Changes in test-simple http://nxr.netbsd.org/rss/src/libexec/httpd/testsuite/test-simple en Copyright 2005 Java Don't pass ${HOST} to test scripts.<br/>htnl_cmp compares against the output of `hostname`.<br/><br/>This makes the tests pass on my machine. /src/libexec/httpd/testsuite/test-simple - 1.6 Fri Dec 14 23:57:22 UTC 2018 maya - move special files defines into bozohttpd.h, so we can ...<br/>- consolidate all the special file checks into<br/> bozo_check_special_files() so that all builds check the same<br/> list of special files, regardless of build options.<br/>- convert "(void)bozo_http_error(...); return -1;" into plain<br/> "return bozo_http_error(...);"<br/>- fix the call to bozo_check_special_files() to be used on all<br/> input types. part of the fixes for failure to reject access<br/> to /.htpasswd as reported by JP on tech-security.<br/>- use warn_unused_result attribute on bozo_check_special_files(),<br/> and fix the failures to return failure. second part of the<br/> htpasswd access fix.<br/>- update testsuite to use a fixed fake hostname.<br/><br/>call this bozohttpd 20181121. /src/libexec/httpd/testsuite/test-simple - 1.5 Wed Nov 21 09:37:02 UTC 2018 mrg branches: 1.4.2; 1.4.4; 1.4.6; 1.4.10; 1.4.16; 1.4.18;<br/>- fix a bug in cgi processing. from Dennis Lindroos.<br/>- add a testcase for this, and expand test-simple to handle additional<br/> args to bozohttpd for eg, cgi-bin setting.<br/>- fix objdir bugs in the testsuite. /src/libexec/httpd/testsuite/test-simple - 1.4 Tue Jan 31 14:33:54 UTC 2017 mrg branches: 1.3.2; 1.3.4;<br/>When testing non-verbosely, show diff on failure. ok mrg@ /src/libexec/httpd/testsuite/test-simple - 1.3 Tue Dec 27 00:09:19 UTC 2016 schmonz branches: 1.2.2; 1.2.4; 1.2.6;<br/>Missed in previous: exit 1 if html_cmp says no match. /src/libexec/httpd/testsuite/test-simple - 1.2 Mon Sep 26 00:21:22 UTC 2016 schmonz Add a VERBOSE knob to the testsuite ("yes" by default, producing<br/>basically the same output as before). When turned off, tests run<br/>silently except when there's a failure.<br/><br/>Reviewed by mrg@. /src/libexec/httpd/testsuite/test-simple - 1.1 Fri Sep 23 16:55:56 UTC 2016 schmonz Pull up the following revisions (via patch) requested by mrg in ticket #1699:<br/><br/> libexec/httpd/CHANGES 1.31-1.40<br/> libexec/httpd/Makefile 1.28<br/> libexec/httpd/auth-bozo.c 1.23-1.24<br/> libexec/httpd/bozohttpd.8 1.75-1.79<br/> libexec/httpd/bozohttpd.c 1.100-1.113<br/> libexec/httpd/bozohttpd.h 1.58-1.60<br/> libexec/httpd/cgi-bozo.c 1.46-1.48<br/> libexec/httpd/daemon-bozo.c 1.20-1.21<br/> libexec/httpd/dir-index-bozo.c 1.29-1.32<br/> libexec/httpd/ssl-bozo.c 1.26<br/> libexec/httpd/testsuite/Makefile 1.12-1.13<br/> libexec/httpd/testsuite/t11.out 1.2<br/> libexec/httpd/testsuite/test-bigfile 1.6<br/> libexec/httpd/testsuite/test-simple 1.6<br/><br/>Don't display special files in the directory index. They aren't<br/>served, but links to them are generated.<br/>---<br/>All from "Rajeev V. Pillai" <rajeev_v_pillai@yahoo.com>:<br/>- use html tables for directory index.<br/>- don't include "index.html" in html headers<br/>- additional escaping of names<br/>- re-add top/bottom borders<br/>- adds an aquamarine table header<br/>- Zebra-stripes table rows using CSS instead of code<br/>- fix CGI '+' param and error handling.<br/>- remove unused parameter to daemon_poll_err().<br/>- avoid sign extension in % handling<br/>fix a few problems pointed out by clang static analyzer:<br/>- bozostrnsep() may return with "in = NULL", so check for it.<br/>- nul terminating in bozo_escape_rfc3986() can be simpler<br/>- don't use uniinit variables in check_remap()<br/>- don't use re-used freed data in check_virtual().<br/>- fix bozoprefs->size setting when increasing the size (new total was<br/> being added to the prior total.)<br/> however, bozostrdup() may reference request->hr_file.<br/>---<br/>Add ssl specific timeout value (30s). If SSL_accept() doesn't<br/>work with in this timeout value, ssl setup now fails.<br/>---<br/>Fix handling of bozo_set_timeout() timeouts (and `-T' option parsing)<br/>---<br/>Avoid .htpasswd exposure to authenticated users when .htpasswd is<br/>in the slashdir too.<br/>---<br/>Avoid possible NULL dereference when sending a big request that timeout.<br/>---<br/>Use strings.h for strcasecmp (on linux)<br/>---<br/>Account for cgihandler being set when counting the number of CGI environment<br/>headers we are about to set. Avoids an assertion failure (and overruninng<br/>the array) later. /src/libexec/httpd/testsuite/test-simple - 1.2.6.5 Sat Jun 15 15:57:32 UTC 2019 martin Sync to HEAD (requested by mrg in ticket #1655):<br/><br/> libexec/httpd/testsuite/data/.bzremap up to 1.1<br/> libexec/httpd/testsuite/t12.out up to 1.1<br/> libexec/httpd/testsuite/t12.in up to 1.1<br/> libexec/httpd/testsuite/t13.out up to 1.1<br/> libexec/httpd/testsuite/t13.in up to 1.1<br/> libexec/httpd/testsuite/t14.out up to 1.1<br/> libexec/httpd/testsuite/t14.in up to 1.1<br/> libexec/httpd/testsuite/t15.out up to 1.1<br/> libexec/httpd/testsuite/t15.in up to 1.1<br/> libexec/httpd/CHANGES up to 1.28<br/> libexec/httpd/Makefile up to 1.27<br/> libexec/httpd/auth-bozo.c up to 1.22<br/> libexec/httpd/bozohttpd.8 up to 1.74<br/> libexec/httpd/bozohttpd.c up to 1.96<br/> libexec/httpd/bozohttpd.h up to 1.56<br/> libexec/httpd/cgi-bozo.c up to 1.44<br/> libexec/httpd/content-bozo.c up to 1.16<br/> libexec/httpd/daemon-bozo.c up to 1.19<br/> libexec/httpd/dir-index-bozo.c up to 1.28<br/> libexec/httpd/lua-bozo.c up to 1.15<br/> libexec/httpd/main.c up to 1.21<br/> libexec/httpd/ssl-bozo.c up to 1.25<br/> libexec/httpd/tilde-luzah-bozo.c up to 1.16<br/> libexec/httpd/libbozohttpd/Makefile up to 1.3<br/> libexec/httpd/lua/bozo.lua up to 1.3<br/> libexec/httpd/lua/glue.c up to 1.5<br/> libexec/httpd/lua/optparse.lua up to 1.2<br/> libexec/httpd/testsuite/Makefile up to 1.11<br/> libexec/httpd/testsuite/html_cmp up to 1.6<br/> libexec/httpd/testsuite/t3.out up to 1.4<br/> libexec/httpd/testsuite/t5.out up to 1.4<br/> libexec/httpd/testsuite/t6.out up to 1.4<br/> libexec/httpd/testsuite/test-bigfile up to 1.5<br/> libexec/httpd/testsuite/test-simple up to 1.5<br/><br/>Cosmetic changes to Lua binding in bozohttpd.<br/><br/>- Don't use negative indicies to read arguments of Lua functions.<br/>- On error, return nil, "error string".<br/>- Use ssize_t for return values from bozo_read() and bozo_write().<br/>- Prefer lstring especially when if saves you from appending NUL and<br/> doing len + 1 which can potentially wraparound.<br/>- Don't mix C allocations with Lua functions marked with "m" in the Lua<br/> manual. Those functions may throw (longjump) and leak data allocated<br/> by C function. In one case, I use luaL_Buffer, in the other case,<br/> I rearranged calls a bit.<br/><br/><br/>fix ordering of a couple of words. from Edgar Pettijohn in PR#52375.<br/>thanks!<br/><br/><br/>s/u_int/unsigned/.<br/><br/>from Jan Danielsson. increases/fixes portability.<br/><br/><br/>PR bin/52194: bozohttpd fails to exec scripts via the -C mechanism<br/>sometimes with EFAULT due to not NULL terminated environment.<br/><br/><br/>Document script handler issues with httpd(8).<br/>From martin@, addressing PR 52194.<br/><br/>While here, use American spelling consistently and upper-case some<br/>abbreviations.<br/><br/>Bump date.<br/><br/><br/>fix output since protocol agnostic change went in.<br/><br/>XXX: i thought someone hooked this into atf already, please do :)<br/><br/><br/>Add support for remapping requested paths via a .bzredirect file.<br/>Fixes PR 52772. Ok: mrg@<br/><br/><br/>Bump date<br/><br/><br/>Remove trailing whitespace.<br/><br/><br/>use __func__ in debug().<br/><br/><br/>fix a denial of service attack against header contents, which<br/>is now bounded at 16KiB. reported by JP.<br/><br/><br/>avoid memory leak in sending multiple auth headers.<br/>mostly mitigated by previous patch to limit total header size,<br/>but still a real problem here.<br/><br/><br/>note the changes present in bozohttpd 20181118:<br/><br/>o add url remap support via .bzremap file, from martin%netbsd.org@localhost<br/>o handle redirections for any protocol, not just http:<br/>o fix a denial of service attack against header contents, which<br/> is now bounded at 16KiB. reported by JP.<br/><br/><br/>from CHANGES:<br/><br/>o reduce default timeouts, and add expand timeouts to handle the<br/> initial line, each header, and the total time spent<br/>o add -T option to expose new timeout settings<br/>o minor RFC fixes related to timeout handling responses<br/><br/>old timeouts:<br/>60 seconds for initial request like, 60 seconds per header line,<br/>and no whole timeout (though the recent total header size changes<br/>do introduce one that would be about 11 hours.)<br/>new timeouts:<br/>30 seconds for initial request like, 10 seconds per header line,<br/>and a total request time of 600 seconds.<br/><br/>the new global timeout is implemented using CLOCK_MONOTONIC, with<br/>a fallback to CLOCK_REALTIME if monotonic time is unavailable.<br/><br/>reject multiple Host: headers. besides being protocol standard,<br/>this closes one additional memory leak found by JP. add a simple<br/>test to check this.<br/><br/>clean up option and usage handling some.<br/><br/><br/>move some #if support into bozohttpd.h.<br/><br/><br/>fix previous: have_debug was reversed.<br/><br/><br/>also fix have_dynamic_content from the previous previous. re-order<br/>the debug and dynamic content to match the same pattern as everything<br/>else so similar problems are less likely in the future.<br/><br/><br/>- move special files defines into bozohttpd.h, so we can ...<br/>- consolidate all the special file checks into<br/> bozo_check_special_files() so that all builds check the same<br/> list of special files, regardless of build options.<br/>- convert "(void)bozo_http_error(...); return -1;" into plain<br/> "return bozo_http_error(...);"<br/>- fix the call to bozo_check_special_files() to be used on all<br/> input types. part of the fixes for failure to reject access<br/> to /.htpasswd as reported by JP on tech-security.<br/>- use warn_unused_result attribute on bozo_check_special_files(),<br/> and fix the failures to return failure. second part of the<br/> htpasswd access fix.<br/>- update testsuite to use a fixed fake hostname.<br/><br/>call this bozohttpd 20181121.<br/><br/><br/>two fixes reported by mouse:<br/>- don't check contents of 'st' if stat(2) failed.<br/>- round up instead of truncate. now 10000 byte files say 10kB not 9kB.<br/><br/><br/>use MAP_SHARED for the bzremap file. avoids netbsd kernel complaining:<br/><br/>WARNING: defaulted mmap() share type to MAP_PRIVATE (pid 15478 command bozohttpd)<br/><br/><br/>many clean ups:<br/>- keep a list of special files and their human names<br/>- remove (void) casts on bozo_http_error()<br/>- fix a few more misuses of bozo_http_error()<br/>- rename check_mapping() to check_remap() and perform some CSE<br/>- switch away from ``%s'' to '%s'<br/>- remove a bunch of #ifdef using new have_feature defines<br/><br/><br/>alpha sort the option switch.<br/><br/><br/>add an assert() check on array bounds.<br/><br/><br/>minor style fixes. simplify bozo_match_content_map(). /src/libexec/httpd/testsuite/test-simple - 1.2.6.4 Sat Nov 24 17:23:48 UTC 2018 martin Pull up following revision(s) (requested by mrg in ticket #1357):<br/> libexec/httpd/CHANGES: revision 1.25<br/> libexec/httpd/bozohttpd.8: revisions 1.63-1.65<br/> libexec/httpd/bozohttpd.c: revisions 1.85, 1.86<br/> libexec/httpd/bozohttpd.h: revision 1.47<br/> libexec/httpd/cgi-bozo.c: revisions 1.36, 1.37<br/> libexec/httpd/libbozohttpd/libbozohttpd.3: revision 1.4<br/> libexec/httpd/testsuite/Makefile: revision 1.7<br/> libexec/httpd/testsuite/html_cmp: revision 1.5<br/> libexec/httpd/testsuite/test-bigfile: revision 1.4<br/> libexec/httpd/testsuite/test-simple: revisions 1.3, 1.4<br/> libexec/httpd/testsuite/t11.in: revision 1.1<br/> libexec/httpd/testsuite/t11.out: revision 1.1<br/> libexec/httpd/testsuite/cgi-bin/empty: revision 1.1<br/>Update bozohttpd to 20170201:<br/>- fix an infinite loop in cgi processing<br/>- fixes and clean up for the testsuite<br/>- no longer sends encoding header for compressed formats /src/libexec/httpd/testsuite/test-simple - 1.2.6.3 Sun Feb 12 21:59:45 UTC 2017 snj Pull up following revision(s) (requested by mrg in ticket #1309):<br/> libexec/httpd/CHANGES: revisions 1.23, 1.24<br/> libexec/httpd/bozohttpd.8: revisions 1.60-1.62<br/> libexec/httpd/bozohttpd.c: revisions 1.81-1.84<br/> libexec/httpd/bozohttpd.h: revision 1.46<br/> libexec/httpd/cgi-bozo.c: revision 1.35<br/> libexec/httpd/content-bozo.c: revision 1.14<br/> libexec/httpd/main.c: revisions 1.14-1.16<br/> libexec/httpd/testsuite/Makefile: revision 1.6<br/> libexec/httpd/testsuite/test-bigfile: revision 1.3<br/> libexec/httpd/testsuite/test-simple: revisions 1.1, 1.2<br/>update bozohttpd to 2016072:<br/>- fix memory leak<br/>- addd -G option to display version<br/>- fix some content type issues<br/>- fix issues in testsuite /src/libexec/httpd/testsuite/test-simple - 1.2.6.2 Fri Dec 23 07:47:40 UTC 2016 snj file test-simple was added on branch netbsd-7-0 on 2016-12-23 07:47:40 +0000 /src/libexec/httpd/testsuite/test-simple - 1.2.6.1 Mon Sep 26 00:21:22 UTC 2016 snj Pull up the following revisions (via patch) requested by mrg in ticket #1699:<br/><br/> libexec/httpd/CHANGES 1.31-1.40<br/> libexec/httpd/Makefile 1.28<br/> libexec/httpd/auth-bozo.c 1.23-1.24<br/> libexec/httpd/bozohttpd.8 1.75-1.79<br/> libexec/httpd/bozohttpd.c 1.100-1.113<br/> libexec/httpd/bozohttpd.h 1.58-1.60<br/> libexec/httpd/cgi-bozo.c 1.46-1.48<br/> libexec/httpd/daemon-bozo.c 1.20-1.21<br/> libexec/httpd/dir-index-bozo.c 1.29-1.32<br/> libexec/httpd/ssl-bozo.c 1.26<br/> libexec/httpd/testsuite/Makefile 1.12-1.13<br/> libexec/httpd/testsuite/t11.out 1.2<br/> libexec/httpd/testsuite/test-bigfile 1.6<br/> libexec/httpd/testsuite/test-simple 1.6<br/><br/>Don't display special files in the directory index. They aren't<br/>served, but links to them are generated.<br/>---<br/>All from "Rajeev V. Pillai" <rajeev_v_pillai@yahoo.com>:<br/>- use html tables for directory index.<br/>- don't include "index.html" in html headers<br/>- additional escaping of names<br/>- re-add top/bottom borders<br/>- adds an aquamarine table header<br/>- Zebra-stripes table rows using CSS instead of code<br/>- fix CGI '+' param and error handling.<br/>- remove unused parameter to daemon_poll_err().<br/>- avoid sign extension in % handling<br/>fix a few problems pointed out by clang static analyzer:<br/>- bozostrnsep() may return with "in = NULL", so check for it.<br/>- nul terminating in bozo_escape_rfc3986() can be simpler<br/>- don't use uniinit variables in check_remap()<br/>- don't use re-used freed data in check_virtual().<br/>- fix bozoprefs->size setting when increasing the size (new total was<br/> being added to the prior total.)<br/> however, bozostrdup() may reference request->hr_file.<br/>---<br/>Add ssl specific timeout value (30s). If SSL_accept() doesn't<br/>work with in this timeout value, ssl setup now fails.<br/>---<br/>Fix handling of bozo_set_timeout() timeouts (and `-T' option parsing)<br/>---<br/>Avoid .htpasswd exposure to authenticated users when .htpasswd is<br/>in the slashdir too.<br/>---<br/>Avoid possible NULL dereference when sending a big request that timeout.<br/>---<br/>Use strings.h for strcasecmp (on linux)<br/>---<br/>Account for cgihandler being set when counting the number of CGI environment<br/>headers we are about to set. Avoids an assertion failure (and overruninng<br/>the array) later. /src/libexec/httpd/testsuite/test-simple - 1.2.4.5 Sat Jun 15 15:54:58 UTC 2019 martin Sync to HEAD (requested by mrg in ticket #1655):<br/><br/> libexec/httpd/testsuite/data/.bzremap up to 1.1<br/> libexec/httpd/testsuite/t12.out up to 1.1<br/> libexec/httpd/testsuite/t12.in up to 1.1<br/> libexec/httpd/testsuite/t13.out up to 1.1<br/> libexec/httpd/testsuite/t13.in up to 1.1<br/> libexec/httpd/testsuite/t14.out up to 1.1<br/> libexec/httpd/testsuite/t14.in up to 1.1<br/> libexec/httpd/testsuite/t15.out up to 1.1<br/> libexec/httpd/testsuite/t15.in up to 1.1<br/> libexec/httpd/CHANGES up to 1.28<br/> libexec/httpd/Makefile up to 1.27<br/> libexec/httpd/auth-bozo.c up to 1.22<br/> libexec/httpd/bozohttpd.8 up to 1.74<br/> libexec/httpd/bozohttpd.c up to 1.96<br/> libexec/httpd/bozohttpd.h up to 1.56<br/> libexec/httpd/cgi-bozo.c up to 1.44<br/> libexec/httpd/content-bozo.c up to 1.16<br/> libexec/httpd/daemon-bozo.c up to 1.19<br/> libexec/httpd/dir-index-bozo.c up to 1.28<br/> libexec/httpd/lua-bozo.c up to 1.15<br/> libexec/httpd/main.c up to 1.21<br/> libexec/httpd/ssl-bozo.c up to 1.25<br/> libexec/httpd/tilde-luzah-bozo.c up to 1.16<br/> libexec/httpd/libbozohttpd/Makefile up to 1.3<br/> libexec/httpd/lua/bozo.lua up to 1.3<br/> libexec/httpd/lua/glue.c up to 1.5<br/> libexec/httpd/lua/optparse.lua up to 1.2<br/> libexec/httpd/testsuite/Makefile up to 1.11<br/> libexec/httpd/testsuite/html_cmp up to 1.6<br/> libexec/httpd/testsuite/t3.out up to 1.4<br/> libexec/httpd/testsuite/t5.out up to 1.4<br/> libexec/httpd/testsuite/t6.out up to 1.4<br/> libexec/httpd/testsuite/test-bigfile up to 1.5<br/> libexec/httpd/testsuite/test-simple up to 1.5<br/><br/>Cosmetic changes to Lua binding in bozohttpd.<br/><br/>- Don't use negative indicies to read arguments of Lua functions.<br/>- On error, return nil, "error string".<br/>- Use ssize_t for return values from bozo_read() and bozo_write().<br/>- Prefer lstring especially when if saves you from appending NUL and<br/> doing len + 1 which can potentially wraparound.<br/>- Don't mix C allocations with Lua functions marked with "m" in the Lua<br/> manual. Those functions may throw (longjump) and leak data allocated<br/> by C function. In one case, I use luaL_Buffer, in the other case,<br/> I rearranged calls a bit.<br/><br/><br/>fix ordering of a couple of words. from Edgar Pettijohn in PR#52375.<br/>thanks!<br/><br/><br/>s/u_int/unsigned/.<br/><br/>from Jan Danielsson. increases/fixes portability.<br/><br/><br/>PR bin/52194: bozohttpd fails to exec scripts via the -C mechanism<br/>sometimes with EFAULT due to not NULL terminated environment.<br/><br/><br/>Document script handler issues with httpd(8).<br/>From martin@, addressing PR 52194.<br/><br/>While here, use American spelling consistently and upper-case some<br/>abbreviations.<br/><br/>Bump date.<br/><br/><br/>fix output since protocol agnostic change went in.<br/><br/>XXX: i thought someone hooked this into atf already, please do :)<br/><br/><br/>Add support for remapping requested paths via a .bzredirect file.<br/>Fixes PR 52772. Ok: mrg@<br/><br/><br/>Bump date<br/><br/><br/>Remove trailing whitespace.<br/><br/><br/>use __func__ in debug().<br/><br/><br/>fix a denial of service attack against header contents, which<br/>is now bounded at 16KiB. reported by JP.<br/><br/><br/>avoid memory leak in sending multiple auth headers.<br/>mostly mitigated by previous patch to limit total header size,<br/>but still a real problem here.<br/><br/><br/>note the changes present in bozohttpd 20181118:<br/><br/>o add url remap support via .bzremap file, from martin%netbsd.org@localhost<br/>o handle redirections for any protocol, not just http:<br/>o fix a denial of service attack against header contents, which<br/> is now bounded at 16KiB. reported by JP.<br/><br/><br/>from CHANGES:<br/><br/>o reduce default timeouts, and add expand timeouts to handle the<br/> initial line, each header, and the total time spent<br/>o add -T option to expose new timeout settings<br/>o minor RFC fixes related to timeout handling responses<br/><br/>old timeouts:<br/>60 seconds for initial request like, 60 seconds per header line,<br/>and no whole timeout (though the recent total header size changes<br/>do introduce one that would be about 11 hours.)<br/>new timeouts:<br/>30 seconds for initial request like, 10 seconds per header line,<br/>and a total request time of 600 seconds.<br/><br/>the new global timeout is implemented using CLOCK_MONOTONIC, with<br/>a fallback to CLOCK_REALTIME if monotonic time is unavailable.<br/><br/>reject multiple Host: headers. besides being protocol standard,<br/>this closes one additional memory leak found by JP. add a simple<br/>test to check this.<br/><br/>clean up option and usage handling some.<br/><br/><br/>move some #if support into bozohttpd.h.<br/><br/><br/>fix previous: have_debug was reversed.<br/><br/><br/>also fix have_dynamic_content from the previous previous. re-order<br/>the debug and dynamic content to match the same pattern as everything<br/>else so similar problems are less likely in the future.<br/><br/><br/>- move special files defines into bozohttpd.h, so we can ...<br/>- consolidate all the special file checks into<br/> bozo_check_special_files() so that all builds check the same<br/> list of special files, regardless of build options.<br/>- convert "(void)bozo_http_error(...); return -1;" into plain<br/> "return bozo_http_error(...);"<br/>- fix the call to bozo_check_special_files() to be used on all<br/> input types. part of the fixes for failure to reject access<br/> to /.htpasswd as reported by JP on tech-security.<br/>- use warn_unused_result attribute on bozo_check_special_files(),<br/> and fix the failures to return failure. second part of the<br/> htpasswd access fix.<br/>- update testsuite to use a fixed fake hostname.<br/><br/>call this bozohttpd 20181121.<br/><br/><br/>two fixes reported by mouse:<br/>- don't check contents of 'st' if stat(2) failed.<br/>- round up instead of truncate. now 10000 byte files say 10kB not 9kB.<br/><br/><br/>use MAP_SHARED for the bzremap file. avoids netbsd kernel complaining:<br/><br/>WARNING: defaulted mmap() share type to MAP_PRIVATE (pid 15478 command bozohttpd)<br/><br/><br/>many clean ups:<br/>- keep a list of special files and their human names<br/>- remove (void) casts on bozo_http_error()<br/>- fix a few more misuses of bozo_http_error()<br/>- rename check_mapping() to check_remap() and perform some CSE<br/>- switch away from ``%s'' to '%s'<br/>- remove a bunch of #ifdef using new have_feature defines<br/><br/><br/>alpha sort the option switch.<br/><br/><br/>add an assert() check on array bounds.<br/><br/><br/>minor style fixes. simplify bozo_match_content_map(). /src/libexec/httpd/testsuite/test-simple - 1.2.4.4 Sat Nov 24 17:22:58 UTC 2018 martin branches: 1.2.4.3.2;<br/>Pull up following revision(s) (requested by mrg in ticket #1357):<br/> libexec/httpd/CHANGES: revision 1.25<br/> libexec/httpd/bozohttpd.8: revisions 1.63-1.65<br/> libexec/httpd/bozohttpd.c: revisions 1.85, 1.86<br/> libexec/httpd/bozohttpd.h: revision 1.47<br/> libexec/httpd/cgi-bozo.c: revisions 1.36, 1.37<br/> libexec/httpd/libbozohttpd/libbozohttpd.3: revision 1.4<br/> libexec/httpd/testsuite/Makefile: revision 1.7<br/> libexec/httpd/testsuite/html_cmp: revision 1.5<br/> libexec/httpd/testsuite/test-bigfile: revision 1.4<br/> libexec/httpd/testsuite/test-simple: revisions 1.3, 1.4<br/> libexec/httpd/testsuite/t11.in: revision 1.1<br/> libexec/httpd/testsuite/t11.out: revision 1.1<br/> libexec/httpd/testsuite/cgi-bin/empty: revision 1.1<br/>Update bozohttpd to 20170201:<br/>- fix an infinite loop in cgi processing<br/>- fixes and clean up for the testsuite<br/>- no longer sends encoding header for compressed formats /src/libexec/httpd/testsuite/test-simple - 1.2.4.3 Sun Feb 12 22:07:17 UTC 2017 snj Pull up following revision(s) (requested by mrg in ticket #1309):<br/> libexec/httpd/CHANGES: revisions 1.23, 1.24<br/> libexec/httpd/bozohttpd.8: revisions 1.60-1.62<br/> libexec/httpd/bozohttpd.c: revisions 1.81-1.84<br/> libexec/httpd/bozohttpd.h: revision 1.46<br/> libexec/httpd/cgi-bozo.c: revision 1.35<br/> libexec/httpd/content-bozo.c: revision 1.14<br/> libexec/httpd/main.c: revisions 1.14-1.16<br/> libexec/httpd/testsuite/Makefile: revision 1.6<br/> libexec/httpd/testsuite/test-bigfile: revision 1.3<br/> libexec/httpd/testsuite/test-simple: revisions 1.1, 1.2<br/>update bozohttpd to 2016072:<br/>- fix memory leak<br/>- addd -G option to display version<br/>- fix some content type issues<br/>- fix issues in testsuite /src/libexec/httpd/testsuite/test-simple - 1.2.4.2 Fri Dec 23 07:42:09 UTC 2016 snj file test-simple was added on branch netbsd-7 on 2016-12-23 07:42:09 +0000 /src/libexec/httpd/testsuite/test-simple - 1.2.4.1 Mon Sep 26 00:21:22 UTC 2016 snj Pull up the following revisions (via patch) requested by mrg in ticket #1699:<br/><br/> libexec/httpd/CHANGES 1.31-1.40<br/> libexec/httpd/Makefile 1.28<br/> libexec/httpd/auth-bozo.c 1.23-1.24<br/> libexec/httpd/bozohttpd.8 1.75-1.79<br/> libexec/httpd/bozohttpd.c 1.100-1.113<br/> libexec/httpd/bozohttpd.h 1.58-1.60<br/> libexec/httpd/cgi-bozo.c 1.46-1.48<br/> libexec/httpd/daemon-bozo.c 1.20-1.21<br/> libexec/httpd/dir-index-bozo.c 1.29-1.32<br/> libexec/httpd/ssl-bozo.c 1.26<br/> libexec/httpd/testsuite/Makefile 1.12-1.13<br/> libexec/httpd/testsuite/t11.out 1.2<br/> libexec/httpd/testsuite/test-bigfile 1.6<br/> libexec/httpd/testsuite/test-simple 1.6<br/><br/>Don't display special files in the directory index. They aren't<br/>served, but links to them are generated.<br/>---<br/>All from "Rajeev V. Pillai" <rajeev_v_pillai@yahoo.com>:<br/>- use html tables for directory index.<br/>- don't include "index.html" in html headers<br/>- additional escaping of names<br/>- re-add top/bottom borders<br/>- adds an aquamarine table header<br/>- Zebra-stripes table rows using CSS instead of code<br/>- fix CGI '+' param and error handling.<br/>- remove unused parameter to daemon_poll_err().<br/>- avoid sign extension in % handling<br/>fix a few problems pointed out by clang static analyzer:<br/>- bozostrnsep() may return with "in = NULL", so check for it.<br/>- nul terminating in bozo_escape_rfc3986() can be simpler<br/>- don't use uniinit variables in check_remap()<br/>- don't use re-used freed data in check_virtual().<br/>- fix bozoprefs->size setting when increasing the size (new total was<br/> being added to the prior total.)<br/> however, bozostrdup() may reference request->hr_file.<br/>---<br/>Add ssl specific timeout value (30s). If SSL_accept() doesn't<br/>work with in this timeout value, ssl setup now fails.<br/>---<br/>Fix handling of bozo_set_timeout() timeouts (and `-T' option parsing)<br/>---<br/>Avoid .htpasswd exposure to authenticated users when .htpasswd is<br/>in the slashdir too.<br/>---<br/>Avoid possible NULL dereference when sending a big request that timeout.<br/>---<br/>Use strings.h for strcasecmp (on linux)<br/>---<br/>Account for cgihandler being set when counting the number of CGI environment<br/>headers we are about to set. Avoids an assertion failure (and overruninng<br/>the array) later. /src/libexec/httpd/testsuite/test-simple - 1.2.4.3.2.2 Sat Jun 15 15:56:22 UTC 2019 martin Sync to HEAD (requested by mrg in ticket #1655):<br/><br/> libexec/httpd/testsuite/data/.bzremap up to 1.1<br/> libexec/httpd/testsuite/t12.out up to 1.1<br/> libexec/httpd/testsuite/t12.in up to 1.1<br/> libexec/httpd/testsuite/t13.out up to 1.1<br/> libexec/httpd/testsuite/t13.in up to 1.1<br/> libexec/httpd/testsuite/t14.out up to 1.1<br/> libexec/httpd/testsuite/t14.in up to 1.1<br/> libexec/httpd/testsuite/t15.out up to 1.1<br/> libexec/httpd/testsuite/t15.in up to 1.1<br/> libexec/httpd/CHANGES up to 1.28<br/> libexec/httpd/Makefile up to 1.27<br/> libexec/httpd/auth-bozo.c up to 1.22<br/> libexec/httpd/bozohttpd.8 up to 1.74<br/> libexec/httpd/bozohttpd.c up to 1.96<br/> libexec/httpd/bozohttpd.h up to 1.56<br/> libexec/httpd/cgi-bozo.c up to 1.44<br/> libexec/httpd/content-bozo.c up to 1.16<br/> libexec/httpd/daemon-bozo.c up to 1.19<br/> libexec/httpd/dir-index-bozo.c up to 1.28<br/> libexec/httpd/lua-bozo.c up to 1.15<br/> libexec/httpd/main.c up to 1.21<br/> libexec/httpd/ssl-bozo.c up to 1.25<br/> libexec/httpd/tilde-luzah-bozo.c up to 1.16<br/> libexec/httpd/libbozohttpd/Makefile up to 1.3<br/> libexec/httpd/lua/bozo.lua up to 1.3<br/> libexec/httpd/lua/glue.c up to 1.5<br/> libexec/httpd/lua/optparse.lua up to 1.2<br/> libexec/httpd/testsuite/Makefile up to 1.11<br/> libexec/httpd/testsuite/html_cmp up to 1.6<br/> libexec/httpd/testsuite/t3.out up to 1.4<br/> libexec/httpd/testsuite/t5.out up to 1.4<br/> libexec/httpd/testsuite/t6.out up to 1.4<br/> libexec/httpd/testsuite/test-bigfile up to 1.5<br/> libexec/httpd/testsuite/test-simple up to 1.5<br/><br/>Cosmetic changes to Lua binding in bozohttpd.<br/><br/>- Don't use negative indicies to read arguments of Lua functions.<br/>- On error, return nil, "error string".<br/>- Use ssize_t for return values from bozo_read() and bozo_write().<br/>- Prefer lstring especially when if saves you from appending NUL and<br/> doing len + 1 which can potentially wraparound.<br/>- Don't mix C allocations with Lua functions marked with "m" in the Lua<br/> manual. Those functions may throw (longjump) and leak data allocated<br/> by C function. In one case, I use luaL_Buffer, in the other case,<br/> I rearranged calls a bit.<br/><br/><br/>fix ordering of a couple of words. from Edgar Pettijohn in PR#52375.<br/>thanks!<br/><br/><br/>s/u_int/unsigned/.<br/><br/>from Jan Danielsson. increases/fixes portability.<br/><br/><br/>PR bin/52194: bozohttpd fails to exec scripts via the -C mechanism<br/>sometimes with EFAULT due to not NULL terminated environment.<br/><br/><br/>Document script handler issues with httpd(8).<br/>From martin@, addressing PR 52194.<br/><br/>While here, use American spelling consistently and upper-case some<br/>abbreviations.<br/><br/>Bump date.<br/><br/><br/>fix output since protocol agnostic change went in.<br/><br/>XXX: i thought someone hooked this into atf already, please do :)<br/><br/><br/>Add support for remapping requested paths via a .bzredirect file.<br/>Fixes PR 52772. Ok: mrg@<br/><br/><br/>Bump date<br/><br/><br/>Remove trailing whitespace.<br/><br/><br/>use __func__ in debug().<br/><br/><br/>fix a denial of service attack against header contents, which<br/>is now bounded at 16KiB. reported by JP.<br/><br/><br/>avoid memory leak in sending multiple auth headers.<br/>mostly mitigated by previous patch to limit total header size,<br/>but still a real problem here.<br/><br/><br/>note the changes present in bozohttpd 20181118:<br/><br/>o add url remap support via .bzremap file, from martin%netbsd.org@localhost<br/>o handle redirections for any protocol, not just http:<br/>o fix a denial of service attack against header contents, which<br/> is now bounded at 16KiB. reported by JP.<br/><br/><br/>from CHANGES:<br/><br/>o reduce default timeouts, and add expand timeouts to handle the<br/> initial line, each header, and the total time spent<br/>o add -T option to expose new timeout settings<br/>o minor RFC fixes related to timeout handling responses<br/><br/>old timeouts:<br/>60 seconds for initial request like, 60 seconds per header line,<br/>and no whole timeout (though the recent total header size changes<br/>do introduce one that would be about 11 hours.)<br/>new timeouts:<br/>30 seconds for initial request like, 10 seconds per header line,<br/>and a total request time of 600 seconds.<br/><br/>the new global timeout is implemented using CLOCK_MONOTONIC, with<br/>a fallback to CLOCK_REALTIME if monotonic time is unavailable.<br/><br/>reject multiple Host: headers. besides being protocol standard,<br/>this closes one additional memory leak found by JP. add a simple<br/>test to check this.<br/><br/>clean up option and usage handling some.<br/><br/><br/>move some #if support into bozohttpd.h.<br/><br/><br/>fix previous: have_debug was reversed.<br/><br/><br/>also fix have_dynamic_content from the previous previous. re-order<br/>the debug and dynamic content to match the same pattern as everything<br/>else so similar problems are less likely in the future.<br/><br/><br/>- move special files defines into bozohttpd.h, so we can ...<br/>- consolidate all the special file checks into<br/> bozo_check_special_files() so that all builds check the same<br/> list of special files, regardless of build options.<br/>- convert "(void)bozo_http_error(...); return -1;" into plain<br/> "return bozo_http_error(...);"<br/>- fix the call to bozo_check_special_files() to be used on all<br/> input types. part of the fixes for failure to reject access<br/> to /.htpasswd as reported by JP on tech-security.<br/>- use warn_unused_result attribute on bozo_check_special_files(),<br/> and fix the failures to return failure. second part of the<br/> htpasswd access fix.<br/>- update testsuite to use a fixed fake hostname.<br/><br/>call this bozohttpd 20181121.<br/><br/><br/>two fixes reported by mouse:<br/>- don't check contents of 'st' if stat(2) failed.<br/>- round up instead of truncate. now 10000 byte files say 10kB not 9kB.<br/><br/><br/>use MAP_SHARED for the bzremap file. avoids netbsd kernel complaining:<br/><br/>WARNING: defaulted mmap() share type to MAP_PRIVATE (pid 15478 command bozohttpd)<br/><br/><br/>many clean ups:<br/>- keep a list of special files and their human names<br/>- remove (void) casts on bozo_http_error()<br/>- fix a few more misuses of bozo_http_error()<br/>- rename check_mapping() to check_remap() and perform some CSE<br/>- switch away from ``%s'' to '%s'<br/>- remove a bunch of #ifdef using new have_feature defines<br/><br/><br/>alpha sort the option switch.<br/><br/><br/>add an assert() check on array bounds.<br/><br/><br/>minor style fixes. simplify bozo_match_content_map(). /src/libexec/httpd/testsuite/test-simple - 1.2.4.3.2.1 Sat Nov 24 17:23:21 UTC 2018 martin Sync with HEAD /src/libexec/httpd/testsuite/test-simple - 1.2.2.4 Mon Mar 20 06:57:01 UTC 2017 pgoyette Sync with HEAD. (Note that most of these changes are simply $NetBSD$<br/>tag issues.) /src/libexec/httpd/testsuite/test-simple - 1.2.2.3 Sat Jan 07 08:56:05 UTC 2017 pgoyette