1$NetBSD: CHANGES,v 1.56 2024/04/28 17:12:30 maya Exp $ 2 3changes in bozohttpd 20240428: 4 o make directory listings mobile friendly. from D. Bohdan. 5 6changes in bozohttpd 20240126: 7 o add some more default mime types. 8 o fix memory leaks. from shm. 9 o fix reading 2 bytes beyond '%', possibly not mapped. from shm. 10 o support openssl 3. from christos. 11 o add -q option to not log. from martin. 12 o fix default return value of bozo_set_defaults(), PR#54785. 13 14changes in bozohttpd 20220104: 15 o remove obsolete .bzdirect handling. 16 17changes in bozohttpd 20210824: 18 o new "-m tlsversion" option to set the minimum TLS version 19 available. partially from <sunil@nimmagadda.net>. 20 o extend the list of available ciphers to include most of the 21 openssl "HIGH" with some additional disables. retain the current 22 list of bad options. should deal with PR#51278. 23 24changes in bozohttpd 20210504: 25 o don't assume host BUFSIZ is sufficient. small BUFSIZ leads to 26 always happens errors in the testsuite. switch all these buffers 27 to be 4KiB sized. reported by embr <git@liclac.eu> 28 29changes in bozohttpd 20210403: 30 o fix a denial of service attack against initial request contents, 31 now bounded at 16KiB. reported by Justin Parrott in PR#56085 32 33changes in bozohttpd 20210227: 34 o new support for content types: .tar.bz2, .tar.xz, .tar.lz, 35 .tar.zst, .tbz2, .txz, .tlz, .zipx, .xz, .zst, .sz, .lz, .lzma, 36 .lzo, .7z, .lzo, .cab, .dmg, .jar, and .rar. should fix 37 netbsd PR#56026: 38 MIME type of .tar.xz file on ny{cdn,ftp}.NetBSD.org is invalid 39 40changes in bozohttpd 20210211: 41 o fix various NULL derefs from malformed headers. mostly from 42 <emily@ingalls.rocks>. 43 o fix memory leaks in library interface: add bozo_cleanup(). 44 45changes in bozohttpd 20201014: 46 o also set -D_GNU_SOURCE in Makefile.boot. from 47 hadrien.lacour@posteo.net. 48 o fix array size botch (assertion, not exploitable.) from 49 martin@netbsd.org. 50 o also match %2F as well as %2f. from leah@vuxu.org. 51 o many manual and help fixes. clean ups for higher lint levels, 52 consistency/style clean ups. various option fixes including made 53 -f imply -b. from <henrik@gulbra.net> for freebsd. 54 55changes in bozohttpd 20200912: 56 o add .m4a and .m4v file extensions. 57 58changes in bozohttpd 20200820: 59 o make this work on sun2 by reducing mmap window there. 60 o fix SSL shutdown sequence. from spz@netbsd.org. 61 o add readme support to directory indexing. from jmcneill@netbsd.org 62 o add blocklist(8) support. from jruoho@netbsd.org. 63 64changes in bozohttpd 20190228: 65 o extend timeout facility to ssl and stop servers hanging forever 66 if the client never sends anything. reported by Steffen in netbsd 67 PR#50655. 68 o don't display special files in the directory index. they aren't 69 served, but links to them are generated. 70 o fix CGI '+' parameter handling, some error checking, and a double 71 free. from rajeev_v_pillai@yahoo.com 72 o more directory indexing clean up. from rajeev_v_pillai@yahoo.com 73 74changes in bozohttpd 20181215: 75 o fix .htpasswd bypass for authenticated users. reported by JP, 76 from leot@netbsd.org 77 o avoid possible null dereference when receiving a big request that 78 timeout. reported by maya@netbsd.org, from leot@netbsd.org 79 o fix handling of -T option, from leot@netbsd.org 80 o cleanups and portability improvements, from maya@netbsd.org 81 o change directory indexing to use html tables, from 82 rajeev_v_pillai@yahoo.com 83 84changes in bozohttpd 20181125: 85 o fixes for option parsing introduced in bozohttpd 20181123 86 87changes in bozohttpd 20181121: 88 o add url remap support via .bzremap file, from martin@netbsd.org 89 o handle redirections for any protocol, not just http: 90 o fix a denial of service attack against header contents, which 91 is now bounded at 16KiB. reported by JP 92 o reduce default timeouts, and add expand timeouts to handle the 93 initial line, each header, and the total time spent 94 o add -T option to expose new timeout settings 95 o minor RFC fixes related to timeout handling 96 o fix special file (.htpasswd, .bz*) bypass. reported by JP 97 98changes in bozohttpd 20170201: 99 o fix an infinite loop in cgi processing 100 o fixes and clean up for the testsuite 101 o no longer sends encoding header for compressed formats 102 103changes in bozohttpd 20160517: 104 o add a bozo_get_version() function which returns the version number 105 106changes in bozohttpd 20160415: 107 o add search-word support for CGI 108 o fix a security issue in CGI suffix handler support which would 109 allow remote code execution, from shm@netbsd.org 110 o -C option supports now CGI scripts only 111 112changes in bozohttpd 20151028: 113 o add CGI support for ~user translation (-E switch) 114 o add redirects to ~user translation 115 o fix bugs around ~user translation 116 o add schema detection for absolute redirects 117 o fixed few memory leaks 118 o bunch of minor tweaks 119 o removed -r support 120 o smarter redirects 121 122changes in bozohttpd 20150320: 123 o fix redirection handling 124 o support transport stream (.ts) and video object (.vob) files 125 o directory listings show correct file sizes for large files 126 127changes in bozohttpd 20140717: 128 o properly handle SSL errors 129 130changes in bozohttpd 20140708: 131 o fixes for virtual host support, from rajeev_v_pillai@yahoo.com 132 o avoid printing double errors, from shm@netbsd.org 133 o fix a security issue in basic HTTP authentication which would allow 134 authentication to be bypassed, from shm@netbsd.org 135 136changes in bozohttpd 20140201: 137 o support .svg files 138 o fix a core dump when requests timeout 139 140changes in bozohttpd 20140102: 141 o update a few content types 142 o add support for directly calling lua scripts to handle 143 processes, from mbalmer@netbsd.org 144 o properly escape generated HTML 145 o add authentication for redirections, from martin@netbsd.org 146 o handle chained ssl certifications, from elric@netbsd.org 147 o add basic support for gzipped files, from elric@netbsd.org 148 o properly escape generated URIs 149 150changes in bozohttpd 20111118: 151 o add -P <pidfile> option, from jmmv@netbsd.org 152 o avoid crashes with http basic auth, from pooka@netbsd.org 153 o add support for REDIRECT_STATUS variable, from tls@netbsd.org 154 o support .mp4 files in the default map 155 o directory indexes with files with : are now displayed properly, from 156 reed@netbsd.org 157 o allow -I option to be useful in non-inetd mode as well 158 159changes in bozohttpd 20100920: 160 o properly fully disable multi-file mode for now 161 o fix the -t and -U options when used without the -e option, broken since 162 the library-ifcation 163 o be explicit that logs go to the FTP facility in syslog 164 o use scandir() with alphasort() for sorted directory lists, from moof 165 o fix a serious error in vhost handling; "Host:.." would allow access to 166 the next level directory from the virtual root directory, from seanb 167 o fix some various non standard compile time errors, from rudolf 168 o fix dynamic CGI content maps, from rudolf 169 170changes in bozohttpd 20100617: 171 o fix some compile issues 172 o fix SSL mode. from rtr 173 o fix some cgi-bin issues, as seen with cvsweb 174 o disable multi-file daemon mode for now, it breaks 175 o return 404's instead of 403's when chdir of ~user dirs fail 176 o remove "noreturn" attribute from bozo_http_error() that was 177 causing incorrect runtime behaviour 178 179changes in bozohttpd 20100509: 180 o major rework and clean up of internal interfaces. move the main 181 program into main.c, the remaining parts are useable as library 182 add bindings for lua. by Alistair G. Crooks <agc@netbsd.org> 183 o fix http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=566325 184 185changes in bozohttpd 20090522: 186 o avoid dying in daemon mode for some uncommon, but recoverable, errors 187 o close leaking file descriptors for CGI and daemon mode 188 o handle poll errors properly 189 o don't try to handle more than one request per process yet 190 o add subdirs for build "debug" and "small" versions 191 o clean up a bad merge / duplicate code 192 o make mmap() usage portable, fixes linux & ranges: support 193 o document the -f option 194 o daemon mode now serves 6 files per child 195 196changes in bozohttpd 20090417: 197 o make bozohttpd internally more modular, preparing the way 198 to handle more than one request per process 199 o fix http-auth, set $REMOTE_USER not $REMOTEUSER. also fix 200 cgi-bin with cvsweb, from Holger Weiss <holger@CIS.FU-Berlin.DE> 201 o fix an uninitialised variable use in daemon mode 202 o fix ssl mode with newer OpenSSL 203 o mmap large files in manageable sizes so we can serve any size file 204 o refactor url processing to handle query strings correctly for CGI 205 from Sergey Katsev at Coyote Point 206 o add If-Modified-Since support, from Joerg Sonnenberger 207 <joerg@netbsd.org> 208 o many more manual fixes, from NetBSD 209 210changes in bozohttpd 20080303: 211 o fix some cgi header processing, from <thelsdj@gmail.com> 212 o add simple Range: header processing, from <bad@bsd.de> 213 o man page fixes, from NetBSD 214 o clean up various parts, from NetBSD 215 216changes in bozohttpd 20060710: 217 o prefix some function names with "bozo" 218 o align directory indexing <hr> markers 219 o clean up some code GCC4 grumbled about 220 221changes in bozohttpd 20060517: 222 o don't allow "/.." or "../" files 223 o don't write ":80" into urls for the http port 224 o fix a fd leak when fork() fails 225 o make directory indexing mode not look so ugly 226 o build a text version of the manual page 227 o make "make clean" work properly 228 229changes in bozohttpd 20050410: 230 o fix some off-by-one errors from <roland.illig@gmx.de> 231 o properly support nph- CGI 232 o make content maps case insensitive 233 o fix proto header merging to include the missing comma 234 o major source reorganisation; most features are in separate files now 235 o new -V flag that makes unknown virtualhosts use slashdir 236 from <rumble@ephemeral.org> 237 o HTTP/1.x protocol headers are now properly merged for CGI 238 239changes in bozohttpd 20040808: 240 o CGI status is now properly handled (-a flag has been removed) 241 o CGI file upload support works 242 o %xy translations are no longer ever applied after the first '?', 243 ala RFC2396. from lukem 244 o daemon mode (-b) should no longer hang spinning forever if it 245 sees no children. from lukem 246 o new .bzabsredirect file support. from <martin@netbsd.org> 247 o return a 404 error if we see %00 or %2f (/) 248 o don't print 2 "200" headers for CGI 249 o support .torrent files 250 251changes in bozohttpd 20040218: 252 o new .bzredirect file support for sane directory redirection 253 o new -Z option that enables SSL mode, from <rtr@eterna.com.au> 254 o the -C option has been changed to take two explicit options, rather 255 than a single option with a space separating the suffix and the 256 interpreter. ``-C ".foo /path/to/bar"'' should now be written 257 as ``-C .foo /path/to/bar'' 258 o the -M option has been changed like -C and no longer requires or 259 supports a single argument with space-separated options 260 o with -a, still print the 200 OK. from <rtr@eterna.com.au> 261 o with -r, if a .bzdirect file appears in a directory, allow direct 262 access to this directory 263 264changes in bozohttpd 20031005: 265 o fixes for basic authorisation. from <ecu@ipv42.net> 266 o always display file size in directory index mode 267 o add .xbel, .xml & .xsl -> text/xml mappings. from 268 <wiz@danbala.ifoer.tuwien.ac.at> 269 270changes in bozohttpd 20030626: 271 o fix a recent core dump when given no input 272 o add new -r flag that ensures referrer is set to this host 273 o fix several compile time errors with -DNO_CGIBIN_SUPPORT 274 o fix some man page details. from lukem@wasabisystems.com 275 o re-add a missing memset(), fixing a core dump. from lukem 276 o support HTTP basic authorisation, disabled by default. from lukem 277 o print the port number in redirects and errors. from lukem 278 o only syslog the basename of the program. from lukem 279 o add __attribute__() format checking. from lukem 280 o fix cgibin SCRIPT_NAME to have a leading /. from zakj@nox.cx 281 o simplify some code in -C to avoid a core dump. from lukem 282 o add a .css -> css/text entry to the content_map[]. from zakj@nox.cx 283 284changes in bozohttpd 20030409: 285 o -d without DEBUG enabled only prints one warning and continues 286 o one can now define the C macro SERVER_SOFTWARE when building to 287 change the Server: header and CGI variable of the same name 288 o add new -s flag the force logging output to stderr. from zakj@nox.cx 289 o add new -a flag for CGI bin that stops bozohttpd from outputting 290 any HTTP reply, the CGI program must output these. from zakj@nox.cx 291 o new REQUEST_URI and DATE_GMT environment variables for CGI. from 292 zakj@nox.cx 293 o add a "Makefile.boot" that should work with any make program 294 o build on linux again 295 o fix core dumps when using -C 296 297changes in bozohttpd 20030313: 298 o deprecate -r flag; make this the default and silently ignore -r now 299 o add support for file extensions to call CGI programs (from lukem) 300 o add dynamic support to add new content map entries, allowing both 301 new file types and non /cgi-bin CGI programs to be run with the 302 new -C "suffix cgihandler" and -M "suffix type encoding encoding11" 303 options 304 o in -b mode, set the http date after accept() returns, not before we 305 call accept() 306 o in -b mode, bind all addresses found not just the first one 307 o unsupport old hostname API 308 o in -b mode, set the SO_REUSEADDR socket option (lukem) 309 o allow -x (index.html) mode to work with CGI handlers 310 311changes in bozohttpd 20021106: 312 o add .bz2 support 313 o properly escape <, > and & in error messages, partly from 314 Nicolas Jombart <ecu@mariejeanne.net> 315 o new -H flag to hide .* files in directory index mode 316 o fix buffer reallocation when parsing a request, to avoid 317 overflowing the buffer with carriage returns (\r) 318 o do not decode "%XY"-style cgi-bin data beyond the "?" 319 320changes in bozohttpd 5.15 (20020913): 321 o add .ogg support -> `application/x-ogg' 322 o fix CGI requests with "/" in the query part 323 324changes in bozohttpd 5.14 (20020823): 325 o allow -X mode to work for "/" 326 o work on systems without MADV_SEQUENTIAL 327 o make a local cut-down copy of "queue.h" (fixes linux & solaris 328 support at the very least) 329 o portability fixes for pre-ipv6 socket api systems (eg, solaris 7) 330 o portability fixes for missing _PATH_DEFPATH, LOG_FTP and __progname 331 o better documentation on virtual host support 332 333changes in bozohttpd 5.13 (20020804): 334 o support .mp3 files (type audio/mpeg) 335 o use stat() to find out if something is a directory, for -X mode 336 337changes in bozohttpd 5.12 (20020803): 338 o constification 339 o fixes & enhancements for directory index mode (-X) 340 341changes in bozohttpd 5.11 (20020730): 342 o more man page fixes from Thomas Klausner 343 <wiz@danbala.ifoer.tuwien.ac.at> 344 o de-K&R C-ification 345 o fix Date: header for daemon mode 346 o fix core dump when asking for /cgi-bin/ when CGI isn't configured 347 o use a valid Server: header 348 349changes in bozohttpd 5.10 (20020710): 350 - add freebsd support 351 - fix a couple of header typos 352 - many cgi-bin fixes from lukem@netbsd.org 353 - add -T chrootdir and -U user, plus several minor other cleanups 354 with signals and return values. from xs@kittenz.org 355 - add -e that does not clear the environment for -T/-U 356 - fix a formatting error noticed by ISIHARA Takanori <ishit@oak.dti.ne.jp> 357 358changes in bozohttpd 5.09 (20010922): 359 - add a daemon mode 360 - document how to use bozohttpd in netbsd inetd with more than 40 361 connections per minute and also with cgibin 362 - man page fixes from wiz@netbsd.org 363 364changes in bozohttpd 5.08 (20010812): 365 - add directory index generation support (-X) from ad@netbsd.org 366 - add .pa as an alias for .pac 367 - make server software version configurable (RFC) 368 369changes in bozohttpd 5.07 (20010610): 370 - add .png support 371 - new "-x index.html" flag to change default file 372 - new "-p public_html" flag to change default ~user directory 373 - fixes cgi-bin support and more from chuck@research.att.com 374 - add many new content-types, now support most common ones 375 376changes in bozohttpd 5.06 (20000825): 377 - add IPv6 support from itojun@iijlab.net 378 - man page fixes from jlam@netbsd.org 379 380changes in bozohttpd 5.05 (20000815): 381 - fix a virtual host bug, from kleink@netbsd.org 382 383changes in bozohttpd 5.04 (20000427): 384 - fix virtual host support; URI takes precedence over Host: 385 386changes in bozohttpd 5.03 (20000427): 387 - fix a bug with chdir() 388 389changes in bozohttpd 5.02 (20000426): 390 - .pac support from simonb 391 392changes in bozohttpd 5.01 (20000421): 393 - .swf support 394 - virtual hosting support 395