| Age | Commit message (Collapse) | Author |
|
Usefull when running multiple instances and some for (high traffic)
APIs e.g. to receive log data from appliences - it makes not sense
to duplicate the whole log in the xferlog file (but we can't configure
that at the syslog level due to other httpd instances using that).
|
|
|
|
OK mrg@
|
|
mostly from sunil@nimmagadda.net in PR#55830, though i moved the
member into the main http structure, so that it doesn't trigger
sslinfo being allocated via command line without the rest of the
ssl being setup (which then leads to crashes.)
|
|
always happens errors in the testsuite. switch all these buffers
to be 4KiB sized. reported by embr <git@liclac.eu>
|
|
|
|
leaks that only apply to the library version.)
XXX: the handling of hr_file and its variants is more crappy
again - the prior clean up is slightly less clean now, but at
least it does not leak memory.
XXX2: cgi-bin test hangs with address sanitizer. don't know
why yet..
|
|
o fix various NULL derefs from malformed headers. mostly from
<emily@ingalls.rocks>.
|
|
bozohttpd.8:
o Added -d flag to the man page
o Moved -E flag in man page to keep alphabetic order
o Grammar fix for description of -E flag in man page
o Moved a word in the man description for the -f flag
o Made -f imply -b as a backwards-compatible shortcut
o Updated man description of -n to mention Lua scripts
o Moved -z below -Z to keep the uppercase options first
bozohttpd.c:
o Removed obsolete comment about ~user missing cgi-bin support
o Removed "/* ARGSUSED */" lines; was that a macro or a reminder?
o Added USE_ARG macro call for sig, which was otherwise not used
o Added USE_ARG macro call for msg (only used if debug is enabled)
bozohttpd.h:
o Fixed typo in the include guard (BOZOHTTOPD_H_ -> BOZOHTTPD_H_)
o Renamed have_all to have_core; it didn't mean "all" options
content-bozo.c:
o Added USE_ARG macro call for signo, which was otherwise not used
o Made -f imply -b as a backwards-compatible shortcut
main.c:
o Simplified -b text to be symmetric with that for the -f option
o Updated -C text to make "suffix" explicit; it's better than "arg"
o Changed to only show the -E description if have_user is true
o Always show the -e option, which incorrectly used the -E logic
o Renamed have_all to have_core; it didn't mean "all" options
o Added three missing tabs for the description of the -G option
o Updated -L text to make "prefix" explicit; it's better than "arg"
o Updated -M text to make "suffix" explicit; it's slightly better
o Added a previously missing description for the -n option
o Documented the otherwise obscure valid types for the -T option
o Shortened "username" to "user" to match the actual help text
o Moved handling of -c below that for -C to standardize the order
o Broke the enabling test for -C into two lines for consistency
o Inverted the enabling test for -E; this is what was meant, right?
o Removed the enabling test for -e, which should always be enabled
ssl-bozo.c:
o Added USE_ARG for httpd, which is not used if SSL has been excluded
|
|
also match %2F as well as %2f. from leah@vuxu.org.
introduce defines for "80" and "443". copyright maint.
|
|
Thanks to Dr. Thomas Orgis for reporting the issue.
|
|
|
|
autoindex listings.
|
|
|
|
work with in this timeout value, ssl setup now fails.
mostly different from, but inspired from the patch in PR 50655
|
|
served, but links to them are generated.
|
|
|
|
- keep a list of special files and their human names
- remove (void) casts on bozo_http_error()
- fix a few more misuses of bozo_http_error()
- rename check_mapping() to check_remap() and perform some CSE
- switch away from ``%s'' to '%s'
- remove a bunch of #ifdef using new have_feature defines
|
|
- consolidate all the special file checks into
bozo_check_special_files() so that all builds check the same
list of special files, regardless of build options.
- convert "(void)bozo_http_error(...); return -1;" into plain
"return bozo_http_error(...);"
- fix the call to bozo_check_special_files() to be used on all
input types. part of the fixes for failure to reject access
to /.htpasswd as reported by JP on tech-security.
- use warn_unused_result attribute on bozo_check_special_files(),
and fix the failures to return failure. second part of the
htpasswd access fix.
- update testsuite to use a fixed fake hostname.
call this bozohttpd 20181121.
|
|
the debug and dynamic content to match the same pattern as everything
else so similar problems are less likely in the future.
|
|
|
|
|
|
o reduce default timeouts, and add expand timeouts to handle the
initial line, each header, and the total time spent
o add -T option to expose new timeout settings
o minor RFC fixes related to timeout handling responses
old timeouts:
60 seconds for initial request like, 60 seconds per header line,
and no whole timeout (though the recent total header size changes
do introduce one that would be about 11 hours.)
new timeouts:
30 seconds for initial request like, 10 seconds per header line,
and a total request time of 600 seconds.
the new global timeout is implemented using CLOCK_MONOTONIC, with
a fallback to CLOCK_REALTIME if monotonic time is unavailable.
reject multiple Host: headers. besides being protocol standard,
this closes one additional memory leak found by JP. add a simple
test to check this.
clean up option and usage handling some.
|
|
is now bounded at 16KiB. reported by JP.
|
|
|
|
|
|
|
|
http://mail-index.netbsd.org/tech-userlevel/2016/05/18/msg009999.html
and
https://www.netbsd.org/~agc/bozo-20160517.diff
add a patch to httpd to return the version string of httpd itself, and use the
-G option on the command line to enable this. This gives httpd the ability to
show, from the command line, what version is running.
% /usr/build/obj/x86_64/usr/src/libexec/httpd/bozohttpd -G
bozohttpd version bozohttpd/20160415
%
|
|
o add search-word support for CGI
o fix a security issue in CGI suffix handler support which would
allow remote code execution, from shm@netbsd.org
o -C option supports now CGI scripts only
|
|
will be included in the HTTP reply. We define this as we are about to
add an authentication method that may need to have a conversation with
the client.
|
|
- don't call getpwuid(0) if we don't need to, or fail it it fails,
and remove the 'username' member of bozohttpd_t since it is not
used outside of bozo_setup().
|
|
new rule is that function that mirror libc-style functions get no underscore.
|
|
- bozostrdup() gains a request parameter, and uses it to determine
what sort of error handling is required
- bozo_strdup() dies
- size_arrays() reduced slightly, pushing error handling into the caller
- convert to size_t for some array indices
- bozo_set_pref() and bozo_init_prefs() gain httpd parameters
- apply a bunch of manual CSE to vastly reduce the number of times the
string "request->hr_httpd" appears.
- CGI parse_header() takes a request not httpd now
XXX: lua glue updated to call bozo_init_prefs() with htttpd parameter,
but i'm only guessing here.
|
|
code duplication.
Note that bozo_strdup is different that bozostrdup; the _ routines exit
loging error to syslog or stderr, whereas the non _ routines send error
responses to the http client.
|
|
- restrict ssl options
From Travis Paul
|
|
* add redirects to ~user translation
* fix bugs around ~user translation
* add schema detection for absolute redirects
* fixed few memory leaks
* bunch of minor tweaks
* removed -r support
* smarter redirects
OK mrg@
|
|
fixes a merge problem in introduced when merging the QNX patches.
from Jan Danielsson.
|
|
|
|
but just call strlen() as needed. call this 20150501.
reported by Jan Danielsson for ".svg".
|
|
client.
OK mrg@
|
|
- handle errors in many places they weren't properly
- make SSL_accept() an error the main code notices
- expand bozo_ssl_err() to include bozo_ssl_warn(), bozo_clear_ssl_queue()
- remove empty bozo_ssl_flush()
|
|
- memory leaks in virtual host plugged
- ensure hr_host is only the host/port part when the request
contains the hostname in the URI not Host: header.
also update the references to the old http/1.1 draft rev 06
to RFC 2616 (fortunately, most sections hadn't moved.)
|
|
- update version to 20140102
- update copyrights
- use getcwd() over getwd()
- fix lean build (don't include lua)
|
|
|
|
|
|
|
|
|
|
|
|
- export esacpe_html() and use it in directory indexing
- update manual to include recent contributors
|
|
virtual server support - in daemonized mode mixed virtual and "main"
server usage would alter the virtual hostname depending on order of
requests.
To fix, move the effective virtual hostname into the request structure
and leave the httpd server description static.
|