| Age | Commit message (Collapse) | Author |
|
|
|
|
|
|
|
Suggested by <mrg>, thanks! (Possible mistakes are mine though!)
|
|
|
|
in the slashdir too.
Problem reported by JP via tech-security@ and discussed with <mrg>, thanks!
|
|
Problem reported by <maya> and reviewed by <maya> and <mrg>, thanks!
|
|
|
|
Note that this isn't reachable in practice as big requests time out.
|
|
htnl_cmp compares against the output of `hostname`.
This makes the tests pass on my machine.
|
|
|
|
|
|
from "Rajeev V. Pillai" <rajeev_v_pillai@yahoo.com>
call this bozohttpd 20181204.
|
|
wanted values.) from Rajeev V. Pillai.
|
|
|
|
version field from the internal object. It is kept in the legacy version
of the main object.
|
|
|
|
|
|
|
|
|
|
- one return is usually enough.
|
|
|
|
|
|
|
|
for some reason gcc does not warn about this:
case 'x':
stuff_here();
break;
other_stuff_here();
break;
and the other_stuff_here() was what was mis-placed.
should fix atf failures in networking.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
- keep a list of special files and their human names
- remove (void) casts on bozo_http_error()
- fix a few more misuses of bozo_http_error()
- rename check_mapping() to check_remap() and perform some CSE
- switch away from ``%s'' to '%s'
- remove a bunch of #ifdef using new have_feature defines
|
|
WARNING: defaulted mmap() share type to MAP_PRIVATE (pid 15478 command bozohttpd)
|
|
- don't check contents of 'st' if stat(2) failed.
- round up instead of truncate. now 10000 byte files say 10kB not 9kB.
|
|
- consolidate all the special file checks into
bozo_check_special_files() so that all builds check the same
list of special files, regardless of build options.
- convert "(void)bozo_http_error(...); return -1;" into plain
"return bozo_http_error(...);"
- fix the call to bozo_check_special_files() to be used on all
input types. part of the fixes for failure to reject access
to /.htpasswd as reported by JP on tech-security.
- use warn_unused_result attribute on bozo_check_special_files(),
and fix the failures to return failure. second part of the
htpasswd access fix.
- update testsuite to use a fixed fake hostname.
call this bozohttpd 20181121.
|
|
the debug and dynamic content to match the same pattern as everything
else so similar problems are less likely in the future.
|
|
|
|
|
|
o reduce default timeouts, and add expand timeouts to handle the
initial line, each header, and the total time spent
o add -T option to expose new timeout settings
o minor RFC fixes related to timeout handling responses
old timeouts:
60 seconds for initial request like, 60 seconds per header line,
and no whole timeout (though the recent total header size changes
do introduce one that would be about 11 hours.)
new timeouts:
30 seconds for initial request like, 10 seconds per header line,
and a total request time of 600 seconds.
the new global timeout is implemented using CLOCK_MONOTONIC, with
a fallback to CLOCK_REALTIME if monotonic time is unavailable.
reject multiple Host: headers. besides being protocol standard,
this closes one additional memory leak found by JP. add a simple
test to check this.
clean up option and usage handling some.
|
|
o add url remap support via .bzremap file, from martin@netbsd.org
o handle redirections for any protocol, not just http:
o fix a denial of service attack against header contents, which
is now bounded at 16KiB. reported by JP.
|
|
mostly mitigated by previous patch to limit total header size,
but still a real problem here.
|
|
is now bounded at 16KiB. reported by JP.
|
|
|
|
and has eben since 2009. Adapt.
NFCI - while the tv_usec (now tv_nsec) field is used, we will
keep its uses to microsecond precision to avoid any compat issues.
|
|
Early ELF binaries defined dlopen and friends in crt0.o by
using function pointers in the object handle passed from rtld.
This contract wastes space when many shared objects are allocated
and ties dynamic linker and rest of the system tightly together.
Fake the entry points in a static object and restrict them to the
platforms that had working ELF support at the time. Keep the magic and
version field used by modern crt0.o for all architectures. The checks
will be removed from crt0.o in a follow-up step.
|
|
- This conversion significantly simplifies the code and moves NPF to
a binary serialisation format (replacing the XML-like format).
- Fix some memory/reference leaks and possibly use-after-free bugs.
- Bump NPF_VERSION as this change makes libnpf incompatible with the
previous versions. Also, different serialisation format means NPF
connection/config saving and loading is not compatible with the
previous versions either.
Thanks to christos@ for extra testing.
|
|
|
|
In large part from FreeBSD.
|
|
|
|
|