summaryrefslogtreecommitdiff
path: root/libexec/httpd/bozohttpd.h
AgeCommit message (Collapse)Author
2022-09-12Add a -q option to make http quiet (no log messages).martin
Usefull when running multiple instances and some for (high traffic) APIs e.g. to receive log data from appliences - it makes not sense to duplicate the whole log in the xferlog file (but we can't configure that at the syslog level due to other httpd instances using that).
2022-05-18call this bozohttpd 20220517.mrg
2022-01-04bozohttpd: remove obsolete .bzdirect handlingkim
OK mrg@
2021-08-24implement tls minimum version setting.mrg
mostly from sunil@nimmagadda.net in PR#55830, though i moved the member into the main http structure, so that it doesn't trigger sslinfo being allocated via command line without the rest of the ssl being setup (which then leads to crashes.)
2021-05-05don't assume host BUFSIZ is sufficent. small BUFSIZ leads tomrg
always happens errors in the testsuite. switch all these buffers to be 4KiB sized. reported by embr <git@liclac.eu>
2021-02-27belated call version 20210211 after previous memory leak fix.mrg
2021-02-11clean up issues detected by address sanitizer (just some memorymrg
leaks that only apply to the library version.) XXX: the handling of hr_file and its variants is more crappy again - the prior clean up is slightly less clean now, but at least it does not leak memory. XXX2: cgi-bin test hangs with address sanitizer. don't know why yet..
2021-02-11changes in bozohttpd 20210210:mrg
o fix various NULL derefs from malformed headers. mostly from <emily@ingalls.rocks>.
2020-10-15various updates from <henrik@gulbra.net> / freebsd. the list from Henrik:mrg
bozohttpd.8: o Added -d flag to the man page o Moved -E flag in man page to keep alphabetic order o Grammar fix for description of -E flag in man page o Moved a word in the man description for the -f flag o Made -f imply -b as a backwards-compatible shortcut o Updated man description of -n to mention Lua scripts o Moved -z below -Z to keep the uppercase options first bozohttpd.c: o Removed obsolete comment about ~user missing cgi-bin support o Removed "/* ARGSUSED */" lines; was that a macro or a reminder? o Added USE_ARG macro call for sig, which was otherwise not used o Added USE_ARG macro call for msg (only used if debug is enabled) bozohttpd.h: o Fixed typo in the include guard (BOZOHTTOPD_H_ -> BOZOHTTPD_H_) o Renamed have_all to have_core; it didn't mean "all" options content-bozo.c: o Added USE_ARG macro call for signo, which was otherwise not used o Made -f imply -b as a backwards-compatible shortcut main.c: o Simplified -b text to be symmetric with that for the -f option o Updated -C text to make "suffix" explicit; it's better than "arg" o Changed to only show the -E description if have_user is true o Always show the -e option, which incorrectly used the -E logic o Renamed have_all to have_core; it didn't mean "all" options o Added three missing tabs for the description of the -G option o Updated -L text to make "prefix" explicit; it's better than "arg" o Updated -M text to make "suffix" explicit; it's slightly better o Added a previously missing description for the -n option o Documented the otherwise obscure valid types for the -T option o Shortened "username" to "user" to match the actual help text o Moved handling of -c below that for -C to standardize the order o Broke the enabling test for -C into two lines for consistency o Inverted the enabling test for -E; this is what was meant, right? o Removed the enabling test for -e, which should always be enabled ssl-bozo.c: o Added USE_ARG for httpd, which is not used if SSL has been excluded
2020-10-15set -D_GNU_SOURCE in Makefile.boot. from hadrien.lacour@posteo.net.mrg
also match %2F as well as %2f. from leah@vuxu.org. introduce defines for "80" and "443". copyright maint.
2020-08-20send close_notify for the ssl connection before closing the TCP connectionspz
Thanks to Dr. Thomas Orgis for reporting the issue.
2020-07-11Add blocklistd(8) support.jruoho
2020-07-06Add -R flag to specify a README file to add at the bottom of directoryjmcneill
autoindex listings.
2019-03-08on m68010 set BOZO_WRSZ to 16k and BOZO_WRSZ to 64k.mrg
2019-02-28add ssl specific timeout value (30s). if SSL_accept() doesn'tmrg
work with in this timeout value, ssl setup now fails. mostly different from, but inspired from the patch in PR 50655
2019-01-22o don't display special files in the directory index. they aren'tmrg
served, but links to them are generated.
2018-11-24one semicolon is usually enough.christos
2018-11-22many clean ups:mrg
- keep a list of special files and their human names - remove (void) casts on bozo_http_error() - fix a few more misuses of bozo_http_error() - rename check_mapping() to check_remap() and perform some CSE - switch away from ``%s'' to '%s' - remove a bunch of #ifdef using new have_feature defines
2018-11-21- move special files defines into bozohttpd.h, so we can ...mrg
- consolidate all the special file checks into bozo_check_special_files() so that all builds check the same list of special files, regardless of build options. - convert "(void)bozo_http_error(...); return -1;" into plain "return bozo_http_error(...);" - fix the call to bozo_check_special_files() to be used on all input types. part of the fixes for failure to reject access to /.htpasswd as reported by JP on tech-security. - use warn_unused_result attribute on bozo_check_special_files(), and fix the failures to return failure. second part of the htpasswd access fix. - update testsuite to use a fixed fake hostname. call this bozohttpd 20181121.
2018-11-20also fix have_dynamic_content from the previous previous. re-ordermrg
the debug and dynamic content to match the same pattern as everything else so similar problems are less likely in the future.
2018-11-20fix previous: have_debug was reversed.mrg
2018-11-20move some #if support into bozohttpd.h.mrg
2018-11-20from CHANGES:mrg
o reduce default timeouts, and add expand timeouts to handle the initial line, each header, and the total time spent o add -T option to expose new timeout settings o minor RFC fixes related to timeout handling responses old timeouts: 60 seconds for initial request like, 60 seconds per header line, and no whole timeout (though the recent total header size changes do introduce one that would be about 11 hours.) new timeouts: 30 seconds for initial request like, 10 seconds per header line, and a total request time of 600 seconds. the new global timeout is implemented using CLOCK_MONOTONIC, with a fallback to CLOCK_REALTIME if monotonic time is unavailable. reject multiple Host: headers. besides being protocol standard, this closes one additional memory leak found by JP. add a simple test to check this. clean up option and usage handling some.
2018-11-19fix a denial of service attack against header contents, whichmrg
is now bounded at 16KiB. reported by JP.
2018-05-04fix the rest of the compilers.christos
2018-05-04fix lintchristos
2017-01-31call this bozohttpd 20170201.mrg
2016-05-24As proposed in:agc
http://mail-index.netbsd.org/tech-userlevel/2016/05/18/msg009999.html and https://www.netbsd.org/~agc/bozo-20160517.diff add a patch to httpd to return the version string of httpd itself, and use the -G option on the command line to enable this. This gives httpd the ability to show, from the command line, what version is running. % /usr/build/obj/x86_64/usr/src/libexec/httpd/bozohttpd -G bozohttpd version bozohttpd/20160415 %
2016-04-15updates and bozohttpd 20160415:mrg
o add search-word support for CGI o fix a security issue in CGI suffix handler support which would allow remote code execution, from shm@netbsd.org o -C option supports now CGI scripts only
2016-01-02Add the concept of ``reply headers'', that is a SIMPLEQ of headers thatelric
will be included in the HTTP reply. We define this as we are about to add an authentication method that may need to have a conversation with the client.
2015-12-29- convert most asprintf() calls to bozoasprintf().mrg
- don't call getpwuid(0) if we don't need to, or fail it it fails, and remove the 'username' member of bozohttpd_t since it is not used outside of bozo_setup().
2015-12-28rename bozo_err/bozo_warn/bozo_asprintf to bozoerr/etc.mrg
new rule is that function that mirror libc-style functions get no underscore.
2015-12-27several clean ups:mrg
- bozostrdup() gains a request parameter, and uses it to determine what sort of error handling is required - bozo_strdup() dies - size_arrays() reduced slightly, pushing error handling into the caller - convert to size_t for some array indices - bozo_set_pref() and bozo_init_prefs() gain httpd parameters - apply a bunch of manual CSE to vastly reduce the number of times the string "request->hr_httpd" appears. - CGI parse_header() takes a request not httpd now XXX: lua glue updated to call bozo_init_prefs() with htttpd parameter, but i'm only guessing here.
2015-12-12Introduce bozo_strdup and bozo_asprintf to add error checking and reducechristos
code duplication. Note that bozo_strdup is different that bozostrdup; the _ routines exit loging error to syslog or stderr, whereas the non _ routines send error responses to the http client.
2015-12-12- restrict the default list of ciphers to something more securechristos
- restrict ssl options From Travis Paul
2015-10-28* add CGI support for ~user translation (-E switch)shm
* add redirects to ~user translation * fix bugs around ~user translation * add schema detection for absolute redirects * fixed few memory leaks * bunch of minor tweaks * removed -r support * smarter redirects OK mrg@
2015-10-25s/USE_NBUTIL/HAVE_NBUTIL_H/, to match the Makefile.mrg
fixes a merge problem in introduced when merging the QNX patches. from Jan Danielsson.
2015-08-05on QNX, use nbutil.h.mrg
2015-05-02fix content type handling to not hard code (wrong) values for length,mrg
but just call strlen() as needed. call this 20150501. reported by Jan Danielsson for ".svg".
2014-11-21Fixed memory leak in case of multiple authentication headers sent by theshm
client. OK mrg@
2014-07-17rewrite much of the SSL code:mrg
- handle errors in many places they weren't properly - make SSL_accept() an error the main code notices - expand bozo_ssl_err() to include bozo_ssl_warn(), bozo_clear_ssl_queue() - remove empty bozo_ssl_flush()
2014-02-09some fixes for virtual hosting support from Rajeev V. Pillai:mrg
- memory leaks in virtual host plugged - ensure hr_host is only the host/port part when the request contains the hostname in the URI not Host: header. also update the references to the old http/1.1 draft rev 06 to RFC 2616 (fortunately, most sections hadn't moved.)
2014-01-02- update CHANGES with recent changesmrg
- update version to 20140102 - update copyrights - use getcwd() over getwd() - fix lean build (don't include lua)
2013-10-12add Lua scripting support to bozohttpd, see httpd(8) for detailsmbalmer
2013-10-12remove trailing whitespacembalmer
2013-09-04allow compile-time overriding of BOZO_WRSZ/MMAPSZ parameterspooka
2013-07-11prepare for netbsd to be mastersrc for bozohttpd.mrg
2013-07-11copyright maint.mrg
2013-07-11- update CHANGES with recent changesmrg
- export esacpe_html() and use it in directory indexing - update manual to include recent contributors
2013-06-27Redo previous (fixing a memory leak introduced), and while there reworkmartin
virtual server support - in daemonized mode mixed virtual and "main" server usage would alter the virtual hostname depending on order of requests. To fix, move the effective virtual hostname into the request structure and leave the httpd server description static.