the
ssl being setup (which then leads to crashes.)

don't assume host BUFSIZ is sufficent. small BUFSIZ leads to
always happens errors in the testsuite. switch all these buffers
to be 4KiB sized. reported by embr <git@liclac.eu>

avoid DoS in initial request size, which is now bounded at 16KiB.
reported by Justin Parrott in PR#56085.

changes in bozohttpd 20210227:
o new support for content types: .tar.bz2, .tar.xz, .tar.lz,
.tar.zst, .tbz2, .txz, .tlz, .zipx, .xz, .zst, .sz, .lz, .lzma,
.lzo, .7z, .lzo, .cab, .dmg, .jar, and .rar. should fix
netbsd PR#56026:
MIME type of .tar.xz file on ny{cdn,ftp}.NetBSD.org is invalid

belated call version 20210211 after previous memory leak fix.

changes in bozohttpd 20210210:
o fix various NULL derefs from malformed headers. mostly from
<emily@ingalls.rocks>.

various updates from <henrik@gulbra.net> / freebsd. the list from Henrik:

bozohttpd.8:
o Added -d flag to the man page
o Moved -E flag in man page to keep alphabetic order
o Grammar fix for description of -E flag in man page
o Moved a word in the man description for the -f flag
o Made -f imply -b as a backwards-compatible shortcut
o Updated man description of -n to mention Lua scripts
o Moved -z below -Z to keep the uppercase options first

bozohttpd.c:
o Removed obsolete comment about ~user missing cgi-bin support
o Removed "/* ARGSUSED */" lines; was that a macro or a reminder?
o Added USE_ARG macro call for sig, which was otherwise not used
o Added USE_ARG macro call for msg (only used if debug is enabled)

bozohttpd.h:
o Fixed typo in the include guard (BOZOHTTOPD_H_ -> BOZOHTTPD_H_)
o Renamed have_all to have_core; it didn't mean "all" options

content-bozo.c:
o Added USE_ARG macro call for signo, which was otherwise not used
o Made -f imply -b as a backwards-compatible shortcut

main.c:
o Simplified -b text to be symmetric with that for the -f option
o Updated -C text to make "suffix" explicit; it's better than "arg"
o Changed to only show the -E description if have_user is true
o Always show the -e option, which incorrectly used the -E logic
o Renamed have_all to have_core; it didn't mean "all" options
o Added three missing tabs for the description of the -G option
o Updated -L text to make "prefix" explicit; it's better than "arg"
o Updated -M text to make "suffix" explicit; it's slightly better
o Added a previously missing description for the -n option
o Documented the otherwise obscure valid types for the -T option
o Shortened "username" to "user" to match the actual help text
o Moved handling of -c below that for -C to standardize the order
o Broke the enabling test for -C into two lines for consistency
o Inverted the enabling test for -E; this is what was meant, right?
o Removed the enabling test for -e, which should always be enabled

ssl-bozo.c:
o Added USE_ARG for httpd, which is not used if SSL has been excluded

set -D_GNU_SOURCE in Makefile.boot. from hadrien.lacour@posteo.net.
also match %2F as well as %2f. from leah@vuxu.org.
introduce defines for "80" and "443". copyright maint.

bozohttpd: add .m4a and .m4v file extensions.

update for recent changes.

branches: 1.40.2;
call this bozohttpd 20190228, and merge the CHANGES entries from the
previous release.

fix duplicated chunk from merge

Merge the [pgoyette-compat] branch

o don't display special files in the directory index. they aren't
served, but links to them are generated.

- call this 20190116
- adjust the directory indexing again:
- don't include "index.html" in html headers
- additional escaping of names
- re-add top/bottom borders
- adds an aquamarine table header
- Zebra-stripes table rows using CSS instead of code
all from "Rajeev V. Pillai" <rajeev_v_pillai@yahoo.com>

- fix CGI '+' param and error handling.
- remove unused parameter to daemon_poll_err().

both from "Rajeev V. Pillai" <rajeev_v_pillai@yahoo.com>

minor rewording. fix alphabeta ordering of contributors.

fix an old spell-o and a new format-o.

Document last changes and bump version to 20181215

Suggested by <mrg>, thanks! (Possible mistakes are mine though!)

use html tables for directory index.
from "Rajeev V. Pillai" <rajeev_v_pillai@yahoo.com>

call this bozohttpd 20181204.

normalise some messages.

add option fixes here.

- move special files defines into bozohttpd.h, so we can ...
- consolidate all the special file checks into
bozo_check_special_files() so that all builds check the same
list of special files, regardless of build options.
- convert "(void)bozo_http_error(...); return -1;" into plain
"return bozo_http_error(...);"
- fix the call to bozo_check_special_files() to be used on all
input types. part of the fixes for failure to reject access
to /.htpasswd as reported by JP on tech-security.
- use warn_unused_result attribute on bozo_check_special_files(),
and fix the failures to return failure. second part of the
htpasswd access fix.
- update testsuite to use a fixed fake hostname.

call this bozohttpd 20181121.

from CHANGES:

o reduce default timeouts, and add expand timeouts to handle the
initial line, each header, and the total time spent
o add -T option to expose new timeout settings
o minor RFC fixes related to timeout handling responses

old timeouts:
60 seconds for initial request like, 60 seconds per header line,
and no whole timeout (though the recent total header size changes
do introduce one that would be about 11 hours.)
new timeouts:
30 seconds for initial request like, 10 seconds per header line,
and a total request time of 600 seconds.


the new global timeout is implemented using CLOCK_MONOTONIC, with
a fallback to CLOCK_REALTIME if monotonic time is unavailable.


reject multiple Host: headers. besides being protocol standard,
this closes one additional memory leak found by JP. add a simple
test to check this.


clean up option and usage handling some.

note the changes present in bozohttpd 20181118:

o add url remap support via .bzremap file, from martin@netbsd.org
o handle redirections for any protocol, not just http:
o fix a denial of service attack against header contents, which
is now bounded at 16KiB. reported by JP.

branches: 1.25.4; 1.25.10; 1.25.12;
- fix a bug in cgi processing. from Dennis Lindroos.
- add a testcase for this, and expand test-simple to handle additional
args to bozohttpd for eg, cgi-bin setting.
- fix objdir bugs in the testsuite.

branches: 1.24.2;
use netbsd rcsid

branches: 1.23.2;
As proposed in:

http://mail-index.netbsd.org/tech-userlevel/2016/05/18/msg009999.html

and

https://www.netbsd.org/~agc/bozo-20160517.diff

add a patch to httpd to return the version string of httpd itself, and use the
-G option on the command line to enable this. This gives httpd the ability to
show, from the command line, what version is running.

% /usr/build/obj/x86_64/usr/src/libexec/httpd/bozohttpd -G
bozohttpd version bozohttpd/20160415
%

updates and bozohttpd 20160415:
o add search-word support for CGI
o fix a security issue in CGI suffix handler support which would
allow remote code execution, from shm@netbsd.org
o -C option supports now CGI scripts only

* add CGI support for ~user translation (-E switch)
* add redirects to ~user translation
* fix bugs around ~user translation
* add schema detection for absolute redirects
* fixed few memory leaks
* bunch of minor tweaks
* removed -r support
* smarter redirects

OK mrg@

copyright maintenance, note shm@ in the manual and update the CHANGES
for recent changes. call this 20150320.

branches: 1.19.2;
call this 20140717.

call this bozohttpd 20140708, and add/fix a couple of CHANGES entries.

avoid truncating a directory path when using snprintf(), but instead
detect and return an error.

found and fixed by shm@netbsd.

bump version, note .svg support.

branches: 1.15.2;
update for 2014-02-01.

- update CHANGES with recent changes
- update version to 20140102
- update copyrights
- use getcwd() over getwd()
- fix lean build (don't include lua)

- update CHANGES with recent changes
- export esacpe_html() and use it in directory indexing
- update manual to include recent contributors

branches: 1.12.2;
when generating URIs escape various characters as specified in RFC 3986.
this makes, among other things, files/dirs with "?" work with dir indexing.

branches: 1.11.2; 1.11.6; 1.11.8;
merge bozohttpd 20111118

branches: 1.10.6;
merge bozohttpd 20100920

merge bozohttpd 20100621

merge bozohttpd 20100617.

merge bozohttpd 20100512

merge bozohttpd 20100509.

merge bozohttpd 20090522

merge bozohttpd 20090418. remove a couple of minor do-nothing local
changes that don't need to cause conflicts.

re-add a lot of the distribution files

branches: 1.2.10; 1.2.12; 1.2.16; 1.2.20;
Get httpd ready for inclusion in build.

branches: 1.1.1;
Initial revision

openssl: Stop dragging libpthread into every libcrypto user.

With the new _NETBSD_PTHREAD_CREATE_WEAK, libcrypto can have a call
to pthread_create without linking against libpthread, so it is not
necessary to link all libcrypto users against libpthread too.

Applications that link against libcrypto but not libpthread can't use
threaded OpenSSL functionality, of course -- OSSL_set_max_threads
will always fail in such applications.

This reverts all the makefile churn that I found for unnecessary
libpthread linkage since the openssl 3.5 import.

PR lib/59685: libcrypto should not depend on libpthread

branches: 1.36.2;
crypto needs pthread

jemalloc, httpd: remove now-unnecessary LINTFLAGS

all: remove 'constant in conditional context' from LINTFLAGS

Lint no longer emits this message, as it produced too many false
positives.

libexec/httpd: fix or suppress lint warnings

No binary change.

branches: 1.32.2;
accommodate OpenSSL-3.x

branches: 1.31.6;
avoid warnings from the previous when using objdirs.

give BOZOVER a default so exporting a distfile is easy.

Add blocklistd(8) support.

branches: 1.28.2;
add 'check' target to toplevel makefile.

fix the t11.out output now that CGI parsing works better.

branches: 1.27.2; 1.27.8; 1.27.10;
Remove MKCRYPTO option.

Originally, MKCRYPTO was introduced because the United States
classified cryptography as a munition and restricted its export. The
export controls were substantially relaxed fifteen years ago, and are
essentially irrelevant for software with published source code.

In the intervening time, nobody bothered to remove the option after
its motivation -- the US export restriction -- was eliminated. I'm
not aware of any other operating system that has a similar option; I
expect it is mainly out of apathy for churn that we still have it.
Today, cryptography is an essential part of modern computing -- you
can't use the internet responsibly without cryptography.

The position of the TNF board of directors is that TNF makes no
representation that MKCRYPTO=no satisfies any country's cryptography
regulations.

My personal position is that the availability of cryptography is a
basic human right; that any local laws restricting it to a privileged
few are fundamentally immoral; and that it is wrong for developers to
spend effort crippling cryptography to work around such laws.

As proposed on tech-crypto, tech-security, and tech-userlevel to no
objections:

https://mail-index.netbsd.org/tech-crypto/2017/05/06/msg000719.html
https://mail-index.netbsd.org/tech-security/2017/05/06/msg000928.html
https://mail-index.netbsd.org/tech-userlevel/2017/05/06/msg010547.html

P.S. Reviewing all the uses of MKCRYPTO in src revealed a lot of
*bad* crypto that was conditional on it, e.g. DES in telnet... That
should probably be removed too, but on the grounds that it is bad,
not on the grounds that it is (nominally) crypto.

- don't use alloca and then check if alloca returns null and then try to
free it. Allocating from the stack does not return null, and freeing it
will have unpredictable results. use malloc instead.
- now we are using malloc remove -Wno-stack-protector kludge

Fix build with "USE_SSP" set to "yes".

on QNX, use nbutil.h.

install as bozohttpd/bozohttpd.8 as well as httpd.

branches: 1.22.2;
make export-distfile target slightly more stable.

branches: 1.21.2;
display the tempdir for exported files as well.

call gzip directly for distfile export target; it's usually run outside
of the normal build.

Pass the -n flag to gzip invocations.

This prevents it from embedding a timestamp in the output. We pass
"-n" unconditionally, not conditional on MKREPRO, because many other
invocations of gzip already passed the -n flag unconditionally.

Use ${TOOL_GZIP} instead of just gzip in all Makefiles
outside */dist/* subdirectories.

When USE_PIGZGZIP=yes, bsd.own.mk sets TOOL_GZIP=${TOOL_PIGZ},
so there's no need to test USE_PIGZGZIP in these Makefiles.

Also depend on LIBLUA, and add -lm to allow static linking.

add Lua scripting support to bozohttpd, see httpd(8) for details

remove trailing whitespace

add a target to export a bozohttpd distfile.

merge parts of the release Makefile back in; unused by the netbsd build.

branches: 1.12.6; 1.12.8; 1.12.12; 1.12.14; 1.12.20;
merge bozohttpd 20100920

merge bozohttpd 20100509.

fix a merge botch in previous

merge bozohttpd 20090522

Default to WARNS=4
Exceptions that need a lower level are:
getty ld.elf_so lfs_cleanerd makewhatis telnetd tftpd
hpropd ipropd-master ipropd-slave kadmind kpasswdd

branches: 1.7.4; 1.7.6; 1.7.8; 1.7.14;
warns=4

branches: 1.6.2;
use BUILDSYMLINKS to not have to rename bozohttpd.8 while still
having this manual installed as httpd.8. now updates from my
repo to bozohttpd.8 will appear in this file.

branches: 1.5.2;
support MKCRYPTO=no:
- don't link -lssl -lcrypto
- -DNO_SSL_SUPPORT

branches: 1.4.2;
A build for sun2 reveals that we also need -lcrypt, as auth-bozo.c
otherwise gets an unsatisfied reference to crypt().

Fix typo on Makefile which causes HTTP Authentication support
to not be used.

Now fix auth-bozo.c to not have warnings "may be used uninitialized"
and pointer targets "differ in signedness".

Get httpd ready for inclusion in build.

branches: 1.1.1;
Initial revision

also set -D_DEFAULT_SOURCE to open up more headers.
allow passing $(EXTRALIBS).

Do not report status code 500 to blocklistd(8) Add -DNO_BLOCKLIST_SUPPORT
to Makefile.boot.

set -D_GNU_SOURCE, needed for linux systems and should be
harmless or ignored elsewhere.

from perry.

branches: 1.6.18; 1.6.26; 1.6.28;
update for 20140102.

branches: 1.5.6; 1.5.8; 1.5.12; 1.5.14; 1.5.20;
merge bozohttpd 20100510.

merge bozohttpd 20100509.

re-add a lot of the distribution files

branches: 1.2.10; 1.2.12; 1.2.16; 1.2.20;
Get httpd ready for inclusion in build.

branches: 1.1.1;
Initial revision

Fix hr_authrealm memory leak

hr_authrealm might be already set, so we need to free it before overwriting
the value

branches: 1.27.6;
don't assume host BUFSIZ is sufficent. small BUFSIZ leads to
always happens errors in the testsuite. switch all these buffers
to be 4KiB sized. reported by embr <git@liclac.eu>

set -D_GNU_SOURCE in Makefile.boot. from hadrien.lacour@posteo.net.
also match %2F as well as %2f. from leah@vuxu.org.
introduce defines for "80" and "443". copyright maint.

Add blocklistd(8) support.

branches: 1.24.2;
add ssl specific timeout value (30s). if SSL_accept() doesn't
work with in this timeout value, ssl setup now fails.

mostly different from, but inspired from the patch in PR 50655

o don't display special files in the directory index. they aren't
served, but links to them are generated.

many clean ups:
- keep a list of special files and their human names
- remove (void) casts on bozo_http_error()
- fix a few more misuses of bozo_http_error()
- rename check_mapping() to check_remap() and perform some CSE
- switch away from ``%s'' to '%s'
- remove a bunch of #ifdef using new have_feature defines

- move special files defines into bozohttpd.h, so we can ...
- consolidate all the special file checks into
bozo_check_special_files() so that all builds check the same
list of special files, regardless of build options.
- convert "(void)bozo_http_error(...); return -1;" into plain
"return bozo_http_error(...);"
- fix the call to bozo_check_special_files() to be used on all
input types. part of the fixes for failure to reject access
to /.htpasswd as reported by JP on tech-security.
- use warn_unused_result attribute on bozo_check_special_files(),
and fix the failures to return failure. second part of the
htpasswd access fix.
- update testsuite to use a fixed fake hostname.

call this bozohttpd 20181121.

from CHANGES:

o reduce default timeouts, and add expand timeouts to handle the
initial line, each header, and the total time spent
o add -T option to expose new timeout settings
o minor RFC fixes related to timeout handling responses

old timeouts:
60 seconds for initial request like, 60 seconds per header line,
and no whole timeout (though the recent total header size changes
do introduce one that would be about 11 hours.)
new timeouts:
30 seconds for initial request like, 10 seconds per header line,
and a total request time of 600 seconds.


the new global timeout is implemented using CLOCK_MONOTONIC, with
a fallback to CLOCK_REALTIME if monotonic time is unavailable.


reject multiple Host: headers. besides being protocol standard,
this closes one additional memory leak found by JP. add a simple
test to check this.


clean up option and usage handling some.

avoid memory leak in sending multiple auth headers.
mostly mitigated by previous patch to limit total header size,
but still a real problem here.

branches: 1.18.8; 1.18.14; 1.18.16;
several clean ups:

- bozostrdup() gains a request parameter, and uses it to determine
what sort of error handling is required
- bozo_strdup() dies
- size_arrays() reduced slightly, pushing error handling into the caller
- convert to size_t for some array indices
- bozo_set_pref() and bozo_init_prefs() gain httpd parameters
- apply a bunch of manual CSE to vastly reduce the number of times the
string "request->hr_httpd" appears.
- CGI parse_header() takes a request not httpd now

XXX: lua glue updated to call bozo_init_prefs() with htttpd parameter,
but i'm only guessing here.

* add CGI support for ~user translation (-E switch)
* add redirects to ~user translation
* fix bugs around ~user translation
* add schema detection for absolute redirects
* fixed few memory leaks
* bunch of minor tweaks
* removed -r support
* smarter redirects

OK mrg@

more for the previous: make sure [i - 1] can never go negative.

properly handle ilen = 0 case, which could lead to array underflow.
pointed out by Maxime Villard.

Fixed memory leak in case of multiple authentication headers sent by the
client.

OK mrg@

branches: 1.13.2;
avoid truncating a directory path when using snprintf(), but instead
detect and return an error.

found and fixed by shm@netbsd.

branches: 1.12.2;
- update CHANGES with recent changes
- update version to 20140102
- update copyrights
- use getcwd() over getwd()
- fix lean build (don't include lua)

no need to check free() arguments against NULL

branches: 1.10.2; 1.10.6; 1.10.8; 1.10.14;
merge bozohttpd 20111118

branches: 1.9.6;
merge bozohttpd 20100510.

merge bozohttpd 20100509.

merge bozohttpd 20090418. remove a couple of minor do-nothing local
changes that don't need to cause conflicts.

return a value when the function wants to.

merge bozohttpd 20090417

branches: 1.4.6; 1.4.8; 1.4.10; 1.4.16;
merge bozohttpd 20080303

branches: 1.3.2; 1.3.6;
RCS IDs

Fix typo on Makefile which causes HTTP Authentication support
to not be used.

Now fix auth-bozo.c to not have warnings "may be used uninitialized"
and pointer targets "differ in signedness".

branches: 1.1.1;
Initial revision

drop duplicate "by default".

bozohttpd(8): clarifications and editorial fixes

Clarify that -b also listens on an address and port
(overridden by -i address and/or -I port), as does -f.
If -i isn't given, all addresses are listened to.

Use literal instead of emphasis for Lua, paths, URLs (etc).

Add more cross-references to other options.

Split FILES into a tagged list and subsections describing
the behaviour.

man: fix month name

branches: 1.97.2;
Bump bozohttpd version to today for mobile-friendly directory listing

note this documents bozohttpd 20240126.

s/supressing/suppressing/.

add some missing changes and bump the version.

add a note about how to setup http -> https redirection.

bump documented version.

branches: 1.92.2;
Document the -q option.

call this bozohttpd 20220517.

bozohttpd: remove obsolete .bzdirect handling

OK mrg@

implement tls minimum version setting.

mostly from sunil@nimmagadda.net in PR#55830, though i moved the
member into the main http structure, so that it doesn't trigger
sslinfo being allocated via command line without the rest of the
ssl being setup (which then leads to crashes.)

update version, dates, add emily to list of contributors. sort list.

New sentence, new line. Fix xref.

various updates from <henrik@gulbra.net> / freebsd. the list from Henrik:

bozohttpd.8:
o Added -d flag to the man page
o Moved -E flag in man page to keep alphabetic order
o Grammar fix for description of -E flag in man page
o Moved a word in the man description for the -f flag
o Made -f imply -b as a backwards-compatible shortcut
o Updated man description of -n to mention Lua scripts
o Moved -z below -Z to keep the uppercase options first

bozohttpd.c:
o Removed obsolete comment about ~user missing cgi-bin support
o Removed "/* ARGSUSED */" lines; was that a macro or a reminder?
o Added USE_ARG macro call for sig, which was otherwise not used
o Added USE_ARG macro call for msg (only used if debug is enabled)

bozohttpd.h:
o Fixed typo in the include guard (BOZOHTTOPD_H_ -> BOZOHTTPD_H_)
o Renamed have_all to have_core; it didn't mean "all" options

content-bozo.c:
o Added USE_ARG macro call for signo, which was otherwise not used
o Made -f imply -b as a backwards-compatible shortcut

main.c:
o Simplified -b text to be symmetric with that for the -f option
o Updated -C text to make "suffix" explicit; it's better than "arg"
o Changed to only show the -E description if have_user is true
o Always show the -e option, which incorrectly used the -E logic
o Renamed have_all to have_core; it didn't mean "all" options
o Added three missing tabs for the description of the -G option
o Updated -L text to make "prefix" explicit; it's better than "arg"
o Updated -M text to make "suffix" explicit; it's slightly better
o Added a previously missing description for the -n option
o Documented the otherwise obscure valid types for the -T option
o Shortened "username" to "user" to match the actual help text
o Moved handling of -c below that for -C to standardize the order
o Broke the enabling test for -C into two lines for consistency
o Inverted the enabling test for -E; this is what was meant, right?
o Removed the enabling test for -e, which should always be enabled

ssl-bozo.c:
o Added USE_ARG for httpd, which is not used if SSL has been excluded

set -D_GNU_SOURCE in Makefile.boot. from hadrien.lacour@posteo.net.
also match %2F as well as %2f. from leah@vuxu.org.
introduce defines for "80" and "443". copyright maint.

update for recent changes.

Use Nx.

Do not report status code 500 to blocklistd(8) Add -DNO_BLOCKLIST_SUPPORT
to Makefile.boot.

Add blocklistd(8) support.

Add -R flag to specify a README file to add at the bottom of directory
autoindex listings.

branches: 1.79.2;
add ssl specific timeout value (30s). if SSL_accept() doesn't
work with in this timeout value, ssl setup now fails.

mostly different from, but inspired from the patch in PR 50655

- call this 20190116
- adjust the directory indexing again:
- don't include "index.html" in html headers
- additional escaping of names
- re-add top/bottom borders
- adds an aquamarine table header
- Zebra-stripes table rows using CSS instead of code
all from "Rajeev V. Pillai" <rajeev_v_pillai@yahoo.com>

remove reference to deleted -r option. fixes PR#53840 from J. Lewis Muir.

minor rewording. fix alphabeta ordering of contributors.

use html tables for directory index.
from "Rajeev V. Pillai" <rajeev_v_pillai@yahoo.com>

call this bozohttpd 20181204.

minor style fixes. simplify bozo_match_content_map().

from CHANGES:

o reduce default timeouts, and add expand timeouts to handle the
initial line, each header, and the total time spent
o add -T option to expose new timeout settings
o minor RFC fixes related to timeout handling responses

old timeouts:
60 seconds for initial request like, 60 seconds per header line,
and no whole timeout (though the recent total header size changes
do introduce one that would be about 11 hours.)
new timeouts:
30 seconds for initial request like, 10 seconds per header line,
and a total request time of 600 seconds.


the new global timeout is implemented using CLOCK_MONOTONIC, with
a fallback to CLOCK_REALTIME if monotonic time is unavailable.


reject multiple Host: headers. besides being protocol standard,
this closes one additional memory leak found by JP. add a simple
test to check this.


clean up option and usage handling some.

note the changes present in bozohttpd 20181118:

o add url remap support via .bzremap file, from martin@netbsd.org
o handle redirections for any protocol, not just http:
o fix a denial of service attack against header contents, which
is now bounded at 16KiB. reported by JP.

Remove trailing whitespace.

Bump date

Add support for remapping requested paths via a .bzredirect file.
Fixes PR 52772. Ok: mrg@

branches: 1.68.2; 1.68.4;
Document script handler issues with httpd(8).
From martin@, addressing PR 52194.

While here, use American spelling consistently and upper-case some
abbreviations.

Bump date.

fix ordering of a couple of words. from Edgar Pettijohn in PR#52375.
thanks!

Remove workaround for ancient HTML generation code.

branches: 1.65.4;
call this bozohttpd 20170201.

Fix typo: s/suport/support

branches: 1.63.2;
Fix sentences at a couple of places.

there was a bug fix in july. call this 20160720.

update the -V documentation to be more clear about what it does.
inspired by Swift Griggs on netbsd-users.

branches: 1.60.2;
As proposed in:

http://mail-index.netbsd.org/tech-userlevel/2016/05/18/msg009999.html

and

https://www.netbsd.org/~agc/bozo-20160517.diff

add a patch to httpd to return the version string of httpd itself, and use the
-G option on the command line to enable this. This gives httpd the ability to
show, from the command line, what version is running.

% /usr/build/obj/x86_64/usr/src/libexec/httpd/bozohttpd -G
bozohttpd version bozohttpd/20160415
%

updates and bozohttpd 20160415:
o add search-word support for CGI
o fix a security issue in CGI suffix handler support which would
allow remote code execution, from shm@netbsd.org
o -C option supports now CGI scripts only

several clean ups:

- bozostrdup() gains a request parameter, and uses it to determine
what sort of error handling is required
- bozo_strdup() dies
- size_arrays() reduced slightly, pushing error handling into the caller
- convert to size_t for some array indices
- bozo_set_pref() and bozo_init_prefs() gain httpd parameters
- apply a bunch of manual CSE to vastly reduce the number of times the
string "request->hr_httpd" appears.
- CGI parse_header() takes a request not httpd now

XXX: lua glue updated to call bozo_init_prefs() with htttpd parameter,
but i'm only guessing here.

- restrict the default list of ciphers to something more secure
- restrict ssl options
From Travis Paul

Bump date for previous

Synchronize SYNOPSIS with reality

* add CGI support for ~user translation (-E switch)
* add redirects to ~user translation
* fix bugs around ~user translation
* add schema detection for absolute redirects
* fixed few memory leaks
* bunch of minor tweaks
* removed -r support
* smarter redirects

OK mrg@

Remove trailing space in boast.

Extend AUTHORS section. Nobody likes a braggart.

OK mrg@

fix content type handling to not hard code (wrong) values for length,
but just call strlen() as needed. call this 20150501.

reported by Jan Danielsson for ".svg".

install as bozohttpd/bozohttpd.8 as well as httpd.

copyright maintenance, note shm@ in the manual and update the CHANGES
for recent changes. call this 20150320.

Bring this man page back to this decade.

call this 20141225.

branches: 1.46.4;
- bump man page date
- strip :80 off virtual host names as they're the default

some fixes for virtual hosting support from Rajeev V. Pillai:

- memory leaks in virtual host plugged
- ensure hr_host is only the host/port part when the request
contains the hostname in the URI not Host: header.


also update the references to the old http/1.1 draft rev 06
to RFC 2616 (fortunately, most sections hadn't moved.)

update for 2014-02-01.

sort the contributor list, and update the defines list to include lua.

update version, date and copyright.

Sort. More markup.

it's Lua, not lua

add Lua scripting support to bozohttpd, see httpd(8) for details

netbsd.org -> NetBSD.org and use my @NetBSD.org address as well.

- update CHANGES with recent changes
- export esacpe_html() and use it in directory indexing
- update manual to include recent contributors

Fix typo, releaases.

Minor typo

branches: 1.34.2;
Bump date for previous. Use more markup.

Check in very basic compressed file support. httpd will now serve
a precompressed .gz file if it exists, the client claims to support
gzip and the request is not ranged.

branches: 1.32.2; 1.32.6; 1.32.8;
merge bozohttpd 20111118

Bump date for previous.

allow the -I option to be useful in non-daemon mode, by letting it force
the returned port number

branches: 1.29.4;
List myself as a contributor.

Remove the "This option..." sentence prefix for all option definitions.
Adjust some sentences so that the new text makes sense. OK mrg@.

fix typo, bump date

Add pid file support: if the new -P option is provided, it specifies the
location of the pid file to create.

OKed by mrg@.

Fix typo.

Fix typo.

merge bozohttpd 20100920

Fix typo, remove trailing whitespace.

merge bozohttpd 20100621

merge bozohttpd 20100617.

merge bozohttpd 20100512

merge 20100510 properly

merge bozohttpd 20100509.

s/the the/the/

Sort options in SYNOPSIS.

merge bozohttpd 20090522

merge bozohttpd 20090418. remove a couple of minor do-nothing local
changes that don't need to cause conflicts.

Remove duplicate part (pasto?). Remove trailing whitespace.
Use Aq where easily possible.

merge bozohttpd 20090417

Fix typo in email address. Pointed out by Mirko Thiesen in PR 41229.

Fix preamble

branches: 1.8.2;
Move all subsections to main DESCRIPTION, noted by John Nemeth.

Fix some more mdoclint warnings.
Add commas in enumerations.

add -t chrootdir to SYNOPSIS, mdoclint

branches: 1.5.2; 1.5.4; 1.5.10;
Fix spelling of my name. While here add my middle initial.

branches: 1.4.2; 1.4.6;
merge bozohttpd 20080303

use BUILDSYMLINKS to not have to rename bozohttpd.8 while still
having this manual installed as httpd.8. now updates from my
repo to bozohttpd.8 will appear in this file.

branches: 1.2.4;
Move bozohttpd.8 to httpd.8

branches: 1.1.1;
Initial revision

oops. these files should never have made it in here.

branches: 1.1.1;
Initial revision

oops. these files should never have made it in here.

branches: 1.1.1;
Initial revision

Grammar and spelling fixes, mainly in comments. A few in documentation,
logging, test description, and SCSI ASC/ASCQ assignment descriptions.

libexec/httpd: fix or suppress lint warnings

No binary change.

branches: 1.147.2;
Bump bozohttpd version to today for mobile-friendly directory listing

add some missing changes and bump the version.

Fix off-by-one in bozo_decode_url_percent

In case of strings that end with '%', debug function was reading past buffer.

Fix memory leaks in bozo_cleanup

serve .iso as "application/octet-stream". bump version & copyright.

branches: 1.142.2;
Add a -q option to make http quiet (no log messages).

Usefull when running multiple instances and some for (high traffic)
APIs e.g. to receive log data from appliences - it makes not sense
to duplicate the whole log in the xferlog file (but we can't configure
that at the syslog level due to other httpd instances using that).

call this bozohttpd 20220517.

fix various typos in comments and output/log messages.

in bozo_init_prefs(), default to returning 1 (success) and if a
bozo_set_pref() fails, return 0 instead. fixes PR#54785 but with
a different patch.

bozohttpd: remove obsolete .bzdirect handling

OK mrg@

s/occured/occurred/ in comments, log messages and man pages.

implement tls minimum version setting.

mostly from sunil@nimmagadda.net in PR#55830, though i moved the
member into the main http structure, so that it doesn't trigger
sslinfo being allocated via command line without the rest of the
ssl being setup (which then leads to crashes.)

rework the bindport setting, inspired by part of the patch
from PR#56367 (thanks JP.)

remove unused parameters, and clean up incompatible options.

from <henrik@gulbra.net>

fix some more typos in comments/log messages, improve wording as well.

don't assume host BUFSIZ is sufficent. small BUFSIZ leads to
always happens errors in the testsuite. switch all these buffers
to be 4KiB sized. reported by embr <git@liclac.eu>

include <stdint.h>. bozo_unconst() uses uintptr_t defined here.
from embr <git@liclac.eu>.

bozohttpd: fix argument type for functions from <ctype.h>

Found by the recently added check to lint (message 342).

ok mrg@

avoid DoS in initial request size, which is now bounded at 16KiB.
reported by Justin Parrott in PR#56085.

changes in bozohttpd 20210227:
o new support for content types: .tar.bz2, .tar.xz, .tar.lz,
.tar.zst, .tbz2, .txz, .tlz, .zipx, .xz, .zst, .sz, .lz, .lzma,
.lzo, .7z, .lzo, .cab, .dmg, .jar, and .rar. should fix
netbsd PR#56026:
MIME type of .tar.xz file on ny{cdn,ftp}.NetBSD.org is invalid

belated call version 20210211 after previous memory leak fix.

clean up issues detected by address sanitizer (just some memory
leaks that only apply to the library version.)

XXX: the handling of hr_file and its variants is more crappy
again - the prior clean up is slightly less clean now, but at
least it does not leak memory.

XXX2: cgi-bin test hangs with address sanitizer. don't know
why yet..

changes in bozohttpd 20210210:
o fix various NULL derefs from malformed headers. mostly from
<emily@ingalls.rocks>.

Bozohttpd clobbers files greater than 4GB on 32bit archs.

Make sure the alignment mask derived from pagesize is an off_t.

various updates from <henrik@gulbra.net> / freebsd. the list from Henrik:

bozohttpd.8:
o Added -d flag to the man page
o Moved -E flag in man page to keep alphabetic order
o Grammar fix for description of -E flag in man page
o Moved a word in the man description for the -f flag
o Made -f imply -b as a backwards-compatible shortcut
o Updated man description of -n to mention Lua scripts
o Moved -z below -Z to keep the uppercase options first

bozohttpd.c:
o Removed obsolete comment about ~user missing cgi-bin support
o Removed "/* ARGSUSED */" lines; was that a macro or a reminder?
o Added USE_ARG macro call for sig, which was otherwise not used
o Added USE_ARG macro call for msg (only used if debug is enabled)

bozohttpd.h:
o Fixed typo in the include guard (BOZOHTTOPD_H_ -> BOZOHTTPD_H_)
o Renamed have_all to have_core; it didn't mean "all" options

content-bozo.c:
o Added USE_ARG macro call for signo, which was otherwise not used
o Made -f imply -b as a backwards-compatible shortcut

main.c:
o Simplified -b text to be symmetric with that for the -f option
o Updated -C text to make "suffix" explicit; it's better than "arg"
o Changed to only show the -E description if have_user is true
o Always show the -e option, which incorrectly used the -E logic
o Renamed have_all to have_core; it didn't mean "all" options
o Added three missing tabs for the description of the -G option
o Updated -L text to make "prefix" explicit; it's better than "arg"
o Updated -M text to make "suffix" explicit; it's slightly better
o Added a previously missing description for the -n option
o Documented the otherwise obscure valid types for the -T option
o Shortened "username" to "user" to match the actual help text
o Moved handling of -c below that for -C to standardize the order
o Broke the enabling test for -C into two lines for consistency
o Inverted the enabling test for -E; this is what was meant, right?
o Removed the enabling test for -e, which should always be enabled

ssl-bozo.c:
o Added USE_ARG for httpd, which is not used if SSL has been excluded

set -D_GNU_SOURCE in Makefile.boot. from hadrien.lacour@posteo.net.
also match %2F as well as %2f. from leah@vuxu.org.
introduce defines for "80" and "443". copyright maint.

avoid passing NULL pointers to printf() like functions and %s.

call this bozohttpd/20200820

compare mmap return again MAP_FAILED not -1 or 0.

send close_notify for the ssl connection before closing the TCP connection
Thanks to Dr. Thomas Orgis for reporting the issue.

Do not report status code 500 to blocklistd(8) Add -DNO_BLOCKLIST_SUPPORT
to Makefile.boot.

Add blocklistd(8) support.

Add -R flag to specify a README file to add at the bottom of directory
autoindex listings.

libexec/httpd: Fix the possible -Werror=stringop-truncation

Error was reported when build.sh was run with MKLIBCSANITIZER=yes flag.

Reviewed by: kamil@, mrg@

branches: 1.113.2;
call this bozohttpd 20190228, and merge the CHANGES entries from the
previous release.

add ssl specific timeout value (30s). if SSL_accept() doesn't
work with in this timeout value, ssl setup now fails.

mostly different from, but inspired from the patch in PR 50655

o don't display special files in the directory index. they aren't
served, but links to them are generated.

rework size_arrays():
- avoid calloc, use bozomalloc
- minor CSE
- fix bozoprefs->size setting when increasing the size (new total was
being added to the prior total.) found by clang static analyzer
from rajeev_v_pillai.

pass httpd to size_arrays() now.
free(NULL) is legal.

fix a few problems pointed out by clang static analyzer, from rajeev_v_pillai:

- bozostrnsep() may return with "in = NULL", so check for it.
- nul terminating in bozo_escape_rfc3986() can be simpler
- don't use uniinit variables in check_remap()
- don't use re-used freed data in check_virtual(). this one is tricky as
the original code was:
free(request->hr_file);
request->hr_file = bozostrdup(httpd, request, s ? s : "/");
however, bozostrdup() may reference request->hr_file.

- call this 20190116
- adjust the directory indexing again:
- don't include "index.html" in html headers
- additional escaping of names
- re-add top/bottom borders
- adds an aquamarine table header
- Zebra-stripes table rows using CSS instead of code
all from "Rajeev V. Pillai" <rajeev_v_pillai@yahoo.com>

Document last changes and bump version to 20181215

Suggested by <mrg>, thanks! (Possible mistakes are mine though!)

Fix handling of bozo_set_timeout() timeouts (and `-T' option parsing)

Avoid .htpasswd exposure to authenticated users when .htpasswd is
in the slashdir too.

Problem reported by JP via tech-security@ and discussed with <mrg>, thanks!

Avoid possible NULL dereference when sending a big request that timeout.

Problem reported by <maya> and reviewed by <maya> and <mrg>, thanks!

strings.h for strcasecmp (on linux)

Check against BOZO_HEADERS_MAX_SIZE in a way that isn't prone to overflow.
Note that this isn't reachable in practice as big requests time out.

use html tables for directory index.
from "Rajeev V. Pillai" <rajeev_v_pillai@yahoo.com>

call this bozohttpd 20181204.

avoid sign extension in % handling (and printing 0xFFFFFF before
wanted values.) from Rajeev V. Pillai.

fix -X option parsing. noted by Rajeev V. Pillai.

avoid c99ism.

- add FALLTHROUGH comment
- one return is usually enough.

call this bozohttpd 20181124.

s/time/val/ to avoid shadowing a global indentifier.

minor style fixes. simplify bozo_match_content_map().

many clean ups:
- keep a list of special files and their human names
- remove (void) casts on bozo_http_error()
- fix a few more misuses of bozo_http_error()
- rename check_mapping() to check_remap() and perform some CSE
- switch away from ``%s'' to '%s'
- remove a bunch of #ifdef using new have_feature defines

use MAP_SHARED for the bzremap file. avoids netbsd kernel complaining:

WARNING: defaulted mmap() share type to MAP_PRIVATE (pid 15478 command bozohttpd)

- move special files defines into bozohttpd.h, so we can ...
- consolidate all the special file checks into
bozo_check_special_files() so that all builds check the same
list of special files, regardless of build options.
- convert "(void)bozo_http_error(...); return -1;" into plain
"return bozo_http_error(...);"
- fix the call to bozo_check_special_files() to be used on all
input types. part of the fixes for failure to reject access
to /.htpasswd as reported by JP on tech-security.
- use warn_unused_result attribute on bozo_check_special_files(),
and fix the failures to return failure. second part of the
htpasswd access fix.
- update testsuite to use a fixed fake hostname.

call this bozohttpd 20181121.

from CHANGES:

o reduce default timeouts, and add expand timeouts to handle the
initial line, each header, and the total time spent
o add -T option to expose new timeout settings
o minor RFC fixes related to timeout handling responses

old timeouts:
60 seconds for initial request like, 60 seconds per header line,
and no whole timeout (though the recent total header size changes
do introduce one that would be about 11 hours.)
new timeouts:
30 seconds for initial request like, 10 seconds per header line,
and a total request time of 600 seconds.


the new global timeout is implemented using CLOCK_MONOTONIC, with
a fallback to CLOCK_REALTIME if monotonic time is unavailable.


reject multiple Host: headers. besides being protocol standard,
this closes one additional memory leak found by JP. add a simple
test to check this.


clean up option and usage handling some.

fix a denial of service attack against header contents, which
is now bounded at 16KiB. reported by JP.

Add support for remapping requested paths via a .bzredirect file.
Fixes PR 52772. Ok: mrg@

branches: 1.87.2; 1.87.4;
Use a protocol-agnostic URL (don't degrade HTTPS->HTTP)

Suggested by Travis Paul in PR bin/52958.

branches: 1.86.4;
uh, this is actually called 20170201 :-)

call this bozohttpd 20170201.

branches: 1.84.2;
there was a bug fix in july. call this 20160720.

update the -V documentation to be more clear about what it does.
inspired by Swift Griggs on netbsd-users.

branches: 1.82.2;
avoid an impossible case the compiler can't quite tell.

As proposed in:

http://mail-index.netbsd.org/tech-userlevel/2016/05/18/msg009999.html

and

https://www.netbsd.org/~agc/bozo-20160517.diff

add a patch to httpd to return the version string of httpd itself, and use the
-G option on the command line to enable this. This gives httpd the ability to
show, from the command line, what version is running.

% /usr/build/obj/x86_64/usr/src/libexec/httpd/bozohttpd -G
bozohttpd version bozohttpd/20160415
%

updates and bozohttpd 20160415:
o add search-word support for CGI
o fix a security issue in CGI suffix handler support which would
allow remote code execution, from shm@netbsd.org
o -C option supports now CGI scripts only

Fix bug in cleanup of reply headers.

Add the concept of ``reply headers'', that is a SIMPLEQ of headers that
will be included in the HTTP reply. We define this as we are about to
add an authentication method that may need to have a conversation with
the client.

bump the version; we have real fixes now.

rewrite the redirection url generation code to use bozoasprintf().

- convert most asprintf() calls to bozoasprintf().
- don't call getpwuid(0) if we don't need to, or fail it it fails,
and remove the 'username' member of bozohttpd_t since it is not
used outside of bozo_setup().

rename bozo_err/bozo_warn/bozo_asprintf to bozoerr/etc.
new rule is that function that mirror libc-style functions get no underscore.

several clean ups:

- bozostrdup() gains a request parameter, and uses it to determine
what sort of error handling is required
- bozo_strdup() dies
- size_arrays() reduced slightly, pushing error handling into the caller
- convert to size_t for some array indices
- bozo_set_pref() and bozo_init_prefs() gain httpd parameters
- apply a bunch of manual CSE to vastly reduce the number of times the
string "request->hr_httpd" appears.
- CGI parse_header() takes a request not httpd now

XXX: lua glue updated to call bozo_init_prefs() with htttpd parameter,
but i'm only guessing here.

Introduce bozo_strdup and bozo_asprintf to add error checking and reduce
code duplication.

Note that bozo_strdup is different that bozostrdup; the _ routines exit
loging error to syslog or stderr, whereas the non _ routines send error
responses to the http client.

handle asprintf errors consistently.

fix wrong variable

simplify

- don't use alloca and then check if alloca returns null and then try to
free it. Allocating from the stack does not return null, and freeing it
will have unpredictable results. use malloc instead.
- now we are using malloc remove -Wno-stack-protector kludge

* add CGI support for ~user translation (-E switch)
* add redirects to ~user translation
* fix bugs around ~user translation
* add schema detection for absolute redirects
* fixed few memory leaks
* bunch of minor tweaks
* removed -r support
* smarter redirects

OK mrg@

Fix handling path with multiple slashes at the beginning
Fix redirections escaping for user support

OK mrg@

Remove d_namelen as it's an BSD extension. Fix building bozohttpd on SunOS.

OK mrg@

fix content type handling to not hard code (wrong) values for length,
but just call strlen() as needed. call this 20150501.

reported by Jan Danielsson for ".svg".

copyright maintenance, note shm@ in the manual and update the CHANGES
for recent changes. call this 20150320.

don't quote /. it doesn't work. this should fix PR#49765.

spit out a 403 not just when an open() fails with EPERM, but with
EACCES as well.

call this 20141225.

Fixed memory leak in case of multiple authentication headers sent by the
client.

OK mrg@

Fixed off-by-one in virtualhost processing. Previous code was checking if
Host header is a prefix of any existing vhost. This behaviour might be used to
uncover existing vitual hosts from the remote.

OK @mrg

don't truncate file sizes to 32 bits for directory indexes.

branches: 1.56.2;
call this 20140717.

rewrite much of the SSL code:
- handle errors in many places they weren't properly
- make SSL_accept() an error the main code notices
- expand bozo_ssl_err() to include bozo_ssl_warn(), bozo_clear_ssl_queue()
- remove empty bozo_ssl_flush()

call this bozohttpd 20140708, and add/fix a couple of CHANGES entries.

avoid truncating a directory path when using snprintf(), but instead
detect and return an error.

found and fixed by shm@netbsd.

Handle ENAMETOOLONG to return 404 error instead of 500.

OK mrg@

* bozo_clean_request free(3) clean up (removed needless checks)
* HEAD method no longer returns response body on error
* fixed bug with multiple bozo_http_error calls caused by fix_url_percent

OK @mrg

bump version, note .svg support.

branches: 1.49.2;
- bump man page date
- strip :80 off virtual host names as they're the default

some fixes for virtual hosting support from Rajeev V. Pillai:

- memory leaks in virtual host plugged
- ensure hr_host is only the host/port part when the request
contains the hostname in the URI not Host: header.


also update the references to the old http/1.1 draft rev 06
to RFC 2616 (fortunately, most sections hadn't moved.)

update for 2014-02-01.

move a variable into the scope of its use, where the assignment
has already validated the pointers used. fixes a bug reported
in private email from dogcow@.

- update CHANGES with recent changes
- update version to 20140102
- update copyrights
- use getcwd() over getwd()
- fix lean build (don't include lua)

no need to check free() arguments against NULL

add Lua scripting support to bozohttpd, see httpd(8) for details

remove trailing whitespace

copyright maint.

- update CHANGES with recent changes
- export esacpe_html() and use it in directory indexing
- update manual to include recent contributors

Check for needed authentication even before redirecting.

Fix debug output for redirects

Fix copy&pasto in debug output

After handling a request by sending a redirect, do not proceed with the normal
request handling (which would typically add error output after the end
of the redirect message).

Redo previous (fixing a memory leak introduced), and while there rework
virtual server support - in daemonized mode mixed virtual and "main"
server usage would alter the virtual hostname depending on order of
requests.
To fix, move the effective virtual hostname into the request structure
and leave the httpd server description static.

Do not keep pointers into a readdir result (which will become invalid
when closing the directory) - strdup() it instead.
Fixes the "bogus redirects" part of PR bin/47925 (atf test case
forthcoming)

fix PR 47629, using a slightly different patch to the one in the PR.

this modifies escape_rfc3986() to escape '%' itself, and to properly
track the buffer size and nul out the final byte, not some random
byte that may actually be unmapped.

branches: 1.32.2;
when generating URIs escape various characters as specified in RFC 3986.
this makes, among other things, files/dirs with "?" work with dir indexing.

Check in very basic compressed file support. httpd will now serve
a precompressed .gz file if it exists, the client claims to support
gzip and the request is not ranged.

branches: 1.30.2; 1.30.6; 1.30.8;
merge bozohttpd 20111118

allow the -I option to be useful in non-daemon mode, by letting it force
the returned port number

branches: 1.28.2;
Don't check for __attribute__ being defined, it won't. Check for GCC 3.x
or compatible and define BOZO_PRINTFLIKE / BOZO_DEAD. Fix fallout.

Add pid file support: if the new -P option is provided, it specifies the
location of the pid file to create.

OKed by mrg@.

Make sure bozo_auth_check_401() isn't called with a NULL "request".

reviewed by mrg

merge bozohttpd 20100920

fix an error in the previous.

fix a serious error in virtual hosting support, noticed by seanb@netbsd,
and disallow ".." as a virtual host name! also ".".

patch from sean.

avoid an unused variable warning(error) for MKCRYPTO=no builds.

merge bozohttpd 20100621

merge bozohttpd 20100617.

merge bozohttpd 20100512

merge 20100510 properly

merge bozohttpd 20100510.

merge bozohttpd 20100509.

fix a new -Wsign-compare bug.

merge bozohttpd 20090522

merge bozohttpd 20090418. remove a couple of minor do-nothing local
changes that don't need to cause conflicts.

merge bozohttpd 20090417

Fix redirection core dump as reported in PR#41042.

Add If-Modified-Since support.

branches: 1.9.2;
From Sergey Katsev at Coyote Point: fix bugs in request transformation and
CGI handling, including bin/40355 . There are two main changes here:

1) call process_cgi() after transform_request(), not before. Now it is
possible to have a default cgi handler catch a request for a path that
was produced by transformation, e.g. by index generation -- so now the
index can be "generated" by a CGI if that is what the user desires.

2) More clearly distinguish "file" from "query" portions of the request
URL, so we do not feed ?-suffixed "arguments" to plain files, fail to
match filename extensions due to ?-suffixes, etc.

After this change, there are only two cases which use the "query"
portion of the request (the portion after the ?):

a) A redirect issued by HTTPD will redirect to the new file, but
with the same query string.

b) process_cgi() will, of course continue to use the query string.

fix -Wsign-compare issues

branches: 1.7.8;
fix a problem in %xy decoding.

merge bozohttpd 20080303

branches: 1.5.2;
remove cdefs.h at mrg's request

include sys/cdefs.h so that __attribute__ can be fixed later

branches: 1.3.2;
RCS IDs

Fix two memory leaks noted by Coverity (CID-4694, CIT-4695) and use
SIMPLEQ_FOREACH where possible. Patch from Arnaud Lacombe.

branches: 1.1.1;
Initial revision

Add a -q option to make http quiet (no log messages).

Usefull when running multiple instances and some for (high traffic)
APIs e.g. to receive log data from appliences - it makes not sense
to duplicate the whole log in the xferlog file (but we can't configure
that at the syslog level due to other httpd instances using that).

call this bozohttpd 20220517.

bozohttpd: remove obsolete .bzdirect handling

OK mrg@

implement tls minimum version setting.

mostly from sunil@nimmagadda.net in PR#55830, though i moved the
member into the main http structure, so that it doesn't trigger
sslinfo being allocated via command line without the rest of the
ssl being setup (which then leads to crashes.)

don't assume host BUFSIZ is sufficent. small BUFSIZ leads to
always happens errors in the testsuite. switch all these buffers
to be 4KiB sized. reported by embr <git@liclac.eu>

belated call version 20210211 after previous memory leak fix.

clean up issues detected by address sanitizer (just some memory
leaks that only apply to the library version.)

XXX: the handling of hr_file and its variants is more crappy
again - the prior clean up is slightly less clean now, but at
least it does not leak memory.

XXX2: cgi-bin test hangs with address sanitizer. don't know
why yet..

changes in bozohttpd 20210210:
o fix various NULL derefs from malformed headers. mostly from
<emily@ingalls.rocks>.

various updates from <henrik@gulbra.net> / freebsd. the list from Henrik:

bozohttpd.8:
o Added -d flag to the man page
o Moved -E flag in man page to keep alphabetic order
o Grammar fix for description of -E flag in man page
o Moved a word in the man description for the -f flag
o Made -f imply -b as a backwards-compatible shortcut
o Updated man description of -n to mention Lua scripts
o Moved -z below -Z to keep the uppercase options first

bozohttpd.c:
o Removed obsolete comment about ~user missing cgi-bin support
o Removed "/* ARGSUSED */" lines; was that a macro or a reminder?
o Added USE_ARG macro call for sig, which was otherwise not used
o Added USE_ARG macro call for msg (only used if debug is enabled)

bozohttpd.h:
o Fixed typo in the include guard (BOZOHTTOPD_H_ -> BOZOHTTPD_H_)
o Renamed have_all to have_core; it didn't mean "all" options

content-bozo.c:
o Added USE_ARG macro call for signo, which was otherwise not used
o Made -f imply -b as a backwards-compatible shortcut

main.c:
o Simplified -b text to be symmetric with that for the -f option
o Updated -C text to make "suffix" explicit; it's better than "arg"
o Changed to only show the -E description if have_user is true
o Always show the -e option, which incorrectly used the -E logic
o Renamed have_all to have_core; it didn't mean "all" options
o Added three missing tabs for the description of the -G option
o Updated -L text to make "prefix" explicit; it's better than "arg"
o Updated -M text to make "suffix" explicit; it's slightly better
o Added a previously missing description for the -n option
o Documented the otherwise obscure valid types for the -T option
o Shortened "username" to "user" to match the actual help text
o Moved handling of -c below that for -C to standardize the order
o Broke the enabling test for -C into two lines for consistency
o Inverted the enabling test for -E; this is what was meant, right?
o Removed the enabling test for -e, which should always be enabled

ssl-bozo.c:
o Added USE_ARG for httpd, which is not used if SSL has been excluded

set -D_GNU_SOURCE in Makefile.boot. from hadrien.lacour@posteo.net.
also match %2F as well as %2f. from leah@vuxu.org.
introduce defines for "80" and "443". copyright maint.

send close_notify for the ssl connection before closing the TCP connection
Thanks to Dr. Thomas Orgis for reporting the issue.

Add blocklistd(8) support.

Add -R flag to specify a README file to add at the bottom of directory
autoindex listings.

branches: 1.60.2;
on m68010 set BOZO_WRSZ to 16k and BOZO_WRSZ to 64k.

add ssl specific timeout value (30s). if SSL_accept() doesn't
work with in this timeout value, ssl setup now fails.

mostly different from, but inspired from the patch in PR 50655

o don't display special files in the directory index. they aren't
served, but links to them are generated.

one semicolon is usually enough.

many clean ups:
- keep a list of special files and their human names
- remove (void) casts on bozo_http_error()
- fix a few more misuses of bozo_http_error()
- rename check_mapping() to check_remap() and perform some CSE
- switch away from ``%s'' to '%s'
- remove a bunch of #ifdef using new have_feature defines

- move special files defines into bozohttpd.h, so we can ...
- consolidate all the special file checks into
bozo_check_special_files() so that all builds check the same
list of special files, regardless of build options.
- convert "(void)bozo_http_error(...); return -1;" into plain
"return bozo_http_error(...);"
- fix the call to bozo_check_special_files() to be used on all
input types. part of the fixes for failure to reject access
to /.htpasswd as reported by JP on tech-security.
- use warn_unused_result attribute on bozo_check_special_files(),
and fix the failures to return failure. second part of the
htpasswd access fix.
- update testsuite to use a fixed fake hostname.

call this bozohttpd 20181121.

also fix have_dynamic_content from the previous previous. re-order
the debug and dynamic content to match the same pattern as everything
else so similar problems are less likely in the future.

fix previous: have_debug was reversed.

move some #if support into bozohttpd.h.

from CHANGES:

o reduce default timeouts, and add expand timeouts to handle the
initial line, each header, and the total time spent
o add -T option to expose new timeout settings
o minor RFC fixes related to timeout handling responses

old timeouts:
60 seconds for initial request like, 60 seconds per header line,
and no whole timeout (though the recent total header size changes
do introduce one that would be about 11 hours.)
new timeouts:
30 seconds for initial request like, 10 seconds per header line,
and a total request time of 600 seconds.


the new global timeout is implemented using CLOCK_MONOTONIC, with
a fallback to CLOCK_REALTIME if monotonic time is unavailable.


reject multiple Host: headers. besides being protocol standard,
this closes one additional memory leak found by JP. add a simple
test to check this.


clean up option and usage handling some.

fix a denial of service attack against header contents, which
is now bounded at 16KiB. reported by JP.

branches: 1.49.2;
fix the rest of the compilers.

fix lint

branches: 1.47.4; 1.47.10;
call this bozohttpd 20170201.

branches: 1.46.2; 1.46.4;
As proposed in:

http://mail-index.netbsd.org/tech-userlevel/2016/05/18/msg009999.html

and

https://www.netbsd.org/~agc/bozo-20160517.diff

add a patch to httpd to return the version string of httpd itself, and use the
-G option on the command line to enable this. This gives httpd the ability to
show, from the command line, what version is running.

% /usr/build/obj/x86_64/usr/src/libexec/httpd/bozohttpd -G
bozohttpd version bozohttpd/20160415
%

updates and bozohttpd 20160415:
o add search-word support for CGI
o fix a security issue in CGI suffix handler support which would
allow remote code execution, from shm@netbsd.org
o -C option supports now CGI scripts only

Add the concept of ``reply headers'', that is a SIMPLEQ of headers that
will be included in the HTTP reply. We define this as we are about to
add an authentication method that may need to have a conversation with
the client.

- convert most asprintf() calls to bozoasprintf().
- don't call getpwuid(0) if we don't need to, or fail it it fails,
and remove the 'username' member of bozohttpd_t since it is not
used outside of bozo_setup().

rename bozo_err/bozo_warn/bozo_asprintf to bozoerr/etc.
new rule is that function that mirror libc-style functions get no underscore.

several clean ups:

- bozostrdup() gains a request parameter, and uses it to determine
what sort of error handling is required
- bozo_strdup() dies
- size_arrays() reduced slightly, pushing error handling into the caller
- convert to size_t for some array indices
- bozo_set_pref() and bozo_init_prefs() gain httpd parameters
- apply a bunch of manual CSE to vastly reduce the number of times the
string "request->hr_httpd" appears.
- CGI parse_header() takes a request not httpd now

XXX: lua glue updated to call bozo_init_prefs() with htttpd parameter,
but i'm only guessing here.

Introduce bozo_strdup and bozo_asprintf to add error checking and reduce
code duplication.

Note that bozo_strdup is different that bozostrdup; the _ routines exit
loging error to syslog or stderr, whereas the non _ routines send error
responses to the http client.

- restrict the default list of ciphers to something more secure
- restrict ssl options
From Travis Paul

* add CGI support for ~user translation (-E switch)
* add redirects to ~user translation
* fix bugs around ~user translation
* add schema detection for absolute redirects
* fixed few memory leaks
* bunch of minor tweaks
* removed -r support
* smarter redirects

OK mrg@

s/USE_NBUTIL/HAVE_NBUTIL_H/, to match the Makefile.
fixes a merge problem in introduced when merging the QNX patches.

from Jan Danielsson.

on QNX, use nbutil.h.

fix content type handling to not hard code (wrong) values for length,
but just call strlen() as needed. call this 20150501.

reported by Jan Danielsson for ".svg".

Fixed memory leak in case of multiple authentication headers sent by the
client.

OK mrg@

branches: 1.33.2;
rewrite much of the SSL code:
- handle errors in many places they weren't properly
- make SSL_accept() an error the main code notices
- expand bozo_ssl_err() to include bozo_ssl_warn(), bozo_clear_ssl_queue()
- remove empty bozo_ssl_flush()

branches: 1.32.2;
some fixes for virtual hosting support from Rajeev V. Pillai:

- memory leaks in virtual host plugged
- ensure hr_host is only the host/port part when the request
contains the hostname in the URI not Host: header.


also update the references to the old http/1.1 draft rev 06
to RFC 2616 (fortunately, most sections hadn't moved.)

- update CHANGES with recent changes
- update version to 20140102
- update copyrights
- use getcwd() over getwd()
- fix lean build (don't include lua)

add Lua scripting support to bozohttpd, see httpd(8) for details

remove trailing whitespace

allow compile-time overriding of BOZO_WRSZ/MMAPSZ parameters

prepare for netbsd to be mastersrc for bozohttpd.

copyright maint.

- update CHANGES with recent changes
- export esacpe_html() and use it in directory indexing
- update manual to include recent contributors

Redo previous (fixing a memory leak introduced), and while there rework
virtual server support - in daemonized mode mixed virtual and "main"
server usage would alter the virtual hostname depending on order of
requests.
To fix, move the effective virtual hostname into the request structure
and leave the httpd server description static.

branches: 1.23.2;
when generating URIs escape various characters as specified in RFC 3986.
this makes, among other things, files/dirs with "?" work with dir indexing.

Add BOZO_PRINTFLIKE for functions that pass an argument and va_arg to
a vprintf-like function.

Check in very basic compressed file support. httpd will now serve
a precompressed .gz file if it exists, the client claims to support
gzip and the request is not ranged.

branches: 1.20.2; 1.20.6; 1.20.8;
merge bozohttpd 20111118

branches: 1.19.2;
Don't check for __attribute__ being defined, it won't. Check for GCC 3.x
or compatible and define BOZO_PRINTFLIKE / BOZO_DEAD. Fix fallout.

Add pid file support: if the new -P option is provided, it specifies the
location of the pid file to create.

OKed by mrg@.

merge bozohttpd 20100920

fix another compile error if NO_DAEMON_MODE is defined. also from rudolf.

fix a compile error if NO_DIRINDEX_SUPPORT is defined. from rudolf.

merge bozohttpd 20100617.

merge bozohttpd 20100510.

merge bozohttpd 20100509.

merge bozohttpd 20090522

merge bozohttpd 20090418. remove a couple of minor do-nothing local
changes that don't need to cause conflicts.

de-const some variables passed to free().

merge bozohttpd 20090417

Add If-Modified-Since support.

branches: 1.6.2;
From Sergey Katsev at Coyote Point: fix bugs in request transformation and
CGI handling, including bin/40355 . There are two main changes here:

1) call process_cgi() after transform_request(), not before. Now it is
possible to have a default cgi handler catch a request for a path that
was produced by transformation, e.g. by index generation -- so now the
index can be "generated" by a CGI if that is what the user desires.

2) More clearly distinguish "file" from "query" portions of the request
URL, so we do not feed ?-suffixed "arguments" to plain files, fail to
match filename extensions due to ?-suffixes, etc.

After this change, there are only two cases which use the "query"
portion of the request (the portion after the ?):

a) A redirect issued by HTTPD will redirect to the new file, but
with the same query string.

b) process_cgi() will, of course continue to use the query string.

branches: 1.5.8;
merge bozohttpd 20080303

branches: 1.4.2; 1.4.6;
- remove const from h_header, this pointer is occasionally free'd
- remove unused write_str var
+ move header parsing to new function separation of parsing vs processing
+ alter some variable names to avoid confusion between header value and
header name (caused breakage with previous rev)

RCS IDs

Get httpd ready for inclusion in build.

branches: 1.1.1;
Initial revision

merge bozohttpd 20111118

branches: 1.1.1;
Initial revision

Removed unnecessary comment

Thanks leot@ for pointing this out

Remove unused variable (bp)

branches: 1.54.6;
bozohttpd: fix argument type for functions from <ctype.h>

Found by the recently added check to lint (message 342).

ok mrg@

belated call version 20210211 after previous memory leak fix.

changes in bozohttpd 20210210:
o fix various NULL derefs from malformed headers. mostly from
<emily@ingalls.rocks>.

various updates from <henrik@gulbra.net> / freebsd. the list from Henrik:

bozohttpd.8:
o Added -d flag to the man page
o Moved -E flag in man page to keep alphabetic order
o Grammar fix for description of -E flag in man page
o Moved a word in the man description for the -f flag
o Made -f imply -b as a backwards-compatible shortcut
o Updated man description of -n to mention Lua scripts
o Moved -z below -Z to keep the uppercase options first

bozohttpd.c:
o Removed obsolete comment about ~user missing cgi-bin support
o Removed "/* ARGSUSED */" lines; was that a macro or a reminder?
o Added USE_ARG macro call for sig, which was otherwise not used
o Added USE_ARG macro call for msg (only used if debug is enabled)

bozohttpd.h:
o Fixed typo in the include guard (BOZOHTTOPD_H_ -> BOZOHTTPD_H_)
o Renamed have_all to have_core; it didn't mean "all" options

content-bozo.c:
o Added USE_ARG macro call for signo, which was otherwise not used
o Made -f imply -b as a backwards-compatible shortcut

main.c:
o Simplified -b text to be symmetric with that for the -f option
o Updated -C text to make "suffix" explicit; it's better than "arg"
o Changed to only show the -E description if have_user is true
o Always show the -e option, which incorrectly used the -E logic
o Renamed have_all to have_core; it didn't mean "all" options
o Added three missing tabs for the description of the -G option
o Updated -L text to make "prefix" explicit; it's better than "arg"
o Updated -M text to make "suffix" explicit; it's slightly better
o Added a previously missing description for the -n option
o Documented the otherwise obscure valid types for the -T option
o Shortened "username" to "user" to match the actual help text
o Moved handling of -c below that for -C to standardize the order
o Broke the enabling test for -C into two lines for consistency
o Inverted the enabling test for -E; this is what was meant, right?
o Removed the enabling test for -e, which should always be enabled

ssl-bozo.c:
o Added USE_ARG for httpd, which is not used if SSL has been excluded

send close_notify for the ssl connection before closing the TCP connection
Thanks to Dr. Thomas Orgis for reporting the issue.

remove some XXX comments. one isn't relevant, and the other two
have been incorrect for a long while now.

branches: 1.48.2;
Account for cgihandler being set when counting the number of CGI environment
headers we are about to set. Avoids an assertion failure (and overruninng
the array) later.

- call this 20190116
- adjust the directory indexing again:
- don't include "index.html" in html headers
- additional escaping of names
- re-add top/bottom borders
- adds an aquamarine table header
- Zebra-stripes table rows using CSS instead of code
all from "Rajeev V. Pillai" <rajeev_v_pillai@yahoo.com>

- fix CGI '+' param and error handling.
- remove unused parameter to daemon_poll_err().

both from "Rajeev V. Pillai" <rajeev_v_pillai@yahoo.com>

appease lint

minor style fixes. simplify bozo_match_content_map().

add an assert() check on array bounds.

many clean ups:
- keep a list of special files and their human names
- remove (void) casts on bozo_http_error()
- fix a few more misuses of bozo_http_error()
- rename check_mapping() to check_remap() and perform some CSE
- switch away from ``%s'' to '%s'
- remove a bunch of #ifdef using new have_feature defines

from CHANGES:

o reduce default timeouts, and add expand timeouts to handle the
initial line, each header, and the total time spent
o add -T option to expose new timeout settings
o minor RFC fixes related to timeout handling responses

old timeouts:
60 seconds for initial request like, 60 seconds per header line,
and no whole timeout (though the recent total header size changes
do introduce one that would be about 11 hours.)
new timeouts:
30 seconds for initial request like, 10 seconds per header line,
and a total request time of 600 seconds.


the new global timeout is implemented using CLOCK_MONOTONIC, with
a fallback to CLOCK_REALTIME if monotonic time is unavailable.


reject multiple Host: headers. besides being protocol standard,
this closes one additional memory leak found by JP. add a simple
test to check this.


clean up option and usage handling some.

use __func__ in debug().

branches: 1.39.2; 1.39.4;
PR bin/52194: bozohttpd fails to exec scripts via the -C mechanism
sometimes with EFAULT due to not NULL terminated environment.

s/u_int/unsigned/.

from Jan Danielsson. increases/fixes portability.

branches: 1.37.4;
call this bozohttpd 20170201.

- fix a bug in cgi processing. from Dennis Lindroos.
- add a testcase for this, and expand test-simple to handle additional
args to bozohttpd for eg, cgi-bin setting.
- fix objdir bugs in the testsuite.

branches: 1.35.2; 1.35.4;
CID 1358679: Fix memory leak.
XXX: pullup 7

use %zu instead of %lu for size_t.

updates and bozohttpd 20160415:
o add search-word support for CGI
o fix a security issue in CGI suffix handler support which would
allow remote code execution, from shm@netbsd.org
o -C option supports now CGI scripts only

redo the fix for rev 1.26 - instead of getting a new string wrong,
just delay the free until the parent has finished using them.
also, free query as well.

fixes PR#50374.

- convert most asprintf() calls to bozoasprintf().
- don't call getpwuid(0) if we don't need to, or fail it it fails,
and remove the 'username' member of bozohttpd_t since it is not
used outside of bozo_setup().

rename bozo_err/bozo_warn/bozo_asprintf to bozoerr/etc.
new rule is that function that mirror libc-style functions get no underscore.

several clean ups:

- bozostrdup() gains a request parameter, and uses it to determine
what sort of error handling is required
- bozo_strdup() dies
- size_arrays() reduced slightly, pushing error handling into the caller
- convert to size_t for some array indices
- bozo_set_pref() and bozo_init_prefs() gain httpd parameters
- apply a bunch of manual CSE to vastly reduce the number of times the
string "request->hr_httpd" appears.
- CGI parse_header() takes a request not httpd now

XXX: lua glue updated to call bozo_init_prefs() with htttpd parameter,
but i'm only guessing here.

* add CGI support for ~user translation (-E switch)
* add redirects to ~user translation
* fix bugs around ~user translation
* add schema detection for absolute redirects
* fixed few memory leaks
* bunch of minor tweaks
* removed -r support
* smarter redirects

OK mrg@

fix content type handling to not hard code (wrong) values for length,
but just call strlen() as needed. call this 20150501.

reported by Jan Danielsson for ".svg".

Fix deref "command" after "free(file)", from KIYOHARA Takashi

branches: 1.25.2;
PR/48810 use cgi handler for index files

OK mrg@ martin@

branches: 1.24.2;
- update CHANGES with recent changes
- update version to 20140102
- update copyrights
- use getcwd() over getwd()
- fix lean build (don't include lua)

no need to check free() arguments against NULL

copyright maint.

Redo previous (fixing a memory leak introduced), and while there rework
virtual server support - in daemonized mode mixed virtual and "main"
server usage would alter the virtual hostname depending on order of
requests.
To fix, move the effective virtual hostname into the request structure
and leave the httpd server description static.

branches: 1.20.2; 1.20.6; 1.20.8; 1.20.14;
merge bozohttpd 20111118

branches: 1.19.6;
When invoking a content handler specified via -C, set the REDIRECT_STATUS
CGI variable to "200". This approximates the Apache behavior which is
required by phpcgi in PHP 5.3 (and by some compilations of older PHP
versions).

I have a revolutionary idea. Perhaps instead of imposing bizarre
requirements on other programs in the name of "security", the PHP
developers should make their own code compile with oh, I don't know,
maybe -Wuninitialized. That might have an effect on the security of
systems using PHP rather than on the "security" of such systems...

...excuse me, got to go now, I think my airquotes just wore out.

merge bozohttpd 20100920

merge bozohttpd 20100617.

merge bozohttpd 20100510.

merge bozohttpd 20100509.

merge bozohttpd 20090522

merge bozohttpd 20090418. remove a couple of minor do-nothing local
changes that don't need to cause conflicts.

merge bozohttpd 20090417

use SIMPLEQ_FOREACH_SAFE(), to avoid a use-after-free.

picked up by coverity.

More CGI handling fixes from Sergey Katsev at Coyote Point.

1) Fix an issue where because of the reordering of transform_request
and process_cgi, the cgi-script name was being cut off
by one character (transform_request for some reason
cuts off the leading '/' for the file name as part of its
processing). As an 'easy' fix, simply re-add the '/' to the
front of the filename, which means that we don't have to
mess with the logic that sometimes adds +1 and sometimes doesn't.

2) Work around ridiculous bug in PHP reported by lukem in 2004,
but stubbornly never fixed by the PHP maintainers:

Change the SCRIPT_NAME and SCRIPT_FILENAME variables
to contain the file name only, not the query if one exists.
Having the query in SCRIPT_FILENAME causes php-cgi to not
work, as per the bug information here:
http://bugs.php.net/bug.php?id=28227

3) Fix a memory leak because URL wasn't being freed.

branches: 1.9.2;
From Sergey Katsev at Coyote Point: fix bugs in request transformation and
CGI handling, including bin/40355 . There are two main changes here:

1) call process_cgi() after transform_request(), not before. Now it is
possible to have a default cgi handler catch a request for a path that
was produced by transformation, e.g. by index generation -- so now the
index can be "generated" by a CGI if that is what the user desires.

2) More clearly distinguish "file" from "query" portions of the request
URL, so we do not feed ?-suffixed "arguments" to plain files, fail to
match filename extensions due to ?-suffixes, etc.

After this change, there are only two cases which use the "query"
portion of the request (the portion after the ?):

a) A redirect issued by HTTPD will redirect to the new file, but
with the same query string.

b) process_cgi() will, of course continue to use the query string.

pull across the fix from my master bozohttpd cvs tree for PR 38466.

branches: 1.7.8;
merge bozohttpd 20080303

branches: 1.6.2; 1.6.6;
- remove const from h_header, this pointer is occasionally free'd
- remove unused write_str var
+ move header parsing to new function separation of parsing vs processing
+ alter some variable names to avoid confusion between header value and
header name (caused breakage with previous rev)

+ don't free strdup()'d ptr that was manipulated.
(i.e. free(): warning: modified (chunk-) pointer))
+ don't leak memory for ptr actually returned from strdup()
+ don't strdup() if we don't have to
+ don't break without free() if we did strdup()
+ as well as freeing h_value also free the header.

RCS IDs

Fix two memory leaks noted by Coverity (CID-4694, CIT-4695) and use
SIMPLEQ_FOREACH where possible. Patch from Arnaud Lacombe.

Get httpd ready for inclusion in build.

branches: 1.1.1;
Initial revision

serve .iso as "application/octet-stream". bump version & copyright.

branches: 1.21.2;
add .mobi / application/x-mobipocket-ebook.

changes in bozohttpd 20210227:
o new support for content types: .tar.bz2, .tar.xz, .tar.lz,
.tar.zst, .tbz2, .txz, .tlz, .zipx, .xz, .zst, .sz, .lz, .lzma,
.lzo, .7z, .lzo, .cab, .dmg, .jar, and .rar. should fix
netbsd PR#56026:
MIME type of .tar.xz file on ny{cdn,ftp}.NetBSD.org is invalid

various updates from <henrik@gulbra.net> / freebsd. the list from Henrik:

bozohttpd.8:
o Added -d flag to the man page
o Moved -E flag in man page to keep alphabetic order
o Grammar fix for description of -E flag in man page
o Moved a word in the man description for the -f flag
o Made -f imply -b as a backwards-compatible shortcut
o Updated man description of -n to mention Lua scripts
o Moved -z below -Z to keep the uppercase options first

bozohttpd.c:
o Removed obsolete comment about ~user missing cgi-bin support
o Removed "/* ARGSUSED */" lines; was that a macro or a reminder?
o Added USE_ARG macro call for sig, which was otherwise not used
o Added USE_ARG macro call for msg (only used if debug is enabled)

bozohttpd.h:
o Fixed typo in the include guard (BOZOHTTOPD_H_ -> BOZOHTTPD_H_)
o Renamed have_all to have_core; it didn't mean "all" options

content-bozo.c:
o Added USE_ARG macro call for signo, which was otherwise not used
o Made -f imply -b as a backwards-compatible shortcut

main.c:
o Simplified -b text to be symmetric with that for the -f option
o Updated -C text to make "suffix" explicit; it's better than "arg"
o Changed to only show the -E description if have_user is true
o Always show the -e option, which incorrectly used the -E logic
o Renamed have_all to have_core; it didn't mean "all" options
o Added three missing tabs for the description of the -G option
o Updated -L text to make "prefix" explicit; it's better than "arg"
o Updated -M text to make "suffix" explicit; it's slightly better
o Added a previously missing description for the -n option
o Documented the otherwise obscure valid types for the -T option
o Shortened "username" to "user" to match the actual help text
o Moved handling of -c below that for -C to standardize the order
o Broke the enabling test for -C into two lines for consistency
o Inverted the enabling test for -E; this is what was meant, right?
o Removed the enabling test for -e, which should always be enabled

ssl-bozo.c:
o Added USE_ARG for httpd, which is not used if SSL has been excluded

bozohttpd: correct .m4a to audio/mp4.

bozohttpd: add .m4a and .m4v file extensions.

branches: 1.16.2;
minor style fixes. simplify bozo_match_content_map().

from CHANGES:

o reduce default timeouts, and add expand timeouts to handle the
initial line, each header, and the total time spent
o add -T option to expose new timeout settings
o minor RFC fixes related to timeout handling responses

old timeouts:
60 seconds for initial request like, 60 seconds per header line,
and no whole timeout (though the recent total header size changes
do introduce one that would be about 11 hours.)
new timeouts:
30 seconds for initial request like, 10 seconds per header line,
and a total request time of 600 seconds.


the new global timeout is implemented using CLOCK_MONOTONIC, with
a fallback to CLOCK_REALTIME if monotonic time is unavailable.


reject multiple Host: headers. besides being protocol standard,
this closes one additional memory leak found by JP. add a simple
test to check this.


clean up option and usage handling some.

branches: 1.14.6; 1.14.12; 1.14.14;
Do not send encoding header for compressed formats.

branches: 1.13.2;
rename bozo_err/bozo_warn/bozo_asprintf to bozoerr/etc.
new rule is that function that mirror libc-style functions get no underscore.

fix content type handling to not hard code (wrong) values for length,
but just call strlen() as needed. call this 20150501.

reported by Jan Danielsson for ".svg".

add .ts and .vob suffixes.

branches: 1.10.2;
enable .svg. as prompted by agc@.

branches: 1.9.2;
- update CHANGES with recent changes
- update version to 20140102
- update copyrights
- use getcwd() over getwd()
- fix lean build (don't include lua)

- update CHANGES with recent changes
- export esacpe_html() and use it in directory indexing
- update manual to include recent contributors

branches: 1.7.2; 1.7.6; 1.7.8; 1.7.14;
merge bozohttpd 20111118

branches: 1.6.4;
add .mp4 as video/mp4.

merge bozohttpd 20100509.

merge bozohttpd 20090417

branches: 1.3.6; 1.3.8; 1.3.10; 1.3.16;
merge bozohttpd 20080303

branches: 1.2.2; 1.2.6;
RCS IDs

branches: 1.1.1;
Initial revision

various updates from <henrik@gulbra.net> / freebsd. the list from Henrik:

bozohttpd.8:
o Added -d flag to the man page
o Moved -E flag in man page to keep alphabetic order
o Grammar fix for description of -E flag in man page
o Moved a word in the man description for the -f flag
o Made -f imply -b as a backwards-compatible shortcut
o Updated man description of -n to mention Lua scripts
o Moved -z below -Z to keep the uppercase options first

bozohttpd.c:
o Removed obsolete comment about ~user missing cgi-bin support
o Removed "/* ARGSUSED */" lines; was that a macro or a reminder?
o Added USE_ARG macro call for sig, which was otherwise not used
o Added USE_ARG macro call for msg (only used if debug is enabled)

bozohttpd.h:
o Fixed typo in the include guard (BOZOHTTOPD_H_ -> BOZOHTTPD_H_)
o Renamed have_all to have_core; it didn't mean "all" options

content-bozo.c:
o Added USE_ARG macro call for signo, which was otherwise not used
o Made -f imply -b as a backwards-compatible shortcut

main.c:
o Simplified -b text to be symmetric with that for the -f option
o Updated -C text to make "suffix" explicit; it's better than "arg"
o Changed to only show the -E description if have_user is true
o Always show the -e option, which incorrectly used the -E logic
o Renamed have_all to have_core; it didn't mean "all" options
o Added three missing tabs for the description of the -G option
o Updated -L text to make "prefix" explicit; it's better than "arg"
o Updated -M text to make "suffix" explicit; it's slightly better
o Added a previously missing description for the -n option
o Documented the otherwise obscure valid types for the -T option
o Shortened "username" to "user" to match the actual help text
o Moved handling of -c below that for -C to standardize the order
o Broke the enabling test for -C into two lines for consistency
o Inverted the enabling test for -E; this is what was meant, right?
o Removed the enabling test for -e, which should always be enabled

ssl-bozo.c:
o Added USE_ARG for httpd, which is not used if SSL has been excluded

branches: 1.21.2;
- call this 20190116
- adjust the directory indexing again:
- don't include "index.html" in html headers
- additional escaping of names
- re-add top/bottom borders
- adds an aquamarine table header
- Zebra-stripes table rows using CSS instead of code
all from "Rajeev V. Pillai" <rajeev_v_pillai@yahoo.com>

- fix CGI '+' param and error handling.
- remove unused parameter to daemon_poll_err().

both from "Rajeev V. Pillai" <rajeev_v_pillai@yahoo.com>

many clean ups:
- keep a list of special files and their human names
- remove (void) casts on bozo_http_error()
- fix a few more misuses of bozo_http_error()
- rename check_mapping() to check_remap() and perform some CSE
- switch away from ``%s'' to '%s'
- remove a bunch of #ifdef using new have_feature defines

from CHANGES:

o reduce default timeouts, and add expand timeouts to handle the
initial line, each header, and the total time spent
o add -T option to expose new timeout settings
o minor RFC fixes related to timeout handling responses

old timeouts:
60 seconds for initial request like, 60 seconds per header line,
and no whole timeout (though the recent total header size changes
do introduce one that would be about 11 hours.)
new timeouts:
30 seconds for initial request like, 10 seconds per header line,
and a total request time of 600 seconds.


the new global timeout is implemented using CLOCK_MONOTONIC, with
a fallback to CLOCK_REALTIME if monotonic time is unavailable.


reject multiple Host: headers. besides being protocol standard,
this closes one additional memory leak found by JP. add a simple
test to check this.


clean up option and usage handling some.