summaryrefslogtreecommitdiff
path: root/libexec/httpd/bozohttpd.c
AgeCommit message (Collapse)Author
2023-06-07serve .iso as "application/octet-stream". bump version & copyright.mrg
2022-09-12Add a -q option to make http quiet (no log messages).martin
Usefull when running multiple instances and some for (high traffic) APIs e.g. to receive log data from appliences - it makes not sense to duplicate the whole log in the xferlog file (but we can't configure that at the syslog level due to other httpd instances using that).
2022-05-18call this bozohttpd 20220517.mrg
2022-04-10fix various typos in comments and output/log messages.andvar
2022-03-14in bozo_init_prefs(), default to returning 1 (success) and if amrg
bozo_set_pref() fails, return 0 instead. fixes PR#54785 but with a different patch.
2022-01-04bozohttpd: remove obsolete .bzdirect handlingkim
OK mrg@
2021-12-10s/occured/occurred/ in comments, log messages and man pages.andvar
2021-08-24implement tls minimum version setting.mrg
mostly from sunil@nimmagadda.net in PR#55830, though i moved the member into the main http structure, so that it doesn't trigger sslinfo being allocated via command line without the rest of the ssl being setup (which then leads to crashes.)
2021-08-24rework the bindport setting, inspired by part of the patchmrg
from PR#56367 (thanks JP.)
2021-08-24remove unused parameters, and clean up incompatible options.mrg
from <henrik@gulbra.net>
2021-08-21fix some more typos in comments/log messages, improve wording as well.andvar
2021-05-05don't assume host BUFSIZ is sufficent. small BUFSIZ leads tomrg
always happens errors in the testsuite. switch all these buffers to be 4KiB sized. reported by embr <git@liclac.eu>
2021-05-05include <stdint.h>. bozo_unconst() uses uintptr_t defined here.mrg
from embr <git@liclac.eu>.
2021-04-08bozohttpd: fix argument type for functions from <ctype.h>rillig
Found by the recently added check to lint (message 342). ok mrg@
2021-04-04avoid DoS in initial request size, which is now bounded at 16KiB.mrg
reported by Justin Parrott in PR#56085.
2021-02-27changes in bozohttpd 20210227:mrg
o new support for content types: .tar.bz2, .tar.xz, .tar.lz, .tar.zst, .tbz2, .txz, .tlz, .zipx, .xz, .zst, .sz, .lz, .lzma, .lzo, .7z, .lzo, .cab, .dmg, .jar, and .rar. should fix netbsd PR#56026: MIME type of .tar.xz file on ny{cdn,ftp}.NetBSD.org is invalid
2021-02-27belated call version 20210211 after previous memory leak fix.mrg
2021-02-11clean up issues detected by address sanitizer (just some memorymrg
leaks that only apply to the library version.) XXX: the handling of hr_file and its variants is more crappy again - the prior clean up is slightly less clean now, but at least it does not leak memory. XXX2: cgi-bin test hangs with address sanitizer. don't know why yet..
2021-02-11changes in bozohttpd 20210210:mrg
o fix various NULL derefs from malformed headers. mostly from <emily@ingalls.rocks>.
2020-11-19Bozohttpd clobbers files greater than 4GB on 32bit archs.hannken
Make sure the alignment mask derived from pagesize is an off_t.
2020-10-15various updates from <henrik@gulbra.net> / freebsd. the list from Henrik:mrg
bozohttpd.8: o Added -d flag to the man page o Moved -E flag in man page to keep alphabetic order o Grammar fix for description of -E flag in man page o Moved a word in the man description for the -f flag o Made -f imply -b as a backwards-compatible shortcut o Updated man description of -n to mention Lua scripts o Moved -z below -Z to keep the uppercase options first bozohttpd.c: o Removed obsolete comment about ~user missing cgi-bin support o Removed "/* ARGSUSED */" lines; was that a macro or a reminder? o Added USE_ARG macro call for sig, which was otherwise not used o Added USE_ARG macro call for msg (only used if debug is enabled) bozohttpd.h: o Fixed typo in the include guard (BOZOHTTOPD_H_ -> BOZOHTTPD_H_) o Renamed have_all to have_core; it didn't mean "all" options content-bozo.c: o Added USE_ARG macro call for signo, which was otherwise not used o Made -f imply -b as a backwards-compatible shortcut main.c: o Simplified -b text to be symmetric with that for the -f option o Updated -C text to make "suffix" explicit; it's better than "arg" o Changed to only show the -E description if have_user is true o Always show the -e option, which incorrectly used the -E logic o Renamed have_all to have_core; it didn't mean "all" options o Added three missing tabs for the description of the -G option o Updated -L text to make "prefix" explicit; it's better than "arg" o Updated -M text to make "suffix" explicit; it's slightly better o Added a previously missing description for the -n option o Documented the otherwise obscure valid types for the -T option o Shortened "username" to "user" to match the actual help text o Moved handling of -c below that for -C to standardize the order o Broke the enabling test for -C into two lines for consistency o Inverted the enabling test for -E; this is what was meant, right? o Removed the enabling test for -e, which should always be enabled ssl-bozo.c: o Added USE_ARG for httpd, which is not used if SSL has been excluded
2020-10-15set -D_GNU_SOURCE in Makefile.boot. from hadrien.lacour@posteo.net.mrg
also match %2F as well as %2f. from leah@vuxu.org. introduce defines for "80" and "443". copyright maint.
2020-09-05avoid passing NULL pointers to printf() like functions and %s.mrg
2020-08-20call this bozohttpd/20200820mrg
2020-08-20compare mmap return again MAP_FAILED not -1 or 0.mrg
2020-08-20send close_notify for the ssl connection before closing the TCP connectionspz
Thanks to Dr. Thomas Orgis for reporting the issue.
2020-07-13Do not report status code 500 to blocklistd(8) Add -DNO_BLOCKLIST_SUPPORTjruoho
to Makefile.boot.
2020-07-11Add blocklistd(8) support.jruoho
2020-07-06Add -R flag to specify a README file to add at the bottom of directoryjmcneill
autoindex listings.
2020-06-07libexec/httpd: Fix the possible -Werror=stringop-truncationfox
Error was reported when build.sh was run with MKLIBCSANITIZER=yes flag. Reviewed by: kamil@, mrg@
2019-02-28call this bozohttpd 20190228, and merge the CHANGES entries from themrg
previous release.
2019-02-28add ssl specific timeout value (30s). if SSL_accept() doesn'tmrg
work with in this timeout value, ssl setup now fails. mostly different from, but inspired from the patch in PR 50655
2019-01-22o don't display special files in the directory index. they aren'tmrg
served, but links to them are generated.
2019-01-18rework size_arrays():mrg
- avoid calloc, use bozomalloc - minor CSE - fix bozoprefs->size setting when increasing the size (new total was being added to the prior total.) found by clang static analyzer from rajeev_v_pillai. pass httpd to size_arrays() now. free(NULL) is legal.
2019-01-18fix a few problems pointed out by clang static analyzer, from rajeev_v_pillai:mrg
- bozostrnsep() may return with "in = NULL", so check for it. - nul terminating in bozo_escape_rfc3986() can be simpler - don't use uniinit variables in check_remap() - don't use re-used freed data in check_virtual(). this one is tricky as the original code was: free(request->hr_file); request->hr_file = bozostrdup(httpd, request, s ? s : "/"); however, bozostrdup() may reference request->hr_file.
2019-01-17- call this 20190116mrg
- adjust the directory indexing again: - don't include "index.html" in html headers - additional escaping of names - re-add top/bottom borders - adds an aquamarine table header - Zebra-stripes table rows using CSS instead of code all from "Rajeev V. Pillai" <rajeev_v_pillai@yahoo.com>
2018-12-15Document last changes and bump version to 20181215leot
Suggested by <mrg>, thanks! (Possible mistakes are mine though!)
2018-12-15Fix handling of bozo_set_timeout() timeouts (and `-T' option parsing)leot
2018-12-15Avoid .htpasswd exposure to authenticated users when .htpasswd isleot
in the slashdir too. Problem reported by JP via tech-security@ and discussed with <mrg>, thanks!
2018-12-15Avoid possible NULL dereference when sending a big request that timeout.leot
Problem reported by <maya> and reviewed by <maya> and <mrg>, thanks!
2018-12-15strings.h for strcasecmp (on linux)maya
2018-12-15Check against BOZO_HEADERS_MAX_SIZE in a way that isn't prone to overflow.maya
Note that this isn't reachable in practice as big requests time out.
2018-12-04use html tables for directory index.mrg
from "Rajeev V. Pillai" <rajeev_v_pillai@yahoo.com> call this bozohttpd 20181204.
2018-12-04avoid sign extension in % handling (and printing 0xFFFFFF beforemrg
wanted values.) from Rajeev V. Pillai.
2018-11-25fix -X option parsing. noted by Rajeev V. Pillai.mrg
2018-11-24avoid c99ism.mrg
2018-11-24- add FALLTHROUGH commentchristos
- one return is usually enough.
2018-11-24call this bozohttpd 20181124.mrg
2018-11-24s/time/val/ to avoid shadowing a global indentifier.mrg
2018-11-23minor style fixes. simplify bozo_match_content_map().mrg