summaryrefslogtreecommitdiff
path: root/libexec
AgeCommit message (Collapse)Author
2018-12-19minor rewording. fix alphabeta ordering of contributors.mrg
2018-12-18fix an old spell-o and a new format-o.mrg
2018-12-15Remove mention of SPX.maya
2018-12-15Document last changes and bump version to 20181215leot
Suggested by <mrg>, thanks! (Possible mistakes are mine though!)
2018-12-15Fix handling of bozo_set_timeout() timeouts (and `-T' option parsing)leot
2018-12-15Avoid .htpasswd exposure to authenticated users when .htpasswd isleot
in the slashdir too. Problem reported by JP via tech-security@ and discussed with <mrg>, thanks!
2018-12-15Avoid possible NULL dereference when sending a big request that timeout.leot
Problem reported by <maya> and reviewed by <maya> and <mrg>, thanks!
2018-12-15strings.h for strcasecmp (on linux)maya
2018-12-15Check against BOZO_HEADERS_MAX_SIZE in a way that isn't prone to overflow.maya
Note that this isn't reachable in practice as big requests time out.
2018-12-14Don't pass ${HOST} to test scripts.maya
htnl_cmp compares against the output of `hostname`. This makes the tests pass on my machine.
2018-12-13IPFilter 5 requires you to specify IPv4 or IPv6sborrill
2018-12-13Remove unused macros.maya
2018-12-04use html tables for directory index.mrg
from "Rajeev V. Pillai" <rajeev_v_pillai@yahoo.com> call this bozohttpd 20181204.
2018-12-04avoid sign extension in % handling (and printing 0xFFFFFF beforemrg
wanted values.) from Rajeev V. Pillai.
2018-12-01Fix typosskrll
2018-11-26Now that lib/csu no longer uses the object handle, drop the magic andjoerg
version field from the internal object. It is kept in the legacy version of the main object.
2018-11-25normalise some messages.mrg
2018-11-25add option fixes here.mrg
2018-11-25fix -X option parsing. noted by Rajeev V. Pillai.mrg
2018-11-24avoid c99ism.mrg
2018-11-24- add FALLTHROUGH commentchristos
- one return is usually enough.
2018-11-24appease lintchristos
2018-11-24one semicolon is usually enough.christos
2018-11-24call this bozohttpd 20181124.mrg
2018-11-24fix a bug in the rework for -i option: move the real code in place.mrg
for some reason gcc does not warn about this: case 'x': stuff_here(); break; other_stuff_here(); break; and the other_stuff_here() was what was mis-placed. should fix atf failures in networking.
2018-11-24s/time/val/ to avoid shadowing a global indentifier.mrg
2018-11-23Fix RTLD_DEBUG_RELOC buildskrll
2018-11-23Trailing whitespaceskrll
2018-11-23minor style fixes. simplify bozo_match_content_map().mrg
2018-11-22add an assert() check on array bounds.mrg
2018-11-22alpha sort the option switch.mrg
2018-11-22many clean ups:mrg
- keep a list of special files and their human names - remove (void) casts on bozo_http_error() - fix a few more misuses of bozo_http_error() - rename check_mapping() to check_remap() and perform some CSE - switch away from ``%s'' to '%s' - remove a bunch of #ifdef using new have_feature defines
2018-11-21use MAP_SHARED for the bzremap file. avoids netbsd kernel complaining:mrg
WARNING: defaulted mmap() share type to MAP_PRIVATE (pid 15478 command bozohttpd)
2018-11-21two fixes reported by mouse:mrg
- don't check contents of 'st' if stat(2) failed. - round up instead of truncate. now 10000 byte files say 10kB not 9kB.
2018-11-21- move special files defines into bozohttpd.h, so we can ...mrg
- consolidate all the special file checks into bozo_check_special_files() so that all builds check the same list of special files, regardless of build options. - convert "(void)bozo_http_error(...); return -1;" into plain "return bozo_http_error(...);" - fix the call to bozo_check_special_files() to be used on all input types. part of the fixes for failure to reject access to /.htpasswd as reported by JP on tech-security. - use warn_unused_result attribute on bozo_check_special_files(), and fix the failures to return failure. second part of the htpasswd access fix. - update testsuite to use a fixed fake hostname. call this bozohttpd 20181121.
2018-11-20also fix have_dynamic_content from the previous previous. re-ordermrg
the debug and dynamic content to match the same pattern as everything else so similar problems are less likely in the future.
2018-11-20fix previous: have_debug was reversed.mrg
2018-11-20move some #if support into bozohttpd.h.mrg
2018-11-20from CHANGES:mrg
o reduce default timeouts, and add expand timeouts to handle the initial line, each header, and the total time spent o add -T option to expose new timeout settings o minor RFC fixes related to timeout handling responses old timeouts: 60 seconds for initial request like, 60 seconds per header line, and no whole timeout (though the recent total header size changes do introduce one that would be about 11 hours.) new timeouts: 30 seconds for initial request like, 10 seconds per header line, and a total request time of 600 seconds. the new global timeout is implemented using CLOCK_MONOTONIC, with a fallback to CLOCK_REALTIME if monotonic time is unavailable. reject multiple Host: headers. besides being protocol standard, this closes one additional memory leak found by JP. add a simple test to check this. clean up option and usage handling some.
2018-11-19note the changes present in bozohttpd 20181118:mrg
o add url remap support via .bzremap file, from martin@netbsd.org o handle redirections for any protocol, not just http: o fix a denial of service attack against header contents, which is now bounded at 16KiB. reported by JP.
2018-11-19avoid memory leak in sending multiple auth headers.mrg
mostly mitigated by previous patch to limit total header size, but still a real problem here.
2018-11-19fix a denial of service attack against header contents, whichmrg
is now bounded at 16KiB. reported by JP.
2018-11-18use __func__ in debug().mrg
2018-10-30sysctl(KERN_BOOTTIME) is a struct timespec, not struct timevalkre
and has eben since 2009. Adapt. NFCI - while the tv_usec (now tv_nsec) field is used, we will keep its uses to microsecond precision to avoid any compat issues.
2018-10-17Move compatibility for pre-2.0 ELF binaries into separate file.joerg
Early ELF binaries defined dlopen and friends in crt0.o by using function pointers in the object handle passed from rtld. This contract wastes space when many shared objects are allocated and ties dynamic linker and rest of the system tightly together. Fake the entry points in a static object and restrict them to the platforms that had working ELF support at the time. Keep the magic and version field used by modern crt0.o for all architectures. The checks will be removed from crt0.o in a follow-up step.
2018-09-29NPF: Major rework -- migrate NPF to the libnv library.rmind
- This conversion significantly simplifies the code and moves NPF to a binary serialisation format (replacing the XML-like format). - Fix some memory/reference leaks and possibly use-after-free bugs. - Bump NPF_VERSION as this change makes libnpf incompatible with the previous versions. Also, different serialisation format means NPF connection/config saving and loading is not compatible with the previous versions either. Thanks to christos@ for extra testing.
2018-09-20Revise previous to not deadlock.jakllsch
2018-09-20Improve support for R_AARCH64_TLSDESC relocations.jakllsch
In large part from FreeBSD.
2018-08-24Remove trailing whitespace.wiz
2018-08-24Bump datemartin