summaryrefslogtreecommitdiff
path: root/libexec/httpd
AgeCommit message (Collapse)Author
2017-10-05s/u_int/unsigned/.mrg
from Jan Danielsson. increases/fixes portability.
2017-07-07fix ordering of a couple of words. from Edgar Pettijohn in PR#52375.mrg
thanks!
2017-07-03Remove workaround for ancient HTML generation code.wiz
2017-05-28Cosmetic changes to Lua binding in bozohttpd.alnsn
- Don't use negative indicies to read arguments of Lua functions. - On error, return nil, "error string". - Use ssize_t for return values from bozo_read() and bozo_write(). - Prefer lstring especially when if saves you from appending NUL and doing len + 1 which can potentially wraparound. - Don't mix C allocations with Lua functions marked with "m" in the Lua manual. Those functions may throw (longjump) and leak data allocated by C function. In one case, I use luaL_Buffer, in the other case, I rearranged calls a bit.
2017-05-21Remove MKCRYPTO option.riastradh
Originally, MKCRYPTO was introduced because the United States classified cryptography as a munition and restricted its export. The export controls were substantially relaxed fifteen years ago, and are essentially irrelevant for software with published source code. In the intervening time, nobody bothered to remove the option after its motivation -- the US export restriction -- was eliminated. I'm not aware of any other operating system that has a similar option; I expect it is mainly out of apathy for churn that we still have it. Today, cryptography is an essential part of modern computing -- you can't use the internet responsibly without cryptography. The position of the TNF board of directors is that TNF makes no representation that MKCRYPTO=no satisfies any country's cryptography regulations. My personal position is that the availability of cryptography is a basic human right; that any local laws restricting it to a privileged few are fundamentally immoral; and that it is wrong for developers to spend effort crippling cryptography to work around such laws. As proposed on tech-crypto, tech-security, and tech-userlevel to no objections: https://mail-index.netbsd.org/tech-crypto/2017/05/06/msg000719.html https://mail-index.netbsd.org/tech-security/2017/05/06/msg000928.html https://mail-index.netbsd.org/tech-userlevel/2017/05/06/msg010547.html P.S. Reviewing all the uses of MKCRYPTO in src revealed a lot of *bad* crypto that was conditional on it, e.g. DES in telnet... That should probably be removed too, but on the grounds that it is bad, not on the grounds that it is (nominally) crypto.
2017-02-05uh, this is actually called 20170201 :-)mrg
2017-02-04fix the prototype for bozo_set_pref(). from cfkochmrg
2017-01-31call this bozohttpd 20170201.mrg
2017-01-31- fix a bug in cgi processing. from Dennis Lindroos.mrg
- add a testcase for this, and expand test-simple to handle additional args to bozohttpd for eg, cgi-bin setting. - fix objdir bugs in the testsuite.
2017-01-20Fix typo: s/suport/supportabhinav
2016-12-27When testing non-verbosely, show diff on failure. ok mrg@schmonz
2016-12-21Fix sentences at a couple of places.abhinav
2016-12-11there was a bug fix in july. call this 20160720.mrg
2016-10-04update the -V documentation to be more clear about what it does.mrg
inspired by Swift Griggs on netbsd-users.
2016-10-04add -V to the usage() list. noted by Swift Griggs on netbsd-users.mrg
2016-09-26Missed in previous: exit 1 if html_cmp says no match.schmonz
2016-09-23Add a VERBOSE knob to the testsuite ("yes" by default, producingschmonz
basically the same output as before). When turned off, tests run silently except when there's a failure. Reviewed by mrg@.
2016-08-20use netbsd rcsidmrg
2016-07-19Do not send encoding header for compressed formats.shm
2016-06-30avoid an impossible case the compiler can't quite tell.mrg
2016-05-24As proposed in:agc
http://mail-index.netbsd.org/tech-userlevel/2016/05/18/msg009999.html and https://www.netbsd.org/~agc/bozo-20160517.diff add a patch to httpd to return the version string of httpd itself, and use the -G option on the command line to enable this. This gives httpd the ability to show, from the command line, what version is running. % /usr/build/obj/x86_64/usr/src/libexec/httpd/bozohttpd -G bozohttpd version bozohttpd/20160415 %
2016-04-24CID 1358679: Fix memory leak.christos
XXX: pullup 7
2016-04-15use %zu instead of %lu for size_t.mrg
2016-04-15updates and bozohttpd 20160415:mrg
o add search-word support for CGI o fix a security issue in CGI suffix handler support which would allow remote code execution, from shm@netbsd.org o -C option supports now CGI scripts only
2016-01-02Fix bug in cleanup of reply headers.elric
2016-01-02Add the concept of ``reply headers'', that is a SIMPLEQ of headers thatelric
will be included in the HTTP reply. We define this as we are about to add an authentication method that may need to have a conversation with the client.
2015-12-31bump the version; we have real fixes now.mrg
2015-12-31redo the fix for rev 1.26 - instead of getting a new string wrong,mrg
just delay the free until the parent has finished using them. also, free query as well. fixes PR#50374.
2015-12-29rewrite the redirection url generation code to use bozoasprintf().mrg
2015-12-29- convert most asprintf() calls to bozoasprintf().mrg
- don't call getpwuid(0) if we don't need to, or fail it it fails, and remove the 'username' member of bozohttpd_t since it is not used outside of bozo_setup().
2015-12-28rename bozo_err/bozo_warn/bozo_asprintf to bozoerr/etc.mrg
new rule is that function that mirror libc-style functions get no underscore.
2015-12-27several clean ups:mrg
- bozostrdup() gains a request parameter, and uses it to determine what sort of error handling is required - bozo_strdup() dies - size_arrays() reduced slightly, pushing error handling into the caller - convert to size_t for some array indices - bozo_set_pref() and bozo_init_prefs() gain httpd parameters - apply a bunch of manual CSE to vastly reduce the number of times the string "request->hr_httpd" appears. - CGI parse_header() takes a request not httpd now XXX: lua glue updated to call bozo_init_prefs() with htttpd parameter, but i'm only guessing here.
2015-12-27fix running the testsuite from the build treemrg
2015-12-12Introduce bozo_strdup and bozo_asprintf to add error checking and reducechristos
code duplication. Note that bozo_strdup is different that bozostrdup; the _ routines exit loging error to syslog or stderr, whereas the non _ routines send error responses to the http client.
2015-12-12- restrict the default list of ciphers to something more securechristos
- restrict ssl options From Travis Paul
2015-12-07Improve the httpd(8) printenv.lua Lua examplekamil
Stop using Lua builtin print function and replace them with http.* ones. httpd.print and http.write wraps SSL support when needed. Print http headers, without them browser may interpret page as raw text. No need to hardcode prefix path in the form. Add comments for a user with tips how to use this script. Patch by Travis Paul Closes PR misc/50502
2015-11-29Bump date for previouskamil
2015-11-29Synchronize SYNOPSIS with realitykamil
2015-11-29Remove nonexistent option z: in the getopt(3) callkamil
2015-10-31handle asprintf errors consistently.christos
2015-10-30fix wrong variablechristos
2015-10-30simplifychristos
2015-10-30- don't use alloca and then check if alloca returns null and then try tochristos
free it. Allocating from the stack does not return null, and freeing it will have unpredictable results. use malloc instead. - now we are using malloc remove -Wno-stack-protector kludge
2015-10-30Fix build with "USE_SSP" set to "yes".tron
2015-10-28* add CGI support for ~user translation (-E switch)shm
* add redirects to ~user translation * fix bugs around ~user translation * add schema detection for absolute redirects * fixed few memory leaks * bunch of minor tweaks * removed -r support * smarter redirects OK mrg@
2015-10-25s/USE_NBUTIL/HAVE_NBUTIL_H/, to match the Makefile.mrg
fixes a merge problem in introduced when merging the QNX patches. from Jan Danielsson.
2015-08-27s/dirname/dirpath/ to avoid potentially shadowing dirname(3).mrg
2015-08-13Remove trailing space in boast.wiz
2015-08-13Extend AUTHORS section. Nobody likes a braggart.shm
OK mrg@
2015-08-05on QNX, use nbutil.h.mrg