| History log of /src/libexec/httpd/cgi-bozo.c |
| Revision | | Date | Author | Comments |
| 1.56 |
| 20-Sep-2023 |
shm | Removed unnecessary comment
Thanks leot@ for pointing this out
|
| 1.55 |
| 20-Sep-2023 |
shm | Remove unused variable (bp)
|
| 1.54 |
| 08-Apr-2021 |
rillig | bozohttpd: fix argument type for functions from <ctype.h>
Found by the recently added check to lint (message 342).
ok mrg@
|
| 1.53 |
| 27-Feb-2021 |
mrg | belated call version 20210211 after previous memory leak fix.
|
| 1.52 |
| 11-Feb-2021 |
mrg | changes in bozohttpd 20210210:
o fix various NULL derefs from malformed headers. mostly from
<emily@ingalls.rocks>.
|
| 1.51 |
| 15-Oct-2020 |
mrg | various updates from <henrik@gulbra.net> / freebsd. the list from Henrik:
bozohttpd.8:
o Added -d flag to the man page
o Moved -E flag in man page to keep alphabetic order
o Grammar fix for description of -E flag in man page
o Moved a word in the man description for the -f flag
o Made -f imply -b as a backwards-compatible shortcut
o Updated man description of -n to mention Lua scripts
o Moved -z below -Z to keep the uppercase options first
bozohttpd.c:
o Removed obsolete comment about ~user missing cgi-bin support
o Removed "/* ARGSUSED */" lines; was that a macro or a reminder?
o Added USE_ARG macro call for sig, which was otherwise not used
o Added USE_ARG macro call for msg (only used if debug is enabled)
bozohttpd.h:
o Fixed typo in the include guard (BOZOHTTOPD_H_ -> BOZOHTTPD_H_)
o Renamed have_all to have_core; it didn't mean "all" options
content-bozo.c:
o Added USE_ARG macro call for signo, which was otherwise not used
o Made -f imply -b as a backwards-compatible shortcut
main.c:
o Simplified -b text to be symmetric with that for the -f option
o Updated -C text to make "suffix" explicit; it's better than "arg"
o Changed to only show the -E description if have_user is true
o Always show the -e option, which incorrectly used the -E logic
o Renamed have_all to have_core; it didn't mean "all" options
o Added three missing tabs for the description of the -G option
o Updated -L text to make "prefix" explicit; it's better than "arg"
o Updated -M text to make "suffix" explicit; it's slightly better
o Added a previously missing description for the -n option
o Documented the otherwise obscure valid types for the -T option
o Shortened "username" to "user" to match the actual help text
o Moved handling of -c below that for -C to standardize the order
o Broke the enabling test for -C into two lines for consistency
o Inverted the enabling test for -E; this is what was meant, right?
o Removed the enabling test for -e, which should always be enabled
ssl-bozo.c:
o Added USE_ARG for httpd, which is not used if SSL has been excluded
|
| 1.50 |
| 20-Aug-2020 |
spz | send close_notify for the ssl connection before closing the TCP connection
Thanks to Dr. Thomas Orgis for reporting the issue.
|
| 1.49 |
| 06-Dec-2019 |
mrg | remove some XXX comments. one isn't relevant, and the other two
have been incorrect for a long while now.
|
| 1.48 |
| 29-Mar-2019 |
martin | branches: 1.48.2;
Account for cgihandler being set when counting the number of CGI environment
headers we are about to set. Avoids an assertion failure (and overruninng
the array) later.
|
| 1.47 |
| 17-Jan-2019 |
mrg | - call this 20190116
- adjust the directory indexing again:
- don't include "index.html" in html headers
- additional escaping of names
- re-add top/bottom borders
- adds an aquamarine table header
- Zebra-stripes table rows using CSS instead of code
all from "Rajeev V. Pillai" <rajeev_v_pillai@yahoo.com>
|
| 1.46 |
| 17-Jan-2019 |
mrg | - fix CGI '+' param and error handling.
- remove unused parameter to daemon_poll_err().
both from "Rajeev V. Pillai" <rajeev_v_pillai@yahoo.com>
|
| 1.45 |
| 24-Nov-2018 |
christos | appease lint
|
| 1.44 |
| 23-Nov-2018 |
mrg | minor style fixes. simplify bozo_match_content_map().
|
| 1.43 |
| 22-Nov-2018 |
mrg | add an assert() check on array bounds.
|
| 1.42 |
| 22-Nov-2018 |
mrg | many clean ups:
- keep a list of special files and their human names
- remove (void) casts on bozo_http_error()
- fix a few more misuses of bozo_http_error()
- rename check_mapping() to check_remap() and perform some CSE
- switch away from ``%s'' to '%s'
- remove a bunch of #ifdef using new have_feature defines
|
| 1.41 |
| 20-Nov-2018 |
mrg | from CHANGES:
o reduce default timeouts, and add expand timeouts to handle the
initial line, each header, and the total time spent
o add -T option to expose new timeout settings
o minor RFC fixes related to timeout handling responses
old timeouts:
60 seconds for initial request like, 60 seconds per header line,
and no whole timeout (though the recent total header size changes
do introduce one that would be about 11 hours.)
new timeouts:
30 seconds for initial request like, 10 seconds per header line,
and a total request time of 600 seconds.
the new global timeout is implemented using CLOCK_MONOTONIC, with
a fallback to CLOCK_REALTIME if monotonic time is unavailable.
reject multiple Host: headers. besides being protocol standard,
this closes one additional memory leak found by JP. add a simple
test to check this.
clean up option and usage handling some.
|
| 1.40 |
| 18-Nov-2018 |
mrg | use __func__ in debug().
|
| 1.39 |
| 28-Nov-2017 |
martin | branches: 1.39.2; 1.39.4;
PR bin/52194: bozohttpd fails to exec scripts via the -C mechanism
sometimes with EFAULT due to not NULL terminated environment.
|
| 1.38 |
| 05-Oct-2017 |
mrg | s/u_int/unsigned/.
from Jan Danielsson. increases/fixes portability.
|
| 1.37 |
| 31-Jan-2017 |
mrg | branches: 1.37.4;
call this bozohttpd 20170201.
|
| 1.36 |
| 31-Jan-2017 |
mrg | - fix a bug in cgi processing. from Dennis Lindroos.
- add a testcase for this, and expand test-simple to handle additional
args to bozohttpd for eg, cgi-bin setting.
- fix objdir bugs in the testsuite.
|
| 1.35 |
| 24-Apr-2016 |
christos | branches: 1.35.2; 1.35.4;
CID 1358679: Fix memory leak.
XXX: pullup 7
|
| 1.34 |
| 15-Apr-2016 |
mrg | use %zu instead of %lu for size_t.
|
| 1.33 |
| 15-Apr-2016 |
mrg | updates and bozohttpd 20160415:
o add search-word support for CGI
o fix a security issue in CGI suffix handler support which would
allow remote code execution, from shm@netbsd.org
o -C option supports now CGI scripts only
|
| 1.32 |
| 31-Dec-2015 |
mrg | redo the fix for rev 1.26 - instead of getting a new string wrong,
just delay the free until the parent has finished using them.
also, free query as well.
fixes PR#50374.
|
| 1.31 |
| 29-Dec-2015 |
mrg | - convert most asprintf() calls to bozoasprintf().
- don't call getpwuid(0) if we don't need to, or fail it it fails,
and remove the 'username' member of bozohttpd_t since it is not
used outside of bozo_setup().
|
| 1.30 |
| 28-Dec-2015 |
mrg | rename bozo_err/bozo_warn/bozo_asprintf to bozoerr/etc.
new rule is that function that mirror libc-style functions get no underscore.
|
| 1.29 |
| 27-Dec-2015 |
mrg | several clean ups:
- bozostrdup() gains a request parameter, and uses it to determine
what sort of error handling is required
- bozo_strdup() dies
- size_arrays() reduced slightly, pushing error handling into the caller
- convert to size_t for some array indices
- bozo_set_pref() and bozo_init_prefs() gain httpd parameters
- apply a bunch of manual CSE to vastly reduce the number of times the
string "request->hr_httpd" appears.
- CGI parse_header() takes a request not httpd now
XXX: lua glue updated to call bozo_init_prefs() with htttpd parameter,
but i'm only guessing here.
|
| 1.28 |
| 28-Oct-2015 |
shm | * add CGI support for ~user translation (-E switch)
* add redirects to ~user translation
* fix bugs around ~user translation
* add schema detection for absolute redirects
* fixed few memory leaks
* bunch of minor tweaks
* removed -r support
* smarter redirects
OK mrg@
|
| 1.27 |
| 02-May-2015 |
mrg | fix content type handling to not hard code (wrong) values for length,
but just call strlen() as needed. call this 20150501.
reported by Jan Danielsson for ".svg".
|
| 1.26 |
| 19-Apr-2015 |
christos | Fix deref "command" after "free(file)", from KIYOHARA Takashi
|
| 1.25 |
| 24-Jun-2014 |
shm | branches: 1.25.2;
PR/48810 use cgi handler for index files
OK mrg@ martin@
|
| 1.24 |
| 02-Jan-2014 |
mrg | branches: 1.24.2;
- update CHANGES with recent changes
- update version to 20140102
- update copyrights
- use getcwd() over getwd()
- fix lean build (don't include lua)
|
| 1.23 |
| 12-Oct-2013 |
mbalmer | no need to check free() arguments against NULL
|
| 1.22 |
| 11-Jul-2013 |
mrg | copyright maint.
|
| 1.21 |
| 27-Jun-2013 |
martin | Redo previous (fixing a memory leak introduced), and while there rework
virtual server support - in daemonized mode mixed virtual and "main"
server usage would alter the virtual hostname depending on order of
requests.
To fix, move the effective virtual hostname into the request structure
and leave the httpd server description static.
|
| 1.20 |
| 18-Nov-2011 |
mrg | branches: 1.20.2; 1.20.6; 1.20.8; 1.20.14;
merge bozohttpd 20111118
|
| 1.19 |
| 14-Dec-2010 |
tls | branches: 1.19.6;
When invoking a content handler specified via -C, set the REDIRECT_STATUS
CGI variable to "200". This approximates the Apache behavior which is
required by phpcgi in PHP 5.3 (and by some compilations of older PHP
versions).
I have a revolutionary idea. Perhaps instead of imposing bizarre
requirements on other programs in the name of "security", the PHP
developers should make their own code compile with oh, I don't know,
maybe -Wuninitialized. That might have an effect on the security of
systems using PHP rather than on the "security" of such systems...
...excuse me, got to go now, I think my airquotes just wore out.
|
| 1.18 |
| 20-Sep-2010 |
mrg | merge bozohttpd 20100920
|
| 1.17 |
| 17-Jun-2010 |
mrg | merge bozohttpd 20100617.
|
| 1.16 |
| 10-May-2010 |
mrg | merge bozohttpd 20100510.
|
| 1.15 |
| 10-May-2010 |
mrg | merge bozohttpd 20100509.
|
| 1.14 |
| 23-May-2009 |
mrg | merge bozohttpd 20090522
|
| 1.13 |
| 18-Apr-2009 |
mrg | merge bozohttpd 20090418. remove a couple of minor do-nothing local
changes that don't need to cause conflicts.
|
| 1.12 |
| 18-Apr-2009 |
mrg | merge bozohttpd 20090417
|
| 1.11 |
| 11-Mar-2009 |
mrg | use SIMPLEQ_FOREACH_SAFE(), to avoid a use-after-free.
picked up by coverity.
|
| 1.10 |
| 19-Feb-2009 |
tls | More CGI handling fixes from Sergey Katsev at Coyote Point.
1) Fix an issue where because of the reordering of transform_request
and process_cgi, the cgi-script name was being cut off
by one character (transform_request for some reason
cuts off the leading '/' for the file name as part of its
processing). As an 'easy' fix, simply re-add the '/' to the
front of the filename, which means that we don't have to
mess with the logic that sometimes adds +1 and sometimes doesn't.
2) Work around ridiculous bug in PHP reported by lukem in 2004,
but stubbornly never fixed by the PHP maintainers:
Change the SCRIPT_NAME and SCRIPT_FILENAME variables
to contain the file name only, not the query if one exists.
Having the query in SCRIPT_FILENAME causes php-cgi to not
work, as per the bug information here:
http://bugs.php.net/bug.php?id=28227
3) Fix a memory leak because URL wasn't being freed.
|
| 1.9 |
| 04-Feb-2009 |
tls | branches: 1.9.2;
From Sergey Katsev at Coyote Point: fix bugs in request transformation and
CGI handling, including bin/40355 . There are two main changes here:
1) call process_cgi() after transform_request(), not before. Now it is
possible to have a default cgi handler catch a request for a path that
was produced by transformation, e.g. by index generation -- so now the
index can be "generated" by a CGI if that is what the user desires.
2) More clearly distinguish "file" from "query" portions of the request
URL, so we do not feed ?-suffixed "arguments" to plain files, fail to
match filename extensions due to ?-suffixes, etc.
After this change, there are only two cases which use the "query"
portion of the request (the portion after the ?):
a) A redirect issued by HTTPD will redirect to the new file, but
with the same query string.
b) process_cgi() will, of course continue to use the query string.
|
| 1.8 |
| 06-Nov-2008 |
mrg | pull across the fix from my master bozohttpd cvs tree for PR 38466.
|
| 1.7 |
| 03-Mar-2008 |
mrg | branches: 1.7.8;
merge bozohttpd 20080303
|
| 1.6 |
| 04-Nov-2007 |
rtr | branches: 1.6.2; 1.6.6;
- remove const from h_header, this pointer is occasionally free'd
- remove unused write_str var
+ move header parsing to new function separation of parsing vs processing
+ alter some variable names to avoid confusion between header value and
header name (caused breakage with previous rev)
|
| 1.5 |
| 04-Nov-2007 |
rtr | + don't free strdup()'d ptr that was manipulated.
(i.e. free(): warning: modified (chunk-) pointer))
+ don't leak memory for ptr actually returned from strdup()
+ don't strdup() if we don't have to
+ don't break without free() if we did strdup()
+ as well as freeing h_value also free the header.
|
| 1.4 |
| 17-Oct-2007 |
tls | RCS IDs
|
| 1.3 |
| 17-Oct-2007 |
tls | Fix two memory leaks noted by Coverity (CID-4694, CIT-4695) and use
SIMPLEQ_FOREACH where possible. Patch from Arnaud Lacombe.
|
| 1.2 |
| 16-Oct-2007 |
tls | Get httpd ready for inclusion in build.
|
| 1.1 |
| 16-Oct-2007 |
tls | branches: 1.1.1;
Initial revision
|
| 1.1.1.10 |
| 18-Nov-2011 |
mrg | update to bozohttpd 20111118. nothing major is missing here but
the changes since the prior import were:
o add -P <pidfile> option, from jmmv@netbsd.org
o avoid crashes with http basic auth, from pooka@netbsd.org
o add support for REDIRECT_STATUS variable, from tls@netbsd.org
o support .mp4 files in the default map
o directory indexes with files with : are now displayed properly, from
reed@netbsd.org
o allow -I option to be useful in non-inetd mode as well
|
| 1.1.1.9 |
| 20-Sep-2010 |
mrg | initial import of bozohttpd 20100920. the only change missing in here is:
o fix dynamic CGI content maps, from rudolf
|
| 1.1.1.8 |
| 17-Jun-2010 |
mrg | initial import of bozohttpd 20100617. recent changes:
o fix some compile issues
o fix SSL mode. from rtr
o fix some cgi-bin issues, as seen with cvsweb
o disable multi-file daemon mode for now, it breaks
o return 404's instead of 403's when chdir of ~user dirs fail
o remove "noreturn" attribute from bozo_http_error() that was
causing incorrect runtime behaviour
|
| 1.1.1.7 |
| 10-May-2010 |
mrg | import bozohttpd 20100510 -- just fixes some compile errors.
|
| 1.1.1.6 |
| 10-May-2010 |
mrg | import bozohttpd 20100509. it has these changes:
o major rework and clean up of internal interfaces. move the main
program into main.c, the remaining parts are useable as library.
add bindings for lua. by Alistair G. Crooks <agc@netbsd.org>
o fix http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=566325
special thanks to al for the majority of these changes.
|
| 1.1.1.5 |
| 23-May-2009 |
mrg | import bozohttpd 20090522, which has these changes:
o close more leaking file descriptors for CGI and daemon mode
o add subdirs for build "debug" and "small" versions
o clean up a bad merge / duplicate code
o make mmap() usage portable, fixes linux & ranges: support
o document the -f option
o daemon mode now serves 6 files per child
|
| 1.1.1.4 |
| 18-Apr-2009 |
mrg | import bozohttpd 20090418. changes include:
o avoid dying in daemon mode for some uncommon, but recoverable, errors
o close leaking file descriptors for CGI and daemon mode
o handle poll errors properly
o don't try to handle more than one request per process yet
this covers PR#38489 and PR#40079, as well some some issues reported
privately.
|
| 1.1.1.3 |
| 18-Apr-2009 |
mrg | import latest bozohttpd sources. changes include:
o make bozohttpd internally more modular, preparing the way
to handle more than one request per process
o fix http-auth, set $REMOTE_USER not $REMOTEUSER. also fix
cgi-bin with cvsweb, from Holger Weiss <holger@CIS.FU-Berlin.DE>
o fix an uninitialised variable use in daemon mode
o fix ssl mode with newer OpenSSL
o mmap large files in manageable sizes so we can serve any size file
o refactor url processing to handle query strings correctly for CGI
from Sergey Katsev at Coyote Point
o add If-Modified-Since support, from Joerg Sonnenberger
<joerg@netbsd.org>
o many more manual fixes, from NetBSD
|
| 1.1.1.2 |
| 03-Mar-2008 |
mrg | import latest bozohttpd. changes include:
o fix some cgi header processing, from <thelsdj@gmail.com>
o add simple Range: header processing, from <bad@bsd.de>
o man page fixes, from NetBSD
o clean up various parts, from NetBSD
o prefix some function names with "bozo"
o align directory indexing <hr> markers
o clean up some code GCC4 grumbled about
|
| 1.1.1.1 |
| 16-Oct-2007 |
tls | Import of bozohttpd for its originally intended purpose: a small (~30k)
simple run-from-inetd httpd suitable for small systems (and some large
ones).
|
| 1.6.6.1 |
| 24-Mar-2008 |
keiichi | sync with head.
|
| 1.6.2.3 |
| 23-Mar-2008 |
matt | sync with HEAD
|
| 1.6.2.2 |
| 06-Nov-2007 |
matt | sync with HEAD
|
| 1.6.2.1 |
| 04-Nov-2007 |
matt | file cgi-bozo.c was added on branch matt-armv6 on 2007-11-06 23:12:03 +0000
|
| 1.7.8.4 |
| 09-Jul-2014 |
msaitoh | Pull up following revision(s) (requested by mrg in ticket #1913):
libexec/httpd/CHANGES 1.3-1.18
libexec/httpd/Makefile 1.8-1.22 via patch
libexec/httpd/Makefile.boot 1.3-1.6
libexec/httpd/auth-bozo.c 1.5-1.13
libexec/httpd/bozohttpd.8 1.6-1.46
libexec/httpd/bozohttpd.c 1.8,1.12-1.54
libexec/httpd/bozohttpd.h 1.8-1.32
libexec/httpd/cgi-bozo.c 1.11-1.25
libexec/httpd/content-bozo.c 1.4-1.10
libexec/httpd/daemon-bozo.c 1.5-1.16
libexec/httpd/dir-index-bozo.c 1.6-1.19
libexec/httpd/ssl-bozo.c 1.5-1.16
libexec/httpd/tilde-luzah-bozo.c 1.5-1.10
libexec/httpd/lua-bozo.c 1.1-1.9
libexec/httpd/main.c 1.1-1.7
libexec/httpd/netbsd_queue.h 1.1
libexec/httpd/printenv.lua 1.1-1.2
libexec/httpd/debug/Makefile 1.1
libexec/httpd/libbozohttpd/Makefile 1.2
libexec/httpd/libbozohttpd/libbozohttpd.3 1.3
libexec/httpd/libbozohttpd/shlib_version 1.1
libexec/httpd/lua/Makefile 1.1
libexec/httpd/lua/bozo.lua 1.1
libexec/httpd/lua/glue.c 1.1
libexec/httpd/lua/optparse.lua 1.1
libexec/httpd/lua/shlib_version 1.1
libexec/httpd/small/Makefile 1.1-1.2
libexec/httpd/testsuite/Makefile 1.4
libexec/httpd/testsuite/html_cmp 1.4
libexec/httpd/testsuite/t1.in 1.3
libexec/httpd/testsuite/t1.out 1.3
libexec/httpd/testsuite/t10.in 1.1
libexec/httpd/testsuite/t10.out 1.1
libexec/httpd/testsuite/t2.in 1.3
libexec/httpd/testsuite/t2.out 1.3
libexec/httpd/testsuite/t3.in 1.3
libexec/httpd/testsuite/t3.out 1.3
libexec/httpd/testsuite/t4.in 1.3
libexec/httpd/testsuite/t4.out 1.3
libexec/httpd/testsuite/t5.in 1.3
libexec/httpd/testsuite/t5.out 1.3
libexec/httpd/testsuite/t6.in 1.3
libexec/httpd/testsuite/t6.out 1.3
libexec/httpd/testsuite/t7.in 1.3
libexec/httpd/testsuite/t7.out 1.3
libexec/httpd/testsuite/t8.in 1.3
libexec/httpd/testsuite/t8.out 1.3
libexec/httpd/testsuite/t9.in 1.3
libexec/httpd/testsuite/t9.out 1.3
libexec/httpd/testsuite/test-bigfile 1.1
libexec/httpd/testsuite/data/bigfile 1.1
libexec/httpd/testsuite/data/bigfile.partial4000 1.1
libexec/httpd/testsuite/data/bigfile.partial8000 1.1
libexec/httpd/testsuite/data/file 1.3
libexec/httpd/testsuite/data/index.html 1.3
Update bozohttpd from 20080303+patches to 20140708.
changes in bozohttpd 20140708:
o fixes for virtual host support, from rajeev_v_pillai@yahoo.com
o avoid printing double errors, from shm@netbsd.org
o fix a security issue in basic HTTP authentication which would allow
authentication to be bypassed, from shm@netbsd.org
changes in bozohttpd 20140201:
o support .svg files
o fix a core dump when requests timeout
changes in bozohttpd 20140102:
o update a few content types
o add support for directly calling lua scripts to handle
processes, from mbalmer@netbsd.org
o properly escape generated HTML
o add authentication for redirections, from martin@netbsd.org
o handle chained ssl certifications, from elric@netbsd.org
o add basic support for gzipped files, from elric@netbsd.org
o properly escape generated URIs
changes in bozohttpd 20111118:
o add -P <pidfile> option, from jmmv@netbsd.org
o avoid crashes with http basic auth, from pooka@netbsd.org
o add support for REDIRECT_STATUS variable, from tls@netbsd.org
o support .mp4 files in the default map
o directory indexes with files with : are now displayed properly, from
reed@netbsd.org
o allow -I option to be useful in non-inetd mode as well
changes in bozohttpd 20100920:
o properly fully disable multi-file mode for now
o fix the -t and -U options when used without the -e option, broken since
the library-ifcation
o be explicit that logs go to the FTP facility in syslog
o use scandir() with alphasort() for sorted directory lists, from moof
o fix a serious error in vhost handling; "Host:.." would allow access to
the next level directory from the virtual root directory, from seanb
o fix some various non standard compile time errors, from rudolf
o fix dynamic CGI content maps, from rudolf
changes in bozohttpd 20100617:
o fix some compile issues
o fix SSL mode. from rtr
o fix some cgi-bin issues, as seen with cvsweb
o disable multi-file daemon mode for now, it breaks
o return 404's instead of 403's when chdir of ~user dirs fail
o remove "noreturn" attribute from bozo_http_error() that was
causing incorrect runtime behaviour
changes in bozohttpd 20100509:
o major rework and clean up of internal interfaces. move the main
program into main.c, the remaining parts are useable as library.
add bindings for lua. by Alistair G. Crooks <agc@netbsd.org>
o fix http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=566325
changes in bozohttpd 20090522:
o avoid dying in daemon mode for some uncommon, but recoverable, errors
o close leaking file descriptors for CGI and daemon mode
o handle poll errors properly
o don't try to handle more than one request per process yet
o add subdirs for build "debug" and "small" versions
o clean up a bad merge / duplicate code
o make mmap() usage portable, fixes linux & ranges: support
o document the -f option
o daemon mode now serves 6 files per child
changes in bozohttpd 20090417:
o make bozohttpd internally more modular, preparing the way
to handle more than one request per process
o fix http-auth, set $REMOTE_USER not $REMOTEUSER. also fix
cgi-bin with cvsweb, from Holger Weiss <holger@CIS.FU-Berlin.DE>
o fix an uninitialised variable use in daemon mode
o fix ssl mode with newer OpenSSL
o mmap large files in manageable sizes so we can serve any size file
o refactor url processing to handle query strings correctly for CGI
from Sergey Katsev at Coyote Point
o add If-Modified-Since support, from Joerg Sonnenberger
<joerg@netbsd.org>
o many more manual fixes, from NetBSD
|
| 1.7.8.3 |
| 24-Feb-2009 |
snj | branches: 1.7.8.3.6; 1.7.8.3.10;
Pull up following revision(s) (requested by tls in ticket #480):
libexec/httpd/cgi-bozo.c: revision 1.10
More CGI handling fixes from Sergey Katsev at Coyote Point.
1) Fix an issue where because of the reordering of transform_request
and process_cgi, the cgi-script name was being cut off
by one character (transform_request for some reason
cuts off the leading '/' for the file name as part of its
processing). As an 'easy' fix, simply re-add the '/' to the
front of the filename, which means that we don't have to
mess with the logic that sometimes adds +1 and sometimes doesn't.
2) Work around ridiculous bug in PHP reported by lukem in 2004,
but stubbornly never fixed by the PHP maintainers:
Change the SCRIPT_NAME and SCRIPT_FILENAME variables
to contain the file name only, not the query if one exists.
Having the query in SCRIPT_FILENAME causes php-cgi to not
work, as per the bug information here:
http://bugs.php.net/bug.php?id=28227
3) Fix a memory leak because URL wasn't being freed.
|
| 1.7.8.2 |
| 08-Feb-2009 |
snj | Pull up following revision(s) (requested by tls in ticket #428):
libexec/httpd/bozohttpd.c: revision 1.9
libexec/httpd/bozohttpd.h: revision 1.6
libexec/httpd/cgi-bozo.c: revision 1.9
libexec/httpd/dir-index-bozo.c: revision 1.5
libexec/httpd/tilde-luzah-bozo.c: revision 1.4
From Sergey Katsev at Coyote Point: fix bugs in request transformation and
CGI handling, including bin/40355 . There are two main changes here:
1) call process_cgi() after transform_request(), not before. Now it is
possible to have a default cgi handler catch a request for a path that
was produced by transformation, e.g. by index generation -- so now the
index can be "generated" by a CGI if that is what the user desires.
2) More clearly distinguish "file" from "query" portions of the request
URL, so we do not feed ?-suffixed "arguments" to plain files, fail to
match filename extensions due to ?-suffixes, etc.
After this change, there are only two cases which use the "query"
portion of the request (the portion after the ?):
a) A redirect issued by HTTPD will redirect to the new file, but
with the same query string.
b) process_cgi() will, of course continue to use the query string.
|
| 1.7.8.1 |
| 23-Nov-2008 |
riz | Pull up following revision(s) (requested by mrg in ticket #115):
libexec/httpd/cgi-bozo.c: revision 1.8
pull across the fix from my master bozohttpd cvs tree for PR 38466.
|
| 1.7.8.3.10.1 |
| 09-Jul-2014 |
msaitoh | Pull up following revision(s) (requested by mrg in ticket #1913):
libexec/httpd/CHANGES 1.3-1.18
libexec/httpd/Makefile 1.8-1.22 via patch
libexec/httpd/Makefile.boot 1.3-1.6
libexec/httpd/auth-bozo.c 1.5-1.13
libexec/httpd/bozohttpd.8 1.6-1.46
libexec/httpd/bozohttpd.c 1.8,1.12-1.54
libexec/httpd/bozohttpd.h 1.8-1.32
libexec/httpd/cgi-bozo.c 1.11-1.25
libexec/httpd/content-bozo.c 1.4-1.10
libexec/httpd/daemon-bozo.c 1.5-1.16
libexec/httpd/dir-index-bozo.c 1.6-1.19
libexec/httpd/ssl-bozo.c 1.5-1.16
libexec/httpd/tilde-luzah-bozo.c 1.5-1.10
libexec/httpd/lua-bozo.c 1.1-1.9
libexec/httpd/main.c 1.1-1.7
libexec/httpd/netbsd_queue.h 1.1
libexec/httpd/printenv.lua 1.1-1.2
libexec/httpd/debug/Makefile 1.1
libexec/httpd/libbozohttpd/Makefile 1.2
libexec/httpd/libbozohttpd/libbozohttpd.3 1.3
libexec/httpd/libbozohttpd/shlib_version 1.1
libexec/httpd/lua/Makefile 1.1
libexec/httpd/lua/bozo.lua 1.1
libexec/httpd/lua/glue.c 1.1
libexec/httpd/lua/optparse.lua 1.1
libexec/httpd/lua/shlib_version 1.1
libexec/httpd/small/Makefile 1.1-1.2
libexec/httpd/testsuite/Makefile 1.4
libexec/httpd/testsuite/html_cmp 1.4
libexec/httpd/testsuite/t1.in 1.3
libexec/httpd/testsuite/t1.out 1.3
libexec/httpd/testsuite/t10.in 1.1
libexec/httpd/testsuite/t10.out 1.1
libexec/httpd/testsuite/t2.in 1.3
libexec/httpd/testsuite/t2.out 1.3
libexec/httpd/testsuite/t3.in 1.3
libexec/httpd/testsuite/t3.out 1.3
libexec/httpd/testsuite/t4.in 1.3
libexec/httpd/testsuite/t4.out 1.3
libexec/httpd/testsuite/t5.in 1.3
libexec/httpd/testsuite/t5.out 1.3
libexec/httpd/testsuite/t6.in 1.3
libexec/httpd/testsuite/t6.out 1.3
libexec/httpd/testsuite/t7.in 1.3
libexec/httpd/testsuite/t7.out 1.3
libexec/httpd/testsuite/t8.in 1.3
libexec/httpd/testsuite/t8.out 1.3
libexec/httpd/testsuite/t9.in 1.3
libexec/httpd/testsuite/t9.out 1.3
libexec/httpd/testsuite/test-bigfile 1.1
libexec/httpd/testsuite/data/bigfile 1.1
libexec/httpd/testsuite/data/bigfile.partial4000 1.1
libexec/httpd/testsuite/data/bigfile.partial8000 1.1
libexec/httpd/testsuite/data/file 1.3
libexec/httpd/testsuite/data/index.html 1.3
Update bozohttpd from 20080303+patches to 20140708.
changes in bozohttpd 20140708:
o fixes for virtual host support, from rajeev_v_pillai@yahoo.com
o avoid printing double errors, from shm@netbsd.org
o fix a security issue in basic HTTP authentication which would allow
authentication to be bypassed, from shm@netbsd.org
changes in bozohttpd 20140201:
o support .svg files
o fix a core dump when requests timeout
changes in bozohttpd 20140102:
o update a few content types
o add support for directly calling lua scripts to handle
processes, from mbalmer@netbsd.org
o properly escape generated HTML
o add authentication for redirections, from martin@netbsd.org
o handle chained ssl certifications, from elric@netbsd.org
o add basic support for gzipped files, from elric@netbsd.org
o properly escape generated URIs
changes in bozohttpd 20111118:
o add -P <pidfile> option, from jmmv@netbsd.org
o avoid crashes with http basic auth, from pooka@netbsd.org
o add support for REDIRECT_STATUS variable, from tls@netbsd.org
o support .mp4 files in the default map
o directory indexes with files with : are now displayed properly, from
reed@netbsd.org
o allow -I option to be useful in non-inetd mode as well
changes in bozohttpd 20100920:
o properly fully disable multi-file mode for now
o fix the -t and -U options when used without the -e option, broken since
the library-ifcation
o be explicit that logs go to the FTP facility in syslog
o use scandir() with alphasort() for sorted directory lists, from moof
o fix a serious error in vhost handling; "Host:.." would allow access to
the next level directory from the virtual root directory, from seanb
o fix some various non standard compile time errors, from rudolf
o fix dynamic CGI content maps, from rudolf
changes in bozohttpd 20100617:
o fix some compile issues
o fix SSL mode. from rtr
o fix some cgi-bin issues, as seen with cvsweb
o disable multi-file daemon mode for now, it breaks
o return 404's instead of 403's when chdir of ~user dirs fail
o remove "noreturn" attribute from bozo_http_error() that was
causing incorrect runtime behaviour
changes in bozohttpd 20100509:
o major rework and clean up of internal interfaces. move the main
program into main.c, the remaining parts are useable as library.
add bindings for lua. by Alistair G. Crooks <agc@netbsd.org>
o fix http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=566325
changes in bozohttpd 20090522:
o avoid dying in daemon mode for some uncommon, but recoverable, errors
o close leaking file descriptors for CGI and daemon mode
o handle poll errors properly
o don't try to handle more than one request per process yet
o add subdirs for build "debug" and "small" versions
o clean up a bad merge / duplicate code
o make mmap() usage portable, fixes linux & ranges: support
o document the -f option
o daemon mode now serves 6 files per child
changes in bozohttpd 20090417:
o make bozohttpd internally more modular, preparing the way
to handle more than one request per process
o fix http-auth, set $REMOTE_USER not $REMOTEUSER. also fix
cgi-bin with cvsweb, from Holger Weiss <holger@CIS.FU-Berlin.DE>
o fix an uninitialised variable use in daemon mode
o fix ssl mode with newer OpenSSL
o mmap large files in manageable sizes so we can serve any size file
o refactor url processing to handle query strings correctly for CGI
from Sergey Katsev at Coyote Point
o add If-Modified-Since support, from Joerg Sonnenberger
<joerg@netbsd.org>
o many more manual fixes, from NetBSD
|
| 1.7.8.3.6.1 |
| 09-Jul-2014 |
msaitoh | Pull up following revision(s) (requested by mrg in ticket #1913):
libexec/httpd/CHANGES 1.3-1.18
libexec/httpd/Makefile 1.8-1.22 via patch
libexec/httpd/Makefile.boot 1.3-1.6
libexec/httpd/auth-bozo.c 1.5-1.13
libexec/httpd/bozohttpd.8 1.6-1.46
libexec/httpd/bozohttpd.c 1.8,1.12-1.54
libexec/httpd/bozohttpd.h 1.8-1.32
libexec/httpd/cgi-bozo.c 1.11-1.25
libexec/httpd/content-bozo.c 1.4-1.10
libexec/httpd/daemon-bozo.c 1.5-1.16
libexec/httpd/dir-index-bozo.c 1.6-1.19
libexec/httpd/ssl-bozo.c 1.5-1.16
libexec/httpd/tilde-luzah-bozo.c 1.5-1.10
libexec/httpd/lua-bozo.c 1.1-1.9
libexec/httpd/main.c 1.1-1.7
libexec/httpd/netbsd_queue.h 1.1
libexec/httpd/printenv.lua 1.1-1.2
libexec/httpd/debug/Makefile 1.1
libexec/httpd/libbozohttpd/Makefile 1.2
libexec/httpd/libbozohttpd/libbozohttpd.3 1.3
libexec/httpd/libbozohttpd/shlib_version 1.1
libexec/httpd/lua/Makefile 1.1
libexec/httpd/lua/bozo.lua 1.1
libexec/httpd/lua/glue.c 1.1
libexec/httpd/lua/optparse.lua 1.1
libexec/httpd/lua/shlib_version 1.1
libexec/httpd/small/Makefile 1.1-1.2
libexec/httpd/testsuite/Makefile 1.4
libexec/httpd/testsuite/html_cmp 1.4
libexec/httpd/testsuite/t1.in 1.3
libexec/httpd/testsuite/t1.out 1.3
libexec/httpd/testsuite/t10.in 1.1
libexec/httpd/testsuite/t10.out 1.1
libexec/httpd/testsuite/t2.in 1.3
libexec/httpd/testsuite/t2.out 1.3
libexec/httpd/testsuite/t3.in 1.3
libexec/httpd/testsuite/t3.out 1.3
libexec/httpd/testsuite/t4.in 1.3
libexec/httpd/testsuite/t4.out 1.3
libexec/httpd/testsuite/t5.in 1.3
libexec/httpd/testsuite/t5.out 1.3
libexec/httpd/testsuite/t6.in 1.3
libexec/httpd/testsuite/t6.out 1.3
libexec/httpd/testsuite/t7.in 1.3
libexec/httpd/testsuite/t7.out 1.3
libexec/httpd/testsuite/t8.in 1.3
libexec/httpd/testsuite/t8.out 1.3
libexec/httpd/testsuite/t9.in 1.3
libexec/httpd/testsuite/t9.out 1.3
libexec/httpd/testsuite/test-bigfile 1.1
libexec/httpd/testsuite/data/bigfile 1.1
libexec/httpd/testsuite/data/bigfile.partial4000 1.1
libexec/httpd/testsuite/data/bigfile.partial8000 1.1
libexec/httpd/testsuite/data/file 1.3
libexec/httpd/testsuite/data/index.html 1.3
Update bozohttpd from 20080303+patches to 20140708.
changes in bozohttpd 20140708:
o fixes for virtual host support, from rajeev_v_pillai@yahoo.com
o avoid printing double errors, from shm@netbsd.org
o fix a security issue in basic HTTP authentication which would allow
authentication to be bypassed, from shm@netbsd.org
changes in bozohttpd 20140201:
o support .svg files
o fix a core dump when requests timeout
changes in bozohttpd 20140102:
o update a few content types
o add support for directly calling lua scripts to handle
processes, from mbalmer@netbsd.org
o properly escape generated HTML
o add authentication for redirections, from martin@netbsd.org
o handle chained ssl certifications, from elric@netbsd.org
o add basic support for gzipped files, from elric@netbsd.org
o properly escape generated URIs
changes in bozohttpd 20111118:
o add -P <pidfile> option, from jmmv@netbsd.org
o avoid crashes with http basic auth, from pooka@netbsd.org
o add support for REDIRECT_STATUS variable, from tls@netbsd.org
o support .mp4 files in the default map
o directory indexes with files with : are now displayed properly, from
reed@netbsd.org
o allow -I option to be useful in non-inetd mode as well
changes in bozohttpd 20100920:
o properly fully disable multi-file mode for now
o fix the -t and -U options when used without the -e option, broken since
the library-ifcation
o be explicit that logs go to the FTP facility in syslog
o use scandir() with alphasort() for sorted directory lists, from moof
o fix a serious error in vhost handling; "Host:.." would allow access to
the next level directory from the virtual root directory, from seanb
o fix some various non standard compile time errors, from rudolf
o fix dynamic CGI content maps, from rudolf
changes in bozohttpd 20100617:
o fix some compile issues
o fix SSL mode. from rtr
o fix some cgi-bin issues, as seen with cvsweb
o disable multi-file daemon mode for now, it breaks
o return 404's instead of 403's when chdir of ~user dirs fail
o remove "noreturn" attribute from bozo_http_error() that was
causing incorrect runtime behaviour
changes in bozohttpd 20100509:
o major rework and clean up of internal interfaces. move the main
program into main.c, the remaining parts are useable as library.
add bindings for lua. by Alistair G. Crooks <agc@netbsd.org>
o fix http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=566325
changes in bozohttpd 20090522:
o avoid dying in daemon mode for some uncommon, but recoverable, errors
o close leaking file descriptors for CGI and daemon mode
o handle poll errors properly
o don't try to handle more than one request per process yet
o add subdirs for build "debug" and "small" versions
o clean up a bad merge / duplicate code
o make mmap() usage portable, fixes linux & ranges: support
o document the -f option
o daemon mode now serves 6 files per child
changes in bozohttpd 20090417:
o make bozohttpd internally more modular, preparing the way
to handle more than one request per process
o fix http-auth, set $REMOTE_USER not $REMOTEUSER. also fix
cgi-bin with cvsweb, from Holger Weiss <holger@CIS.FU-Berlin.DE>
o fix an uninitialised variable use in daemon mode
o fix ssl mode with newer OpenSSL
o mmap large files in manageable sizes so we can serve any size file
o refactor url processing to handle query strings correctly for CGI
from Sergey Katsev at Coyote Point
o add If-Modified-Since support, from Joerg Sonnenberger
<joerg@netbsd.org>
o many more manual fixes, from NetBSD
|
| 1.9.2.1 |
| 13-May-2009 |
jym | Sync with HEAD.
Third (and last) commit. See http://mail-index.netbsd.org/source-changes/2009/05/13/msg221222.html
|
| 1.19.6.2 |
| 22-May-2014 |
yamt | sync with head.
for a reference, the tree before this commit was tagged
as yamt-pagecache-tag8.
this commit was splitted into small chunks to avoid
a limitation of cvs. ("Protocol error: too many arguments")
|
| 1.19.6.1 |
| 17-Apr-2012 |
yamt | sync with head
|
| 1.20.14.4 |
| 07-Mar-2017 |
snj | Pull up following revision(s) (requested by mrg in ticket #1437:
libexec/httpd/CHANGES: up to 1.25
libexec/httpd/bozohttpd.8: up to 1.65
libexec/httpd/bozohttpd.c: up to 1.86
libexec/httpd/bozohttpd.h: up to 1.47
libexec/httpd/cgi-bozo.c: up to 1.37
libexec/httpd/content-bozo.c: up to 1.14
libexec/httpd/libbozohttpd/libbozohttpd.3: up to 1.4
libexec/httpd/main.c: up to 1.16
libexec/httpd/small/Makefile: up to 1.3
libexec/httpd/testsuite/Makefile: up to 1.7
libexec/httpd/testsuite/cgi-bin/empty: up to 1.1
libexec/httpd/testsuite/html_cmp: up to 1.5
libexec/httpd/testsuite/t11.in: up to 1.1
libexec/httpd/testsuite/t11.out: up to 1.1
libexec/httpd/testsuite/test-bigfile: up to 1.4
libexec/httpd/testsuite/test-simple: up to 1.4
Update bozohttpd to 20170201. Changes:
- fix an infinite loop in cgi processing
- fixes and clean up for the testsuite
- no longer sends encoding header for compressed formats
- add a bozo_get_version() function which returns the version number
|
| 1.20.14.3 |
| 15-Apr-2016 |
mrg | Pull up following revision(s) (requested by mrg in ticket #1377):
libexec/httpd/cgi-bozo.c 1.34
use %zu instead of %lu for size_t.
(ok snj@)
|
| 1.20.14.2 |
| 15-Apr-2016 |
snj | Pull up following revision(s) (requested by mrg in ticket #1377):
libexec/httpd/CHANGES: up to 1.22
libexec/httpd/Makefile: up to 1.26 via patch
libexec/httpd/auth-bozo.c: up to 1.18
libexec/httpd/bozohttpd.8: up to 1.59
libexec/httpd/bozohttpd.c: up to 1.80 via patch
libexec/httpd/bozohttpd.h: up to 1.45
libexec/httpd/cgi-bozo.c: up to 1.33
libexec/httpd/content-bozo.c: up to 1.13
libexec/httpd/daemon-bozo.c: up to 1.17
libexec/httpd/dir-index-bozo.c: up to 1.25
libexec/httpd/lua-bozo.c: up to 1.14
libexec/httpd/lua/bozo.lua: up to 1.2
libexec/httpd/lua/glue.c: up to 1.2
libexec/httpd/main.c: up to 1.13
libexec/httpd/printenv.lua: up to 1.3
libexec/httpd/ssl-bozo.c: up to 1.22
libexec/httpd/testsuite/Makefile: up to 1.5
libexec/httpd/testsuite/t10.out: up to 1.2
libexec/httpd/testsuite/test-bigfile: up to 1.2
libexec/httpd/tilde-luzah-bozo.c: up to 1.14
Import bozohttpd 20151028:
o add CGI support for ~user translation (-E switch)
o add redirects to ~user translation
o fix bugs around ~user translation
o add schema detection for absolute redirects
o fixed few memory leaks
o bunch of minor tweaks
o removed -r support
o smarter redirects
--
Changes in 20150320:
o fix redirection handling
o support transport stream (.ts) and video object (.vob) files
o directory listings show correct file sizes for large files
--
updates and bozohttpd 20160415:
o add search-word support for CGI
o fix a security issue in CGI suffix handler support which would
allow remote code execution, from shm@netbsd.org
o -C option supports now CGI scripts only
|
| 1.20.14.1 |
| 09-Jul-2014 |
msaitoh | Pull up following revision(s) (requested by mrg in ticket #1095):
libexec/httpd/CHANGES 1.12-1.18
libexec/httpd/Makefile 1.13-1.22
libexec/httpd/Makefile.boot 1.6
libexec/httpd/auth-bozo.c 1.11-1.13
libexec/httpd/bozohttpd.8 1.33-1.46
libexec/httpd/bozohttpd.c 1.31-1.54
libexec/httpd/bozohttpd.h 1.21-1.32
libexec/httpd/cgi-bozo.c 1.21-1.25
libexec/httpd/content-bozo.c 1.8-1.10
libexec/httpd/daemon-bozo.c 1.16-1.16
libexec/httpd/dir-index-bozo.c 1.15-1.19
libexec/httpd/lua-bozo.c 1.1-1.9
libexec/httpd/main.c 1.6-1.7
libexec/httpd/netbsd_queue.h 1.1
libexec/httpd/printenv.lua 1.1-1.2
libexec/httpd/ssl-bozo.c 1.14-1.16
libexec/httpd/tilde-luzah-bozo.c 1.10
libexec/httpd/libbozohttpd/Makefile 1.2
libexec/httpd/libbozohttpd/libbozohttpd.3 1.2-1.3
libexec/httpd/small/Makefile 1.2
Update bozohttpd from 20111118 to 20140708.
changes in bozohttpd 20140708:
o fixes for virtual host support, from rajeev_v_pillai@yahoo.com
o avoid printing double errors, from shm@netbsd.org
o fix a security issue in basic HTTP authentication which would allow
authentication to be bypassed, from shm@netbsd.org
changes in bozohttpd 20140201:
o support .svg files
o fix a core dump when requests timeout
changes in bozohttpd 20140102:
o update a few content types
o add support for directly calling lua scripts to handle
processes, from mbalmer@netbsd.org
o properly escape generated HTML
o add authentication for redirections, from martin@netbsd.org
o handle chained ssl certifications, from elric@netbsd.org
o add basic support for gzipped files, from elric@netbsd.org
o properly escape generated URIs
|
| 1.20.8.4 |
| 07-Mar-2017 |
snj | Pull up following revision(s) (requested by mrg in ticket #1437):
libexec/httpd/CHANGES: up to 1.25
libexec/httpd/bozohttpd.8: up to 1.65
libexec/httpd/bozohttpd.c: up to 1.86
libexec/httpd/bozohttpd.h: up to 1.47
libexec/httpd/cgi-bozo.c: up to 1.37
libexec/httpd/content-bozo.c: up to 1.14
libexec/httpd/libbozohttpd/libbozohttpd.3: up to 1.4
libexec/httpd/main.c: up to 1.16
libexec/httpd/small/Makefile: up to 1.3
libexec/httpd/testsuite/Makefile: up to 1.7
libexec/httpd/testsuite/cgi-bin/empty: up to 1.1
libexec/httpd/testsuite/html_cmp: up to 1.5
libexec/httpd/testsuite/t11.in: up to 1.1
libexec/httpd/testsuite/t11.out: up to 1.1
libexec/httpd/testsuite/test-bigfile: up to 1.4
libexec/httpd/testsuite/test-simple: up to 1.4
Update bozohttpd to 20170201. Changes:
- fix an infinite loop in cgi processing
- fixes and clean up for the testsuite
- no longer sends encoding header for compressed formats
- add a bozo_get_version() function which returns the version number
|
| 1.20.8.3 |
| 15-Apr-2016 |
mrg | Pull up following revision(s) (requested by mrg in ticket #1377):
libexec/httpd/cgi-bozo.c 1.34
use %zu instead of %lu for size_t.
(ok snj@)
|
| 1.20.8.2 |
| 15-Apr-2016 |
snj | Pull up following revision(s) (requested by mrg in ticket #1377):
libexec/httpd/CHANGES: up to 1.22
libexec/httpd/Makefile: up to 1.26 via patch
libexec/httpd/auth-bozo.c: up to 1.18
libexec/httpd/bozohttpd.8: up to 1.59
libexec/httpd/bozohttpd.c: up to 1.80 via patch
libexec/httpd/bozohttpd.h: up to 1.45
libexec/httpd/cgi-bozo.c: up to 1.33
libexec/httpd/content-bozo.c: up to 1.13
libexec/httpd/daemon-bozo.c: up to 1.17
libexec/httpd/dir-index-bozo.c: up to 1.25
libexec/httpd/lua-bozo.c: up to 1.14
libexec/httpd/lua/bozo.lua: up to 1.2
libexec/httpd/lua/glue.c: up to 1.2
libexec/httpd/main.c: up to 1.13
libexec/httpd/printenv.lua: up to 1.3
libexec/httpd/ssl-bozo.c: up to 1.22
libexec/httpd/testsuite/Makefile: up to 1.5
libexec/httpd/testsuite/t10.out: up to 1.2
libexec/httpd/testsuite/test-bigfile: up to 1.2
libexec/httpd/tilde-luzah-bozo.c: up to 1.14
Import bozohttpd 20151028:
o add CGI support for ~user translation (-E switch)
o add redirects to ~user translation
o fix bugs around ~user translation
o add schema detection for absolute redirects
o fixed few memory leaks
o bunch of minor tweaks
o removed -r support
o smarter redirects
--
Changes in 20150320:
o fix redirection handling
o support transport stream (.ts) and video object (.vob) files
o directory listings show correct file sizes for large files
--
updates and bozohttpd 20160415:
o add search-word support for CGI
o fix a security issue in CGI suffix handler support which would
allow remote code execution, from shm@netbsd.org
o -C option supports now CGI scripts only
|
| 1.20.8.1 |
| 09-Jul-2014 |
msaitoh | Pull up following revision(s) (requested by mrg in ticket #1095):
libexec/httpd/CHANGES 1.12-1.18
libexec/httpd/Makefile 1.13-1.22
libexec/httpd/Makefile.boot 1.6
libexec/httpd/auth-bozo.c 1.11-1.13
libexec/httpd/bozohttpd.8 1.33-1.46
libexec/httpd/bozohttpd.c 1.31-1.54
libexec/httpd/bozohttpd.h 1.21-1.32
libexec/httpd/cgi-bozo.c 1.21-1.25
libexec/httpd/content-bozo.c 1.8-1.10
libexec/httpd/daemon-bozo.c 1.16-1.16
libexec/httpd/dir-index-bozo.c 1.15-1.19
libexec/httpd/lua-bozo.c 1.1-1.9
libexec/httpd/main.c 1.6-1.7
libexec/httpd/netbsd_queue.h 1.1
libexec/httpd/printenv.lua 1.1-1.2
libexec/httpd/ssl-bozo.c 1.14-1.16
libexec/httpd/tilde-luzah-bozo.c 1.10
libexec/httpd/libbozohttpd/Makefile 1.2
libexec/httpd/libbozohttpd/libbozohttpd.3 1.2-1.3
libexec/httpd/small/Makefile 1.2
Update bozohttpd from 20111118 to 20140708.
changes in bozohttpd 20140708:
o fixes for virtual host support, from rajeev_v_pillai@yahoo.com
o avoid printing double errors, from shm@netbsd.org
o fix a security issue in basic HTTP authentication which would allow
authentication to be bypassed, from shm@netbsd.org
changes in bozohttpd 20140201:
o support .svg files
o fix a core dump when requests timeout
changes in bozohttpd 20140102:
o update a few content types
o add support for directly calling lua scripts to handle
processes, from mbalmer@netbsd.org
o properly escape generated HTML
o add authentication for redirections, from martin@netbsd.org
o handle chained ssl certifications, from elric@netbsd.org
o add basic support for gzipped files, from elric@netbsd.org
o properly escape generated URIs
|
| 1.20.6.1 |
| 20-Aug-2014 |
tls | Rebase to HEAD as of a few days ago.
|
| 1.20.2.4 |
| 07-Mar-2017 |
snj | Pull up following revision(s) (requested by mrg in ticket #1437):
libexec/httpd/CHANGES: up to 1.25
libexec/httpd/bozohttpd.8: up to 1.65
libexec/httpd/bozohttpd.c: up to 1.86
libexec/httpd/bozohttpd.h: up to 1.47
libexec/httpd/cgi-bozo.c: up to 1.37
libexec/httpd/content-bozo.c: up to 1.14
libexec/httpd/libbozohttpd/libbozohttpd.3: up to 1.4
libexec/httpd/main.c: up to 1.16
libexec/httpd/small/Makefile: up to 1.3
libexec/httpd/testsuite/Makefile: up to 1.7
libexec/httpd/testsuite/cgi-bin/empty: up to 1.1
libexec/httpd/testsuite/html_cmp: up to 1.5
libexec/httpd/testsuite/t11.in: up to 1.1
libexec/httpd/testsuite/t11.out: up to 1.1
libexec/httpd/testsuite/test-bigfile: up to 1.4
libexec/httpd/testsuite/test-simple: up to 1.4
Update bozohttpd to 20170201. Changes:
- fix an infinite loop in cgi processing
- fixes and clean up for the testsuite
- no longer sends encoding header for compressed formats
- add a bozo_get_version() function which returns the version number
|
| 1.20.2.3 |
| 15-Apr-2016 |
mrg | Pull up following revision(s) (requested by mrg in ticket #1377):
libexec/httpd/cgi-bozo.c 1.34
use %zu instead of %lu for size_t.
(ok snj@)
|
| 1.20.2.2 |
| 15-Apr-2016 |
snj | Pull up following revision(s) (requested by mrg in ticket #1377):
libexec/httpd/CHANGES: up to 1.22
libexec/httpd/Makefile: up to 1.26 via patch
libexec/httpd/auth-bozo.c: up to 1.18
libexec/httpd/bozohttpd.8: up to 1.59
libexec/httpd/bozohttpd.c: up to 1.80 via patch
libexec/httpd/bozohttpd.h: up to 1.45
libexec/httpd/cgi-bozo.c: up to 1.33
libexec/httpd/content-bozo.c: up to 1.13
libexec/httpd/daemon-bozo.c: up to 1.17
libexec/httpd/dir-index-bozo.c: up to 1.25
libexec/httpd/lua-bozo.c: up to 1.14
libexec/httpd/lua/bozo.lua: up to 1.2
libexec/httpd/lua/glue.c: up to 1.2
libexec/httpd/main.c: up to 1.13
libexec/httpd/printenv.lua: up to 1.3
libexec/httpd/ssl-bozo.c: up to 1.22
libexec/httpd/testsuite/Makefile: up to 1.5
libexec/httpd/testsuite/t10.out: up to 1.2
libexec/httpd/testsuite/test-bigfile: up to 1.2
libexec/httpd/tilde-luzah-bozo.c: up to 1.14
Import bozohttpd 20151028:
o add CGI support for ~user translation (-E switch)
o add redirects to ~user translation
o fix bugs around ~user translation
o add schema detection for absolute redirects
o fixed few memory leaks
o bunch of minor tweaks
o removed -r support
o smarter redirects
--
Changes in 20150320:
o fix redirection handling
o support transport stream (.ts) and video object (.vob) files
o directory listings show correct file sizes for large files
--
updates and bozohttpd 20160415:
o add search-word support for CGI
o fix a security issue in CGI suffix handler support which would
allow remote code execution, from shm@netbsd.org
o -C option supports now CGI scripts only
|
| 1.20.2.1 |
| 09-Jul-2014 |
msaitoh | Pull up following revision(s) (requested by mrg in ticket #1095):
libexec/httpd/CHANGES 1.12-1.18
libexec/httpd/Makefile 1.13-1.22
libexec/httpd/Makefile.boot 1.6
libexec/httpd/auth-bozo.c 1.11-1.13
libexec/httpd/bozohttpd.8 1.33-1.46
libexec/httpd/bozohttpd.c 1.31-1.54
libexec/httpd/bozohttpd.h 1.21-1.32
libexec/httpd/cgi-bozo.c 1.21-1.25
libexec/httpd/content-bozo.c 1.8-1.10
libexec/httpd/daemon-bozo.c 1.16-1.16
libexec/httpd/dir-index-bozo.c 1.15-1.19
libexec/httpd/lua-bozo.c 1.1-1.9
libexec/httpd/main.c 1.6-1.7
libexec/httpd/netbsd_queue.h 1.1
libexec/httpd/printenv.lua 1.1-1.2
libexec/httpd/ssl-bozo.c 1.14-1.16
libexec/httpd/tilde-luzah-bozo.c 1.10
libexec/httpd/libbozohttpd/Makefile 1.2
libexec/httpd/libbozohttpd/libbozohttpd.3 1.2-1.3
libexec/httpd/small/Makefile 1.2
Update bozohttpd from 20111118 to 20140708.
changes in bozohttpd 20140708:
o fixes for virtual host support, from rajeev_v_pillai@yahoo.com
o avoid printing double errors, from shm@netbsd.org
o fix a security issue in basic HTTP authentication which would allow
authentication to be bypassed, from shm@netbsd.org
changes in bozohttpd 20140201:
o support .svg files
o fix a core dump when requests timeout
changes in bozohttpd 20140102:
o update a few content types
o add support for directly calling lua scripts to handle
processes, from mbalmer@netbsd.org
o properly escape generated HTML
o add authentication for redirections, from martin@netbsd.org
o handle chained ssl certifications, from elric@netbsd.org
o add basic support for gzipped files, from elric@netbsd.org
o properly escape generated URIs
|
| 1.24.2.1 |
| 10-Aug-2014 |
tls | Rebase.
|
| 1.25.2.11 |
| 15-Jun-2019 |
martin | Pull up the following revisions (via patch) requested by mrg in ticket #1699:
libexec/httpd/CHANGES 1.31-1.40
libexec/httpd/Makefile 1.28
libexec/httpd/auth-bozo.c 1.23-1.24
libexec/httpd/bozohttpd.8 1.75-1.79
libexec/httpd/bozohttpd.c 1.100-1.113
libexec/httpd/bozohttpd.h 1.58-1.60
libexec/httpd/cgi-bozo.c 1.46-1.48
libexec/httpd/daemon-bozo.c 1.20-1.21
libexec/httpd/dir-index-bozo.c 1.29-1.32
libexec/httpd/ssl-bozo.c 1.26
libexec/httpd/testsuite/Makefile 1.12-1.13
libexec/httpd/testsuite/t11.out 1.2
libexec/httpd/testsuite/test-bigfile 1.6
libexec/httpd/testsuite/test-simple 1.6
Don't display special files in the directory index. They aren't
served, but links to them are generated.
---
All from "Rajeev V. Pillai" <rajeev_v_pillai@yahoo.com>:
- use html tables for directory index.
- don't include "index.html" in html headers
- additional escaping of names
- re-add top/bottom borders
- adds an aquamarine table header
- Zebra-stripes table rows using CSS instead of code
- fix CGI '+' param and error handling.
- remove unused parameter to daemon_poll_err().
- avoid sign extension in % handling
fix a few problems pointed out by clang static analyzer:
- bozostrnsep() may return with "in = NULL", so check for it.
- nul terminating in bozo_escape_rfc3986() can be simpler
- don't use uniinit variables in check_remap()
- don't use re-used freed data in check_virtual().
- fix bozoprefs->size setting when increasing the size (new total was
being added to the prior total.)
however, bozostrdup() may reference request->hr_file.
---
Add ssl specific timeout value (30s). If SSL_accept() doesn't
work with in this timeout value, ssl setup now fails.
---
Fix handling of bozo_set_timeout() timeouts (and `-T' option parsing)
---
Avoid .htpasswd exposure to authenticated users when .htpasswd is
in the slashdir too.
---
Avoid possible NULL dereference when sending a big request that timeout.
---
Use strings.h for strcasecmp (on linux)
---
Account for cgihandler being set when counting the number of CGI environment
headers we are about to set. Avoids an assertion failure (and overruninng
the array) later.
|
| 1.25.2.10 |
| 28-Nov-2018 |
martin | Pull up following revision(s) (requested by mrg in ticket #1659):
libexec/httpd/main.c: revision 1.22
libexec/httpd/CHANGES: revision 1.29
libexec/httpd/cgi-bozo.c: revision 1.45
libexec/httpd/bozohttpd.h: revision 1.57
libexec/httpd/CHANGES: revision 1.30
libexec/httpd/bozohttpd.c: revision 1.97
libexec/httpd/bozohttpd.c: revision 1.98
libexec/httpd/bozohttpd.c: revision 1.99
one semicolon is usually enough.
-
appease lint
- add FALLTHROUGH comment
- one return is usually enough.
-
avoid c99ism.
-
fix -X option parsing. noted by Rajeev V. Pillai.
-
add option fixes here.
-
normalise some messages.
|
| 1.25.2.9 |
| 24-Nov-2018 |
martin | Sync to HEAD (requested by mrg in ticket #1655):
libexec/httpd/testsuite/data/.bzremap up to 1.1
libexec/httpd/testsuite/t12.out up to 1.1
libexec/httpd/testsuite/t12.in up to 1.1
libexec/httpd/testsuite/t13.out up to 1.1
libexec/httpd/testsuite/t13.in up to 1.1
libexec/httpd/testsuite/t14.out up to 1.1
libexec/httpd/testsuite/t14.in up to 1.1
libexec/httpd/testsuite/t15.out up to 1.1
libexec/httpd/testsuite/t15.in up to 1.1
libexec/httpd/CHANGES up to 1.28
libexec/httpd/Makefile up to 1.27
libexec/httpd/auth-bozo.c up to 1.22
libexec/httpd/bozohttpd.8 up to 1.74
libexec/httpd/bozohttpd.c up to 1.96
libexec/httpd/bozohttpd.h up to 1.56
libexec/httpd/cgi-bozo.c up to 1.44
libexec/httpd/content-bozo.c up to 1.16
libexec/httpd/daemon-bozo.c up to 1.19
libexec/httpd/dir-index-bozo.c up to 1.28
libexec/httpd/lua-bozo.c up to 1.15
libexec/httpd/main.c up to 1.21
libexec/httpd/ssl-bozo.c up to 1.25
libexec/httpd/tilde-luzah-bozo.c up to 1.16
libexec/httpd/libbozohttpd/Makefile up to 1.3
libexec/httpd/lua/bozo.lua up to 1.3
libexec/httpd/lua/glue.c up to 1.5
libexec/httpd/lua/optparse.lua up to 1.2
libexec/httpd/testsuite/Makefile up to 1.11
libexec/httpd/testsuite/html_cmp up to 1.6
libexec/httpd/testsuite/t3.out up to 1.4
libexec/httpd/testsuite/t5.out up to 1.4
libexec/httpd/testsuite/t6.out up to 1.4
libexec/httpd/testsuite/test-bigfile up to 1.5
libexec/httpd/testsuite/test-simple up to 1.5
Cosmetic changes to Lua binding in bozohttpd.
- Don't use negative indicies to read arguments of Lua functions.
- On error, return nil, "error string".
- Use ssize_t for return values from bozo_read() and bozo_write().
- Prefer lstring especially when if saves you from appending NUL and
doing len + 1 which can potentially wraparound.
- Don't mix C allocations with Lua functions marked with "m" in the Lua
manual. Those functions may throw (longjump) and leak data allocated
by C function. In one case, I use luaL_Buffer, in the other case,
I rearranged calls a bit.
fix ordering of a couple of words. from Edgar Pettijohn in PR#52375.
thanks!
s/u_int/unsigned/.
from Jan Danielsson. increases/fixes portability.
PR bin/52194: bozohttpd fails to exec scripts via the -C mechanism
sometimes with EFAULT due to not NULL terminated environment.
Document script handler issues with httpd(8).
From martin@, addressing PR 52194.
While here, use American spelling consistently and upper-case some
abbreviations.
Bump date.
fix output since protocol agnostic change went in.
XXX: i thought someone hooked this into atf already, please do :)
Add support for remapping requested paths via a .bzredirect file.
Fixes PR 52772. Ok: mrg@
Bump date
Remove trailing whitespace.
use __func__ in debug().
fix a denial of service attack against header contents, which
is now bounded at 16KiB. reported by JP.
avoid memory leak in sending multiple auth headers.
mostly mitigated by previous patch to limit total header size,
but still a real problem here.
note the changes present in bozohttpd 20181118:
o add url remap support via .bzremap file, from martin%netbsd.org@localhost
o handle redirections for any protocol, not just http:
o fix a denial of service attack against header contents, which
is now bounded at 16KiB. reported by JP.
from CHANGES:
o reduce default timeouts, and add expand timeouts to handle the
initial line, each header, and the total time spent
o add -T option to expose new timeout settings
o minor RFC fixes related to timeout handling responses
old timeouts:
60 seconds for initial request like, 60 seconds per header line,
and no whole timeout (though the recent total header size changes
do introduce one that would be about 11 hours.)
new timeouts:
30 seconds for initial request like, 10 seconds per header line,
and a total request time of 600 seconds.
the new global timeout is implemented using CLOCK_MONOTONIC, with
a fallback to CLOCK_REALTIME if monotonic time is unavailable.
reject multiple Host: headers. besides being protocol standard,
this closes one additional memory leak found by JP. add a simple
test to check this.
clean up option and usage handling some.
move some #if support into bozohttpd.h.
fix previous: have_debug was reversed.
also fix have_dynamic_content from the previous previous. re-order
the debug and dynamic content to match the same pattern as everything
else so similar problems are less likely in the future.
- move special files defines into bozohttpd.h, so we can ...
- consolidate all the special file checks into
bozo_check_special_files() so that all builds check the same
list of special files, regardless of build options.
- convert "(void)bozo_http_error(...); return -1;" into plain
"return bozo_http_error(...);"
- fix the call to bozo_check_special_files() to be used on all
input types. part of the fixes for failure to reject access
to /.htpasswd as reported by JP on tech-security.
- use warn_unused_result attribute on bozo_check_special_files(),
and fix the failures to return failure. second part of the
htpasswd access fix.
- update testsuite to use a fixed fake hostname.
call this bozohttpd 20181121.
two fixes reported by mouse:
- don't check contents of 'st' if stat(2) failed.
- round up instead of truncate. now 10000 byte files say 10kB not 9kB.
use MAP_SHARED for the bzremap file. avoids netbsd kernel complaining:
WARNING: defaulted mmap() share type to MAP_PRIVATE (pid 15478 command bozohttpd)
many clean ups:
- keep a list of special files and their human names
- remove (void) casts on bozo_http_error()
- fix a few more misuses of bozo_http_error()
- rename check_mapping() to check_remap() and perform some CSE
- switch away from ``%s'' to '%s'
- remove a bunch of #ifdef using new have_feature defines
alpha sort the option switch.
add an assert() check on array bounds.
minor style fixes. simplify bozo_match_content_map().
|
| 1.25.2.8 |
| 03-Jan-2018 |
snj | Pull up following revision(s) (requested by martin in ticket #1533):
libexec/httpd/cgi-bozo.c: revision 1.39
PR bin/52194: bozohttpd fails to exec scripts via the -C mechanism
sometimes with EFAULT due to not NULL terminated environment.
|
| 1.25.2.7 |
| 12-Feb-2017 |
snj | branches: 1.25.2.7.2;
Pull up following revision(s) (requested by mrg in ticket #1357):
libexec/httpd/CHANGES: revision 1.25
libexec/httpd/bozohttpd.8: revisions 1.63-1.65
libexec/httpd/bozohttpd.c: revisions 1.85, 1.86
libexec/httpd/bozohttpd.h: revision 1.47
libexec/httpd/cgi-bozo.c: revisions 1.36, 1.37
libexec/httpd/libbozohttpd/libbozohttpd.3: revision 1.4
libexec/httpd/testsuite/Makefile: revision 1.7
libexec/httpd/testsuite/html_cmp: revision 1.5
libexec/httpd/testsuite/test-bigfile: revision 1.4
libexec/httpd/testsuite/test-simple: revisions 1.3, 1.4
libexec/httpd/testsuite/t11.in: revision 1.1
libexec/httpd/testsuite/t11.out: revision 1.1
libexec/httpd/testsuite/cgi-bin/empty: revision 1.1
Update bozohttpd to 20170201:
- fix an infinite loop in cgi processing
- fixes and clean up for the testsuite
- no longer sends encoding header for compressed formats
|
| 1.25.2.6 |
| 23-Dec-2016 |
snj | Pull up following revision(s) (requested by mrg in ticket #1309):
libexec/httpd/CHANGES: revisions 1.23, 1.24
libexec/httpd/bozohttpd.8: revisions 1.60-1.62
libexec/httpd/bozohttpd.c: revisions 1.81-1.84
libexec/httpd/bozohttpd.h: revision 1.46
libexec/httpd/cgi-bozo.c: revision 1.35
libexec/httpd/content-bozo.c: revision 1.14
libexec/httpd/main.c: revisions 1.14-1.16
libexec/httpd/testsuite/Makefile: revision 1.6
libexec/httpd/testsuite/test-bigfile: revision 1.3
libexec/httpd/testsuite/test-simple: revisions 1.1, 1.2
update bozohttpd to 2016072:
- fix memory leak
- addd -G option to display version
- fix some content type issues
- fix issues in testsuite
|
| 1.25.2.5 |
| 15-Apr-2016 |
mrg | branches: 1.25.2.5.2;
Pull up following revision(s) (requested by mrg in ticket #1377):
libexec/httpd/cgi-bozo.c 1.34
use %zu instead of %lu for size_t.
(ok snj@)
|
| 1.25.2.4 |
| 15-Apr-2016 |
snj | Pull up following revision(s) (requested by mrg in ticket #1141):
libexec/httpd/CHANGES: up to 1.22
libexec/httpd/bozohttpd.8: up to 1.59
libexec/httpd/bozohttpd.c: up to 1.80
libexec/httpd/bozohttpd.h: up to 1.45
libexec/httpd/cgi-bozo.c: up to 1.33
libexec/httpd/lua/bozo.lua: up to 1.2
libexec/httpd/lua/glue.c: up to 1.2
Import bozohttpd 20151028:
o add CGI support for ~user translation (-E switch)
o add redirects to ~user translation
o fix bugs around ~user translation
o add schema detection for absolute redirects
o fixed few memory leaks
o bunch of minor tweaks
o removed -r support
o smarter redirects
--
Changes in 20150320:
o fix redirection handling
o support transport stream (.ts) and video object (.vob) files
o directory listings show correct file sizes for large files
--
updates and bozohttpd 20160415:
o add search-word support for CGI
o fix a security issue in CGI suffix handler support which would
allow remote code execution, from shm@netbsd.org
o -C option supports now CGI scripts only
|
| 1.25.2.3 |
| 10-Apr-2016 |
martin | Catch up to -current (via patch), requested by mspo in #1141:
libexec/httpd/CHANGES up to 1.21
libexec/httpd/Makefile up to 1.26
libexec/httpd/auth-bozo.c up to 1.18
libexec/httpd/bozohttpd.8 up to 1.58
libexec/httpd/bozohttpd.c up to 1.79
libexec/httpd/bozohttpd.h up to 1.44
libexec/httpd/cgi-bozo.c up to 1.32
libexec/httpd/content-bozo.c up to 1.13
libexec/httpd/daemon-bozo.c up to 1.17
libexec/httpd/dir-index-bozo.c up to 1.25
libexec/httpd/lua-bozo.c up to 1.14
libexec/httpd/main.c up to 1.13
libexec/httpd/netbsd_queue.h up to 1.1
libexec/httpd/printenv.lua up to 1.3
libexec/httpd/ssl-bozo.c up to 1.22
libexec/httpd/tilde-luzah-bozo.c up to 1.14
libexec/httpd/testsuite/Makefile up to 1.5
libexec/httpd/testsuite/test-bigfile up to 1.2
Import bozohttpd 20151028:
o add CGI support for ~user translation (-E switch)
o add redirects to ~user translation
o fix bugs around ~user translation
o add schema detection for absolute redirects
o fixed few memory leaks
o bunch of minor tweaks
o removed -r support
o smarter redirects
Changes in 20150320:
o fix redirection handling
o support transport stream (.ts) and video object (.vob) files
o directory listings show correct file sizes for large files
|
| 1.25.2.2 |
| 09-May-2015 |
snj | branches: 1.25.2.2.2;
Pull up following revision(s) (requested by mrg in ticket #743):
libexec/httpd/bozohttpd.8: revision 1.51
libexec/httpd/bozohttpd.c: revision 1.64
libexec/httpd/bozohttpd.h: revision 1.35
libexec/httpd/cgi-bozo.c: revision 1.27
libexec/httpd/content-bozo.c: revision 1.12
fix content type handling to not hard code (wrong) values for length,
but just call strlen() as needed. call this 20150501.
reported by Jan Danielsson for ".svg".
|
| 1.25.2.1 |
| 23-Apr-2015 |
snj | Pull up following revision(s) (requested by mrg in ticket #715):
distrib/sets/lists/base/mi: revision 1.1100
distrib/sets/lists/man/mi: revision 1.1499 via patch
libexec/httpd/Makefile: revision 1.23
libexec/httpd/bozohttpd.8: revision 1.50
libexec/httpd/cgi-bozo.c: revision 1.26
install as bozohttpd/bozohttpd.8 as well as httpd.
--
Fix deref "command" after "free(file)", from KIYOHARA Takashi
|
| 1.25.2.7.2.4 |
| 15-Jun-2019 |
martin | Pull up the following revisions (via patch) requested by mrg in ticket #1699:
libexec/httpd/CHANGES 1.31-1.40
libexec/httpd/Makefile 1.28
libexec/httpd/auth-bozo.c 1.23-1.24
libexec/httpd/bozohttpd.8 1.75-1.79
libexec/httpd/bozohttpd.c 1.100-1.113
libexec/httpd/bozohttpd.h 1.58-1.60
libexec/httpd/cgi-bozo.c 1.46-1.48
libexec/httpd/daemon-bozo.c 1.20-1.21
libexec/httpd/dir-index-bozo.c 1.29-1.32
libexec/httpd/ssl-bozo.c 1.26
libexec/httpd/testsuite/Makefile 1.12-1.13
libexec/httpd/testsuite/t11.out 1.2
libexec/httpd/testsuite/test-bigfile 1.6
libexec/httpd/testsuite/test-simple 1.6
Don't display special files in the directory index. They aren't
served, but links to them are generated.
---
All from "Rajeev V. Pillai" <rajeev_v_pillai@yahoo.com>:
- use html tables for directory index.
- don't include "index.html" in html headers
- additional escaping of names
- re-add top/bottom borders
- adds an aquamarine table header
- Zebra-stripes table rows using CSS instead of code
- fix CGI '+' param and error handling.
- remove unused parameter to daemon_poll_err().
- avoid sign extension in % handling
fix a few problems pointed out by clang static analyzer:
- bozostrnsep() may return with "in = NULL", so check for it.
- nul terminating in bozo_escape_rfc3986() can be simpler
- don't use uniinit variables in check_remap()
- don't use re-used freed data in check_virtual().
- fix bozoprefs->size setting when increasing the size (new total was
being added to the prior total.)
however, bozostrdup() may reference request->hr_file.
---
Add ssl specific timeout value (30s). If SSL_accept() doesn't
work with in this timeout value, ssl setup now fails.
---
Fix handling of bozo_set_timeout() timeouts (and `-T' option parsing)
---
Avoid .htpasswd exposure to authenticated users when .htpasswd is
in the slashdir too.
---
Avoid possible NULL dereference when sending a big request that timeout.
---
Use strings.h for strcasecmp (on linux)
---
Account for cgihandler being set when counting the number of CGI environment
headers we are about to set. Avoids an assertion failure (and overruninng
the array) later.
|
| 1.25.2.7.2.3 |
| 28-Nov-2018 |
martin | Pull up following revision(s) (requested by mrg in ticket #1659):
libexec/httpd/main.c: revision 1.22
libexec/httpd/CHANGES: revision 1.29
libexec/httpd/cgi-bozo.c: revision 1.45
libexec/httpd/bozohttpd.h: revision 1.57
libexec/httpd/CHANGES: revision 1.30
libexec/httpd/bozohttpd.c: revision 1.97
libexec/httpd/bozohttpd.c: revision 1.98
libexec/httpd/bozohttpd.c: revision 1.99
one semicolon is usually enough.
-
appease lint
- add FALLTHROUGH comment
- one return is usually enough.
-
avoid c99ism.
-
fix -X option parsing. noted by Rajeev V. Pillai.
-
add option fixes here.
-
normalise some messages.
|
| 1.25.2.7.2.2 |
| 24-Nov-2018 |
martin | Sync to HEAD (requested by mrg in ticket #1655):
libexec/httpd/testsuite/data/.bzremap up to 1.1
libexec/httpd/testsuite/t12.out up to 1.1
libexec/httpd/testsuite/t12.in up to 1.1
libexec/httpd/testsuite/t13.out up to 1.1
libexec/httpd/testsuite/t13.in up to 1.1
libexec/httpd/testsuite/t14.out up to 1.1
libexec/httpd/testsuite/t14.in up to 1.1
libexec/httpd/testsuite/t15.out up to 1.1
libexec/httpd/testsuite/t15.in up to 1.1
libexec/httpd/CHANGES up to 1.28
libexec/httpd/Makefile up to 1.27
libexec/httpd/auth-bozo.c up to 1.22
libexec/httpd/bozohttpd.8 up to 1.74
libexec/httpd/bozohttpd.c up to 1.96
libexec/httpd/bozohttpd.h up to 1.56
libexec/httpd/cgi-bozo.c up to 1.44
libexec/httpd/content-bozo.c up to 1.16
libexec/httpd/daemon-bozo.c up to 1.19
libexec/httpd/dir-index-bozo.c up to 1.28
libexec/httpd/lua-bozo.c up to 1.15
libexec/httpd/main.c up to 1.21
libexec/httpd/ssl-bozo.c up to 1.25
libexec/httpd/tilde-luzah-bozo.c up to 1.16
libexec/httpd/libbozohttpd/Makefile up to 1.3
libexec/httpd/lua/bozo.lua up to 1.3
libexec/httpd/lua/glue.c up to 1.5
libexec/httpd/lua/optparse.lua up to 1.2
libexec/httpd/testsuite/Makefile up to 1.11
libexec/httpd/testsuite/html_cmp up to 1.6
libexec/httpd/testsuite/t3.out up to 1.4
libexec/httpd/testsuite/t5.out up to 1.4
libexec/httpd/testsuite/t6.out up to 1.4
libexec/httpd/testsuite/test-bigfile up to 1.5
libexec/httpd/testsuite/test-simple up to 1.5
Cosmetic changes to Lua binding in bozohttpd.
- Don't use negative indicies to read arguments of Lua functions.
- On error, return nil, "error string".
- Use ssize_t for return values from bozo_read() and bozo_write().
- Prefer lstring especially when if saves you from appending NUL and
doing len + 1 which can potentially wraparound.
- Don't mix C allocations with Lua functions marked with "m" in the Lua
manual. Those functions may throw (longjump) and leak data allocated
by C function. In one case, I use luaL_Buffer, in the other case,
I rearranged calls a bit.
fix ordering of a couple of words. from Edgar Pettijohn in PR#52375.
thanks!
s/u_int/unsigned/.
from Jan Danielsson. increases/fixes portability.
PR bin/52194: bozohttpd fails to exec scripts via the -C mechanism
sometimes with EFAULT due to not NULL terminated environment.
Document script handler issues with httpd(8).
From martin@, addressing PR 52194.
While here, use American spelling consistently and upper-case some
abbreviations.
Bump date.
fix output since protocol agnostic change went in.
XXX: i thought someone hooked this into atf already, please do :)
Add support for remapping requested paths via a .bzredirect file.
Fixes PR 52772. Ok: mrg@
Bump date
Remove trailing whitespace.
use __func__ in debug().
fix a denial of service attack against header contents, which
is now bounded at 16KiB. reported by JP.
avoid memory leak in sending multiple auth headers.
mostly mitigated by previous patch to limit total header size,
but still a real problem here.
note the changes present in bozohttpd 20181118:
o add url remap support via .bzremap file, from martin%netbsd.org@localhost
o handle redirections for any protocol, not just http:
o fix a denial of service attack against header contents, which
is now bounded at 16KiB. reported by JP.
from CHANGES:
o reduce default timeouts, and add expand timeouts to handle the
initial line, each header, and the total time spent
o add -T option to expose new timeout settings
o minor RFC fixes related to timeout handling responses
old timeouts:
60 seconds for initial request like, 60 seconds per header line,
and no whole timeout (though the recent total header size changes
do introduce one that would be about 11 hours.)
new timeouts:
30 seconds for initial request like, 10 seconds per header line,
and a total request time of 600 seconds.
the new global timeout is implemented using CLOCK_MONOTONIC, with
a fallback to CLOCK_REALTIME if monotonic time is unavailable.
reject multiple Host: headers. besides being protocol standard,
this closes one additional memory leak found by JP. add a simple
test to check this.
clean up option and usage handling some.
move some #if support into bozohttpd.h.
fix previous: have_debug was reversed.
also fix have_dynamic_content from the previous previous. re-order
the debug and dynamic content to match the same pattern as everything
else so similar problems are less likely in the future.
- move special files defines into bozohttpd.h, so we can ...
- consolidate all the special file checks into
bozo_check_special_files() so that all builds check the same
list of special files, regardless of build options.
- convert "(void)bozo_http_error(...); return -1;" into plain
"return bozo_http_error(...);"
- fix the call to bozo_check_special_files() to be used on all
input types. part of the fixes for failure to reject access
to /.htpasswd as reported by JP on tech-security.
- use warn_unused_result attribute on bozo_check_special_files(),
and fix the failures to return failure. second part of the
htpasswd access fix.
- update testsuite to use a fixed fake hostname.
call this bozohttpd 20181121.
two fixes reported by mouse:
- don't check contents of 'st' if stat(2) failed.
- round up instead of truncate. now 10000 byte files say 10kB not 9kB.
use MAP_SHARED for the bzremap file. avoids netbsd kernel complaining:
WARNING: defaulted mmap() share type to MAP_PRIVATE (pid 15478 command bozohttpd)
many clean ups:
- keep a list of special files and their human names
- remove (void) casts on bozo_http_error()
- fix a few more misuses of bozo_http_error()
- rename check_mapping() to check_remap() and perform some CSE
- switch away from ``%s'' to '%s'
- remove a bunch of #ifdef using new have_feature defines
alpha sort the option switch.
add an assert() check on array bounds.
minor style fixes. simplify bozo_match_content_map().
|
| 1.25.2.7.2.1 |
| 03-Jan-2018 |
snj | Pull up following revision(s) (requested by martin in ticket #1533):
libexec/httpd/cgi-bozo.c: revision 1.39
PR bin/52194: bozohttpd fails to exec scripts via the -C mechanism
sometimes with EFAULT due to not NULL terminated environment.
|
| 1.25.2.5.2.2 |
| 13-Mar-2017 |
skrll | Sync with netbsd-7-1-RELEASE
|
| 1.25.2.5.2.1 |
| 18-Jan-2017 |
skrll | Sync with netbsd-5
|
| 1.25.2.2.2.8 |
| 15-Jun-2019 |
martin | Pull up the following revisions (via patch) requested by mrg in ticket #1699:
libexec/httpd/CHANGES 1.31-1.40
libexec/httpd/Makefile 1.28
libexec/httpd/auth-bozo.c 1.23-1.24
libexec/httpd/bozohttpd.8 1.75-1.79
libexec/httpd/bozohttpd.c 1.100-1.113
libexec/httpd/bozohttpd.h 1.58-1.60
libexec/httpd/cgi-bozo.c 1.46-1.48
libexec/httpd/daemon-bozo.c 1.20-1.21
libexec/httpd/dir-index-bozo.c 1.29-1.32
libexec/httpd/ssl-bozo.c 1.26
libexec/httpd/testsuite/Makefile 1.12-1.13
libexec/httpd/testsuite/t11.out 1.2
libexec/httpd/testsuite/test-bigfile 1.6
libexec/httpd/testsuite/test-simple 1.6
Don't display special files in the directory index. They aren't
served, but links to them are generated.
---
All from "Rajeev V. Pillai" <rajeev_v_pillai@yahoo.com>:
- use html tables for directory index.
- don't include "index.html" in html headers
- additional escaping of names
- re-add top/bottom borders
- adds an aquamarine table header
- Zebra-stripes table rows using CSS instead of code
- fix CGI '+' param and error handling.
- remove unused parameter to daemon_poll_err().
- avoid sign extension in % handling
fix a few problems pointed out by clang static analyzer:
- bozostrnsep() may return with "in = NULL", so check for it.
- nul terminating in bozo_escape_rfc3986() can be simpler
- don't use uniinit variables in check_remap()
- don't use re-used freed data in check_virtual().
- fix bozoprefs->size setting when increasing the size (new total was
being added to the prior total.)
however, bozostrdup() may reference request->hr_file.
---
Add ssl specific timeout value (30s). If SSL_accept() doesn't
work with in this timeout value, ssl setup now fails.
---
Fix handling of bozo_set_timeout() timeouts (and `-T' option parsing)
---
Avoid .htpasswd exposure to authenticated users when .htpasswd is
in the slashdir too.
---
Avoid possible NULL dereference when sending a big request that timeout.
---
Use strings.h for strcasecmp (on linux)
---
Account for cgihandler being set when counting the number of CGI environment
headers we are about to set. Avoids an assertion failure (and overruninng
the array) later.
|
| 1.25.2.2.2.7 |
| 28-Nov-2018 |
martin | Pull up following revision(s) (requested by mrg in ticket #1659):
libexec/httpd/main.c: revision 1.22
libexec/httpd/CHANGES: revision 1.29
libexec/httpd/cgi-bozo.c: revision 1.45
libexec/httpd/bozohttpd.h: revision 1.57
libexec/httpd/CHANGES: revision 1.30
libexec/httpd/bozohttpd.c: revision 1.97
libexec/httpd/bozohttpd.c: revision 1.98
libexec/httpd/bozohttpd.c: revision 1.99
one semicolon is usually enough.
-
appease lint
- add FALLTHROUGH comment
- one return is usually enough.
-
avoid c99ism.
-
fix -X option parsing. noted by Rajeev V. Pillai.
-
add option fixes here.
-
normalise some messages.
|
| 1.25.2.2.2.6 |
| 24-Nov-2018 |
martin | Sync to HEAD (requested by mrg in ticket #1655):
libexec/httpd/testsuite/data/.bzremap up to 1.1
libexec/httpd/testsuite/t12.out up to 1.1
libexec/httpd/testsuite/t12.in up to 1.1
libexec/httpd/testsuite/t13.out up to 1.1
libexec/httpd/testsuite/t13.in up to 1.1
libexec/httpd/testsuite/t14.out up to 1.1
libexec/httpd/testsuite/t14.in up to 1.1
libexec/httpd/testsuite/t15.out up to 1.1
libexec/httpd/testsuite/t15.in up to 1.1
libexec/httpd/CHANGES up to 1.28
libexec/httpd/Makefile up to 1.27
libexec/httpd/auth-bozo.c up to 1.22
libexec/httpd/bozohttpd.8 up to 1.74
libexec/httpd/bozohttpd.c up to 1.96
libexec/httpd/bozohttpd.h up to 1.56
libexec/httpd/cgi-bozo.c up to 1.44
libexec/httpd/content-bozo.c up to 1.16
libexec/httpd/daemon-bozo.c up to 1.19
libexec/httpd/dir-index-bozo.c up to 1.28
libexec/httpd/lua-bozo.c up to 1.15
libexec/httpd/main.c up to 1.21
libexec/httpd/ssl-bozo.c up to 1.25
libexec/httpd/tilde-luzah-bozo.c up to 1.16
libexec/httpd/libbozohttpd/Makefile up to 1.3
libexec/httpd/lua/bozo.lua up to 1.3
libexec/httpd/lua/glue.c up to 1.5
libexec/httpd/lua/optparse.lua up to 1.2
libexec/httpd/testsuite/Makefile up to 1.11
libexec/httpd/testsuite/html_cmp up to 1.6
libexec/httpd/testsuite/t3.out up to 1.4
libexec/httpd/testsuite/t5.out up to 1.4
libexec/httpd/testsuite/t6.out up to 1.4
libexec/httpd/testsuite/test-bigfile up to 1.5
libexec/httpd/testsuite/test-simple up to 1.5
Cosmetic changes to Lua binding in bozohttpd.
- Don't use negative indicies to read arguments of Lua functions.
- On error, return nil, "error string".
- Use ssize_t for return values from bozo_read() and bozo_write().
- Prefer lstring especially when if saves you from appending NUL and
doing len + 1 which can potentially wraparound.
- Don't mix C allocations with Lua functions marked with "m" in the Lua
manual. Those functions may throw (longjump) and leak data allocated
by C function. In one case, I use luaL_Buffer, in the other case,
I rearranged calls a bit.
fix ordering of a couple of words. from Edgar Pettijohn in PR#52375.
thanks!
s/u_int/unsigned/.
from Jan Danielsson. increases/fixes portability.
PR bin/52194: bozohttpd fails to exec scripts via the -C mechanism
sometimes with EFAULT due to not NULL terminated environment.
Document script handler issues with httpd(8).
From martin@, addressing PR 52194.
While here, use American spelling consistently and upper-case some
abbreviations.
Bump date.
fix output since protocol agnostic change went in.
XXX: i thought someone hooked this into atf already, please do :)
Add support for remapping requested paths via a .bzredirect file.
Fixes PR 52772. Ok: mrg@
Bump date
Remove trailing whitespace.
use __func__ in debug().
fix a denial of service attack against header contents, which
is now bounded at 16KiB. reported by JP.
avoid memory leak in sending multiple auth headers.
mostly mitigated by previous patch to limit total header size,
but still a real problem here.
note the changes present in bozohttpd 20181118:
o add url remap support via .bzremap file, from martin%netbsd.org@localhost
o handle redirections for any protocol, not just http:
o fix a denial of service attack against header contents, which
is now bounded at 16KiB. reported by JP.
from CHANGES:
o reduce default timeouts, and add expand timeouts to handle the
initial line, each header, and the total time spent
o add -T option to expose new timeout settings
o minor RFC fixes related to timeout handling responses
old timeouts:
60 seconds for initial request like, 60 seconds per header line,
and no whole timeout (though the recent total header size changes
do introduce one that would be about 11 hours.)
new timeouts:
30 seconds for initial request like, 10 seconds per header line,
and a total request time of 600 seconds.
the new global timeout is implemented using CLOCK_MONOTONIC, with
a fallback to CLOCK_REALTIME if monotonic time is unavailable.
reject multiple Host: headers. besides being protocol standard,
this closes one additional memory leak found by JP. add a simple
test to check this.
clean up option and usage handling some.
move some #if support into bozohttpd.h.
fix previous: have_debug was reversed.
also fix have_dynamic_content from the previous previous. re-order
the debug and dynamic content to match the same pattern as everything
else so similar problems are less likely in the future.
- move special files defines into bozohttpd.h, so we can ...
- consolidate all the special file checks into
bozo_check_special_files() so that all builds check the same
list of special files, regardless of build options.
- convert "(void)bozo_http_error(...); return -1;" into plain
"return bozo_http_error(...);"
- fix the call to bozo_check_special_files() to be used on all
input types. part of the fixes for failure to reject access
to /.htpasswd as reported by JP on tech-security.
- use warn_unused_result attribute on bozo_check_special_files(),
and fix the failures to return failure. second part of the
htpasswd access fix.
- update testsuite to use a fixed fake hostname.
call this bozohttpd 20181121.
two fixes reported by mouse:
- don't check contents of 'st' if stat(2) failed.
- round up instead of truncate. now 10000 byte files say 10kB not 9kB.
use MAP_SHARED for the bzremap file. avoids netbsd kernel complaining:
WARNING: defaulted mmap() share type to MAP_PRIVATE (pid 15478 command bozohttpd)
many clean ups:
- keep a list of special files and their human names
- remove (void) casts on bozo_http_error()
- fix a few more misuses of bozo_http_error()
- rename check_mapping() to check_remap() and perform some CSE
- switch away from ``%s'' to '%s'
- remove a bunch of #ifdef using new have_feature defines
alpha sort the option switch.
add an assert() check on array bounds.
minor style fixes. simplify bozo_match_content_map().
|
| 1.25.2.2.2.5 |
| 03-Jan-2018 |
snj | Pull up following revision(s) (requested by martin in ticket #1533):
libexec/httpd/cgi-bozo.c: revision 1.39
PR bin/52194: bozohttpd fails to exec scripts via the -C mechanism
sometimes with EFAULT due to not NULL terminated environment.
|
| 1.25.2.2.2.4 |
| 12-Feb-2017 |
snj | Pull up following revision(s) (requested by mrg in ticket #1357):
libexec/httpd/CHANGES: revision 1.25
libexec/httpd/bozohttpd.8: revisions 1.63-1.65
libexec/httpd/bozohttpd.c: revisions 1.85, 1.86
libexec/httpd/bozohttpd.h: revision 1.47
libexec/httpd/cgi-bozo.c: revisions 1.36, 1.37
libexec/httpd/libbozohttpd/libbozohttpd.3: revision 1.4
libexec/httpd/testsuite/Makefile: revision 1.7
libexec/httpd/testsuite/html_cmp: revision 1.5
libexec/httpd/testsuite/test-bigfile: revision 1.4
libexec/httpd/testsuite/test-simple: revisions 1.3, 1.4
libexec/httpd/testsuite/t11.in: revision 1.1
libexec/httpd/testsuite/t11.out: revision 1.1
libexec/httpd/testsuite/cgi-bin/empty: revision 1.1
Update bozohttpd to 20170201:
- fix an infinite loop in cgi processing
- fixes and clean up for the testsuite
- no longer sends encoding header for compressed formats
|
| 1.25.2.2.2.3 |
| 23-Dec-2016 |
snj | Pull up following revision(s) (requested by mrg in ticket #1309):
libexec/httpd/CHANGES: revisions 1.23, 1.24
libexec/httpd/bozohttpd.8: revisions 1.60-1.62
libexec/httpd/bozohttpd.c: revisions 1.81-1.84
libexec/httpd/bozohttpd.h: revision 1.46
libexec/httpd/cgi-bozo.c: revision 1.35
libexec/httpd/content-bozo.c: revision 1.14
libexec/httpd/main.c: revisions 1.14-1.16
libexec/httpd/testsuite/Makefile: revision 1.6
libexec/httpd/testsuite/test-bigfile: revision 1.3
libexec/httpd/testsuite/test-simple: revisions 1.1, 1.2
update bozohttpd to 2016072:
- fix memory leak
- addd -G option to display version
- fix some content type issues
- fix issues in testsuite
|
| 1.25.2.2.2.2 |
| 15-Apr-2016 |
mrg | Pull up following revision(s) (requested by mrg in ticket #1141):
libexec/httpd/cgi-bozo.c 1.34
use %zu instead of %lu for size_t.
(ok snj@)
|
| 1.25.2.2.2.1 |
| 15-Apr-2016 |
snj | Pull up following revision(s) (requested by mrg in ticket #1141):
libexec/httpd/CHANGES: up to 1.22
libexec/httpd/Makefile: up to 1.26
libexec/httpd/auth-bozo.c: up to 1.18
libexec/httpd/bozohttpd.8: up to 1.59
libexec/httpd/bozohttpd.c: up to 1.80
libexec/httpd/bozohttpd.h: up to 1.45
libexec/httpd/cgi-bozo.c: up to 1.33
libexec/httpd/content-bozo.c: up to 1.13
libexec/httpd/daemon-bozo.c: up to 1.17
libexec/httpd/dir-index-bozo.c: up to 1.25
libexec/httpd/lua-bozo.c: up to 1.14
libexec/httpd/lua/bozo.lua: up to 1.2
libexec/httpd/lua/glue.c: up to 1.2
libexec/httpd/main.c: up to 1.13
libexec/httpd/printenv.lua: up to 1.3
libexec/httpd/ssl-bozo.c: up to 1.22
libexec/httpd/testsuite/Makefile: up to 1.5
libexec/httpd/testsuite/test-bigfile: up to 1.2
libexec/httpd/tilde-luzah-bozo.c: up to 1.14
Import bozohttpd 20151028:
o add CGI support for ~user translation (-E switch)
o add redirects to ~user translation
o fix bugs around ~user translation
o add schema detection for absolute redirects
o fixed few memory leaks
o bunch of minor tweaks
o removed -r support
o smarter redirects
Changes in 20150320:
o fix redirection handling
o support transport stream (.ts) and video object (.vob) files
o directory listings show correct file sizes for large files
--
updates and bozohttpd 20160415:
o add search-word support for CGI
o fix a security issue in CGI suffix handler support which would
allow remote code execution, from shm@netbsd.org
o -C option supports now CGI scripts only
|
| 1.35.4.1 |
| 21-Apr-2017 |
bouyer | Sync with HEAD
|
| 1.35.2.1 |
| 20-Mar-2017 |
pgoyette | Sync with HEAD
|
| 1.37.4.5 |
| 27-Mar-2021 |
martin | Pull up the following via patch, requested by mrg in ticket #1668:
Makefile 1.30-1.31
Makefile.boot 1.7-1.9
auth-bozo.c 1.25-1.26
bozohttpd.8 1.80-1.87
bozohttpd.c 1.114-1.123,1.125-1.128
bozohttpd.h 1.61-1.68
cgi-bozo.c 1.49-1.53
content-bozo.c 1.17-1.20
daemon-bozo.c 1-.22
dir-index-bozo.c 1.33-1.34
main.c 1.23-1.27
printenv.lua 1.4-1.5
ssl-bozo.c 1.27-1.29
libbozohttpd/libbozohttpd.3 1.5-1.6
small/Makefile 1.4
testsuite/Makefile 1.14
testsuite/t16.in 1.1
testsuite/t16.out 1.1
testsuite/t17.in 1.1
testsuite/t17.out 1.1
testsuite/t18.in 1.1
testsuite/t18.out 1.1
Update to bozohttpd 20210227.
changes in bozohttpd 20210227:
o new support for content types: .tar.bz2, .tar.xz, .tar.lz,
.tar.zst, .tbz2, .txz, .tlz, .zipx, .xz, .zst, .sz, .lz, .lzma,
.lzo, .7z, .lzo, .cab, .dmg, .jar, and .rar. should fix
netbsd PR#56026:
MIME type of .tar.xz file on ny{cdn,ftp}.NetBSD.org is invalid
changes in bozohttpd 20210211:
o fix various NULL derefs from malformed headers. mostly from
<emily@ingalls.rocks>.
o fix memory leaks in library interface: add bozo_cleanup().
changes in bozohttpd 20201014:
o also set -D_GNU_SOURCE in Makefile.boot. from
hadrien.lacour@posteo.net.
o fix array size botch (assertion, not exploitable.) from
martin@netbsd.org.
o also match %2F as well as %2f. from leah@vuxu.org.
o many manual and help fixes. clean ups for higher lint levels,
consistency/style clean ups. various option fixes including made
-f imply -b. from <henrik@gulbra.net> for freebsd.
changes in bozohttpd 20200912:
o add .m4a and .m4v file extensions.
changes in bozohttpd 20200820:
o make this work on sun2 by reducing mmap window there.
o fix SSL shutdown sequence. from spz@netbsd.org.
o add readme support to directory indexing. from jmcneill@netbsd.org
o add blocklist(8) support. from jruoho@netbsd.org.
|
| 1.37.4.4 |
| 12-Jun-2019 |
martin | Pull up the following revisions (via patch) requested by mrg in ticket #1281:
libexec/httpd/CHANGES 1.31-1.40
libexec/httpd/Makefile 1.28
libexec/httpd/auth-bozo.c 1.23-1.24
libexec/httpd/bozohttpd.8 1.75-1.79
libexec/httpd/bozohttpd.c 1.100-1.113
libexec/httpd/bozohttpd.h 1.58-1.60
libexec/httpd/cgi-bozo.c 1.46-1.48
libexec/httpd/daemon-bozo.c 1.20-1.21
libexec/httpd/dir-index-bozo.c 1.29-1.32
libexec/httpd/ssl-bozo.c 1.26
libexec/httpd/testsuite/Makefile 1.12-1.13
libexec/httpd/testsuite/t11.out 1.2
libexec/httpd/testsuite/test-bigfile 1.6
libexec/httpd/testsuite/test-simple 1.6
Don't display special files in the directory index. They aren't
served, but links to them are generated.
---
All from "Rajeev V. Pillai" <rajeev_v_pillai@yahoo.com>:
- use html tables for directory index.
- don't include "index.html" in html headers
- additional escaping of names
- re-add top/bottom borders
- adds an aquamarine table header
- Zebra-stripes table rows using CSS instead of code
- fix CGI '+' param and error handling.
- remove unused parameter to daemon_poll_err().
- avoid sign extension in % handling
fix a few problems pointed out by clang static analyzer:
- bozostrnsep() may return with "in = NULL", so check for it.
- nul terminating in bozo_escape_rfc3986() can be simpler
- don't use uniinit variables in check_remap()
- don't use re-used freed data in check_virtual().
- fix bozoprefs->size setting when increasing the size (new total was
being added to the prior total.)
however, bozostrdup() may reference request->hr_file.
---
Add ssl specific timeout value (30s). If SSL_accept() doesn't
work with in this timeout value, ssl setup now fails.
---
Fix handling of bozo_set_timeout() timeouts (and `-T' option parsing)
---
Avoid .htpasswd exposure to authenticated users when .htpasswd is
in the slashdir too.
---
Avoid possible NULL dereference when sending a big request that timeout.
---
Use strings.h for strcasecmp (on linux)
---
Account for cgihandler being set when counting the number of CGI environment
headers we are about to set. Avoids an assertion failure (and overruninng
the array) later.
|
| 1.37.4.3 |
| 28-Nov-2018 |
martin | Pull up following revision(s) (requested by mrg in ticket #1109):
libexec/httpd/main.c: revision 1.22
libexec/httpd/CHANGES: revision 1.29
libexec/httpd/cgi-bozo.c: revision 1.45
libexec/httpd/bozohttpd.h: revision 1.57
libexec/httpd/CHANGES: revision 1.30
libexec/httpd/bozohttpd.c: revision 1.97
libexec/httpd/bozohttpd.c: revision 1.98
libexec/httpd/bozohttpd.c: revision 1.99
one semicolon is usually enough.
-
appease lint
- add FALLTHROUGH comment
- one return is usually enough.
-
avoid c99ism.
-
fix -X option parsing. noted by Rajeev V. Pillai.
-
add option fixes here.
-
normalise some messages.
|
| 1.37.4.2 |
| 24-Nov-2018 |
martin | Sync to HEAD (requested by mrg in ticket #1104)
libexec/httpd/testsuite/data/.bzremap up to 1.1
libexec/httpd/testsuite/t12.out up to 1.1
libexec/httpd/testsuite/t12.in up to 1.1
libexec/httpd/testsuite/t13.out up to 1.1
libexec/httpd/testsuite/t13.in up to 1.1
libexec/httpd/testsuite/t14.out up to 1.1
libexec/httpd/testsuite/t14.in up to 1.1
libexec/httpd/testsuite/t15.out up to 1.1
libexec/httpd/testsuite/t15.in up to 1.1
libexec/httpd/CHANGES up to 1.28
libexec/httpd/auth-bozo.c up to 1.22
libexec/httpd/bozohttpd.8 up to 1.74
libexec/httpd/bozohttpd.c up to 1.96
libexec/httpd/bozohttpd.h up to 1.56
libexec/httpd/cgi-bozo.c up to 1.44
libexec/httpd/content-bozo.c up to 1.16
libexec/httpd/daemon-bozo.c up to 1.19
libexec/httpd/dir-index-bozo.c up to 1.28
libexec/httpd/main.c up to 1.21
libexec/httpd/ssl-bozo.c up to 1.25
libexec/httpd/tilde-luzah-bozo.c up to 1.16
libexec/httpd/lua/bozo.lua up to 1.3
libexec/httpd/lua/glue.c up to 1.5
libexec/httpd/lua/optparse.lua up to 1.2
libexec/httpd/testsuite/Makefile up to 1.11
libexec/httpd/testsuite/html_cmp up to 1.6
libexec/httpd/testsuite/t3.out up to 1.4
libexec/httpd/testsuite/t5.out up to 1.4
libexec/httpd/testsuite/t6.out up to 1.4
libexec/httpd/testsuite/test-bigfile up to 1.5
libexec/httpd/testsuite/test-simple up to 1.5
Cosmetic changes to Lua binding in bozohttpd.
- Don't use negative indicies to read arguments of Lua functions.
- On error, return nil, "error string".
- Use ssize_t for return values from bozo_read() and bozo_write().
- Prefer lstring especially when if saves you from appending NUL and
doing len + 1 which can potentially wraparound.
- Don't mix C allocations with Lua functions marked with "m" in the Lua
manual. Those functions may throw (longjump) and leak data allocated
by C function. In one case, I use luaL_Buffer, in the other case,
I rearranged calls a bit.
fix ordering of a couple of words. from Edgar Pettijohn in PR#52375.
thanks!
s/u_int/unsigned/.
from Jan Danielsson. increases/fixes portability.
PR bin/52194: bozohttpd fails to exec scripts via the -C mechanism
sometimes with EFAULT due to not NULL terminated environment.
Document script handler issues with httpd(8).
From martin@, addressing PR 52194.
While here, use American spelling consistently and upper-case some
abbreviations.
Bump date.
fix output since protocol agnostic change went in.
XXX: i thought someone hooked this into atf already, please do :)
Add support for remapping requested paths via a .bzredirect file.
Fixes PR 52772. Ok: mrg@
Bump date
Remove trailing whitespace.
use __func__ in debug().
fix a denial of service attack against header contents, which
is now bounded at 16KiB. reported by JP.
avoid memory leak in sending multiple auth headers.
mostly mitigated by previous patch to limit total header size,
but still a real problem here.
note the changes present in bozohttpd 20181118:
o add url remap support via .bzremap file, from martin%netbsd.org@localhost
o handle redirections for any protocol, not just http:
o fix a denial of service attack against header contents, which
is now bounded at 16KiB. reported by JP.
from CHANGES:
o reduce default timeouts, and add expand timeouts to handle the
initial line, each header, and the total time spent
o add -T option to expose new timeout settings
o minor RFC fixes related to timeout handling responses
old timeouts:
60 seconds for initial request like, 60 seconds per header line,
and no whole timeout (though the recent total header size changes
do introduce one that would be about 11 hours.)
new timeouts:
30 seconds for initial request like, 10 seconds per header line,
and a total request time of 600 seconds.
the new global timeout is implemented using CLOCK_MONOTONIC, with
a fallback to CLOCK_REALTIME if monotonic time is unavailable.
reject multiple Host: headers. besides being protocol standard,
this closes one additional memory leak found by JP. add a simple
test to check this.
clean up option and usage handling some.
move some #if support into bozohttpd.h.
fix previous: have_debug was reversed.
also fix have_dynamic_content from the previous previous. re-order
the debug and dynamic content to match the same pattern as everything
else so similar problems are less likely in the future.
- move special files defines into bozohttpd.h, so we can ...
- consolidate all the special file checks into
bozo_check_special_files() so that all builds check the same
list of special files, regardless of build options.
- convert "(void)bozo_http_error(...); return -1;" into plain
"return bozo_http_error(...);"
- fix the call to bozo_check_special_files() to be used on all
input types. part of the fixes for failure to reject access
to /.htpasswd as reported by JP on tech-security.
- use warn_unused_result attribute on bozo_check_special_files(),
and fix the failures to return failure. second part of the
htpasswd access fix.
- update testsuite to use a fixed fake hostname.
call this bozohttpd 20181121.
two fixes reported by mouse:
- don't check contents of 'st' if stat(2) failed.
- round up instead of truncate. now 10000 byte files say 10kB not 9kB.
use MAP_SHARED for the bzremap file. avoids netbsd kernel complaining:
WARNING: defaulted mmap() share type to MAP_PRIVATE (pid 15478 command bozohttpd)
many clean ups:
- keep a list of special files and their human names
- remove (void) casts on bozo_http_error()
- fix a few more misuses of bozo_http_error()
- rename check_mapping() to check_remap() and perform some CSE
- switch away from ``%s'' to '%s'
- remove a bunch of #ifdef using new have_feature defines
alpha sort the option switch.
add an assert() check on array bounds.
minor style fixes. simplify bozo_match_content_map().
|
| 1.37.4.1 |
| 04-Dec-2017 |
snj | Pull up following revision(s) (requested by martin in ticket #409):
libexec/httpd/cgi-bozo.c: revision 1.39
PR bin/52194: bozohttpd fails to exec scripts via the -C mechanism
sometimes with EFAULT due to not NULL terminated environment.
|
| 1.39.4.2 |
| 08-Apr-2020 |
martin | Merge changes from current as of 20200406
|
| 1.39.4.1 |
| 10-Jun-2019 |
christos | Sync with HEAD
|
| 1.39.2.2 |
| 18-Jan-2019 |
pgoyette | Synch with HEAD
|
| 1.39.2.1 |
| 26-Nov-2018 |
pgoyette | Sync with HEAD, resolve a couple of conflicts
|
| 1.48.2.1 |
| 05-Mar-2021 |
martin | Pull up the following (all via patch), requested by mrg in ticket #1221:
lib/lua/bozohttpd/Makefile (apply patch)
libexec/httpd/Makefile 1.30-1.31
libexec/httpd/Makefile.boot 1.7-1.9
libexec/httpd/auth-bozo.c 1.25-1.26
libexec/httpd/bozohttpd.8 1.80-1.87
libexec/httpd/bozohttpd.c 1.114-1.123,1.125-1.128
libexec/httpd/bozohttpd.h 1.61-1.68
libexec/httpd/cgi-bozo.c 1.49-1.53
libexec/httpd/content-bozo.c 1.17-1.20
libexec/httpd/daemon-bozo.c 1-.22
libexec/httpd/dir-index-bozo.c 1.33-1.34
libexec/httpd/main.c 1.23-1.27
libexec/httpd/printenv.lua 1.4-1.5
libexec/httpd/ssl-bozo.c 1.27-1.29
libexec/httpd/libbozohttpd/libbozohttpd.3 1.5-1.6
libexec/httpd/small/Makefile 1.4
libexec/httpd/testsuite/Makefile 1.14
libexec/httpd/testsuite/t16.in 1.1
libexec/httpd/testsuite/t16.out 1.1
libexec/httpd/testsuite/t17.in 1.1
libexec/httpd/testsuite/t17.out 1.1
libexec/httpd/testsuite/t18.in 1.1
libexec/httpd/testsuite/t18.out 1.1
Update to bozohttpd 20210227.
Apply lua build fix (no blocklist support on this branch).
changes in bozohttpd 20210227:
o new support for content types: .tar.bz2, .tar.xz, .tar.lz,
.tar.zst, .tbz2, .txz, .tlz, .zipx, .xz, .zst, .sz, .lz, .lzma,
.lzo, .7z, .lzo, .cab, .dmg, .jar, and .rar. should fix
netbsd PR#56026:
MIME type of .tar.xz file on ny{cdn,ftp}.NetBSD.org is invalid
changes in bozohttpd 20210211:
o fix various NULL derefs from malformed headers. mostly from
<emily@ingalls.rocks>.
o fix memory leaks in library interface: add bozo_cleanup().
changes in bozohttpd 20201014:
o also set -D_GNU_SOURCE in Makefile.boot. from
hadrien.lacour@posteo.net.
o fix array size botch (assertion, not exploitable.) from
martin@netbsd.org.
o also match %2F as well as %2f. from leah@vuxu.org.
o many manual and help fixes. clean ups for higher lint levels,
consistency/style clean ups. various option fixes including made
-f imply -b. from <henrik@gulbra.net> for freebsd.
changes in bozohttpd 20200912:
o add .m4a and .m4v file extensions.
changes in bozohttpd 20200820:
o make this work on sun2 by reducing mmap window there.
o fix SSL shutdown sequence. from spz@netbsd.org.
o add readme support to directory indexing. from jmcneill@netbsd.org
o add blocklist(8) support. from jruoho@netbsd.org.
|
