summaryrefslogtreecommitdiff
path: root/libexec/httpd
AgeCommit message (Collapse)Author
2021-03-05Pull up the following (all via patch), requested by mrg in ticket #1221:martin
lib/lua/bozohttpd/Makefile (apply patch) libexec/httpd/Makefile 1.30-1.31 libexec/httpd/Makefile.boot 1.7-1.9 libexec/httpd/auth-bozo.c 1.25-1.26 libexec/httpd/bozohttpd.8 1.80-1.87 libexec/httpd/bozohttpd.c 1.114-1.123,1.125-1.128 libexec/httpd/bozohttpd.h 1.61-1.68 libexec/httpd/cgi-bozo.c 1.49-1.53 libexec/httpd/content-bozo.c 1.17-1.20 libexec/httpd/daemon-bozo.c 1-.22 libexec/httpd/dir-index-bozo.c 1.33-1.34 libexec/httpd/main.c 1.23-1.27 libexec/httpd/printenv.lua 1.4-1.5 libexec/httpd/ssl-bozo.c 1.27-1.29 libexec/httpd/libbozohttpd/libbozohttpd.3 1.5-1.6 libexec/httpd/small/Makefile 1.4 libexec/httpd/testsuite/Makefile 1.14 libexec/httpd/testsuite/t16.in 1.1 libexec/httpd/testsuite/t16.out 1.1 libexec/httpd/testsuite/t17.in 1.1 libexec/httpd/testsuite/t17.out 1.1 libexec/httpd/testsuite/t18.in 1.1 libexec/httpd/testsuite/t18.out 1.1 Update to bozohttpd 20210227. Apply lua build fix (no blocklist support on this branch). changes in bozohttpd 20210227: o new support for content types: .tar.bz2, .tar.xz, .tar.lz, .tar.zst, .tbz2, .txz, .tlz, .zipx, .xz, .zst, .sz, .lz, .lzma, .lzo, .7z, .lzo, .cab, .dmg, .jar, and .rar. should fix netbsd PR#56026: MIME type of .tar.xz file on ny{cdn,ftp}.NetBSD.org is invalid changes in bozohttpd 20210211: o fix various NULL derefs from malformed headers. mostly from <emily@ingalls.rocks>. o fix memory leaks in library interface: add bozo_cleanup(). changes in bozohttpd 20201014: o also set -D_GNU_SOURCE in Makefile.boot. from hadrien.lacour@posteo.net. o fix array size botch (assertion, not exploitable.) from martin@netbsd.org. o also match %2F as well as %2f. from leah@vuxu.org. o many manual and help fixes. clean ups for higher lint levels, consistency/style clean ups. various option fixes including made -f imply -b. from <henrik@gulbra.net> for freebsd. changes in bozohttpd 20200912: o add .m4a and .m4v file extensions. changes in bozohttpd 20200820: o make this work on sun2 by reducing mmap window there. o fix SSL shutdown sequence. from spz@netbsd.org. o add readme support to directory indexing. from jmcneill@netbsd.org o add blocklist(8) support. from jruoho@netbsd.org.
2020-11-19Pull up following revision(s) (requested by hannken in ticket #1134):martin
libexec/httpd/bozohttpd.c: revision 1.124 Bozohttpd clobbers files greater than 4GB on 32bit archs. Make sure the alignment mask derived from pagesize is an off_t.
2019-03-29Account for cgihandler being set when counting the number of CGI environmentmartin
headers we are about to set. Avoids an assertion failure (and overruninng the array) later.
2019-03-27add $NetBSD$mrg
2019-03-08on m68010 set BOZO_WRSZ to 16k and BOZO_WRSZ to 64k.mrg
2019-02-28call this bozohttpd 20190228, and merge the CHANGES entries from themrg
previous release.
2019-02-28add ssl specific timeout value (30s). if SSL_accept() doesn'tmrg
work with in this timeout value, ssl setup now fails. mostly different from, but inspired from the patch in PR 50655
2019-01-27fix duplicated chunk from mergedholland
2019-01-27Merge the [pgoyette-compat] branchpgoyette
2019-01-22o don't display special files in the directory index. they aren'tmrg
served, but links to them are generated.
2019-01-18rework size_arrays():mrg
- avoid calloc, use bozomalloc - minor CSE - fix bozoprefs->size setting when increasing the size (new total was being added to the prior total.) found by clang static analyzer from rajeev_v_pillai. pass httpd to size_arrays() now. free(NULL) is legal.
2019-01-18fix a few problems pointed out by clang static analyzer, from rajeev_v_pillai:mrg
- bozostrnsep() may return with "in = NULL", so check for it. - nul terminating in bozo_escape_rfc3986() can be simpler - don't use uniinit variables in check_remap() - don't use re-used freed data in check_virtual(). this one is tricky as the original code was: free(request->hr_file); request->hr_file = bozostrdup(httpd, request, s ? s : "/"); however, bozostrdup() may reference request->hr_file.
2019-01-17- call this 20190116mrg
- adjust the directory indexing again: - don't include "index.html" in html headers - additional escaping of names - re-add top/bottom borders - adds an aquamarine table header - Zebra-stripes table rows using CSS instead of code all from "Rajeev V. Pillai" <rajeev_v_pillai@yahoo.com>
2019-01-17add 'check' target to toplevel makefile.mrg
fix the t11.out output now that CGI parsing works better.
2019-01-17- fix CGI '+' param and error handling.mrg
- remove unused parameter to daemon_poll_err(). both from "Rajeev V. Pillai" <rajeev_v_pillai@yahoo.com>
2019-01-08remove reference to deleted -r option. fixes PR#53840 from J. Lewis Muir.mrg
2018-12-19minor rewording. fix alphabeta ordering of contributors.mrg
2018-12-18fix an old spell-o and a new format-o.mrg
2018-12-15Document last changes and bump version to 20181215leot
Suggested by <mrg>, thanks! (Possible mistakes are mine though!)
2018-12-15Fix handling of bozo_set_timeout() timeouts (and `-T' option parsing)leot
2018-12-15Avoid .htpasswd exposure to authenticated users when .htpasswd isleot
in the slashdir too. Problem reported by JP via tech-security@ and discussed with <mrg>, thanks!
2018-12-15Avoid possible NULL dereference when sending a big request that timeout.leot
Problem reported by <maya> and reviewed by <maya> and <mrg>, thanks!
2018-12-15strings.h for strcasecmp (on linux)maya
2018-12-15Check against BOZO_HEADERS_MAX_SIZE in a way that isn't prone to overflow.maya
Note that this isn't reachable in practice as big requests time out.
2018-12-14Don't pass ${HOST} to test scripts.maya
htnl_cmp compares against the output of `hostname`. This makes the tests pass on my machine.
2018-12-04use html tables for directory index.mrg
from "Rajeev V. Pillai" <rajeev_v_pillai@yahoo.com> call this bozohttpd 20181204.
2018-12-04avoid sign extension in % handling (and printing 0xFFFFFF beforemrg
wanted values.) from Rajeev V. Pillai.
2018-11-25normalise some messages.mrg
2018-11-25add option fixes here.mrg
2018-11-25fix -X option parsing. noted by Rajeev V. Pillai.mrg
2018-11-24avoid c99ism.mrg
2018-11-24- add FALLTHROUGH commentchristos
- one return is usually enough.
2018-11-24appease lintchristos
2018-11-24one semicolon is usually enough.christos
2018-11-24call this bozohttpd 20181124.mrg
2018-11-24fix a bug in the rework for -i option: move the real code in place.mrg
for some reason gcc does not warn about this: case 'x': stuff_here(); break; other_stuff_here(); break; and the other_stuff_here() was what was mis-placed. should fix atf failures in networking.
2018-11-24s/time/val/ to avoid shadowing a global indentifier.mrg
2018-11-23minor style fixes. simplify bozo_match_content_map().mrg
2018-11-22add an assert() check on array bounds.mrg
2018-11-22alpha sort the option switch.mrg
2018-11-22many clean ups:mrg
- keep a list of special files and their human names - remove (void) casts on bozo_http_error() - fix a few more misuses of bozo_http_error() - rename check_mapping() to check_remap() and perform some CSE - switch away from ``%s'' to '%s' - remove a bunch of #ifdef using new have_feature defines
2018-11-21use MAP_SHARED for the bzremap file. avoids netbsd kernel complaining:mrg
WARNING: defaulted mmap() share type to MAP_PRIVATE (pid 15478 command bozohttpd)
2018-11-21two fixes reported by mouse:mrg
- don't check contents of 'st' if stat(2) failed. - round up instead of truncate. now 10000 byte files say 10kB not 9kB.
2018-11-21- move special files defines into bozohttpd.h, so we can ...mrg
- consolidate all the special file checks into bozo_check_special_files() so that all builds check the same list of special files, regardless of build options. - convert "(void)bozo_http_error(...); return -1;" into plain "return bozo_http_error(...);" - fix the call to bozo_check_special_files() to be used on all input types. part of the fixes for failure to reject access to /.htpasswd as reported by JP on tech-security. - use warn_unused_result attribute on bozo_check_special_files(), and fix the failures to return failure. second part of the htpasswd access fix. - update testsuite to use a fixed fake hostname. call this bozohttpd 20181121.
2018-11-20also fix have_dynamic_content from the previous previous. re-ordermrg
the debug and dynamic content to match the same pattern as everything else so similar problems are less likely in the future.
2018-11-20fix previous: have_debug was reversed.mrg
2018-11-20move some #if support into bozohttpd.h.mrg
2018-11-20from CHANGES:mrg
o reduce default timeouts, and add expand timeouts to handle the initial line, each header, and the total time spent o add -T option to expose new timeout settings o minor RFC fixes related to timeout handling responses old timeouts: 60 seconds for initial request like, 60 seconds per header line, and no whole timeout (though the recent total header size changes do introduce one that would be about 11 hours.) new timeouts: 30 seconds for initial request like, 10 seconds per header line, and a total request time of 600 seconds. the new global timeout is implemented using CLOCK_MONOTONIC, with a fallback to CLOCK_REALTIME if monotonic time is unavailable. reject multiple Host: headers. besides being protocol standard, this closes one additional memory leak found by JP. add a simple test to check this. clean up option and usage handling some.
2018-11-19note the changes present in bozohttpd 20181118:mrg
o add url remap support via .bzremap file, from martin@netbsd.org o handle redirections for any protocol, not just http: o fix a denial of service attack against header contents, which is now bounded at 16KiB. reported by JP.
2018-11-19avoid memory leak in sending multiple auth headers.mrg
mostly mitigated by previous patch to limit total header size, but still a real problem here.