1$NetBSD: CHANGES,v 1.52 2021/09/03 21:54:59 andvar Exp $ 2 3changes in bozohttpd 20210824: 4 o new "-m tlsversion" option to set the minimum TLS version 5 available. partially from <sunil@nimmagadda.net>. 6 o extend the list of available ciphers to include most of the 7 openssl "HIGH" with some additional disables. retain the current 8 list of bad options. should deal with PR#51278. 9 10changes in bozohttpd 20210504: 11 o don't assume host BUFSIZ is sufficient. small BUFSIZ leads to 12 always happens errors in the testsuite. switch all these buffers 13 to be 4KiB sized. reported by embr <git@liclac.eu> 14 15changes in bozohttpd 20210403: 16 o fix a denial of service attack against initial request contents, 17 now bounded at 16KiB. reported by Justin Parrott in PR#56085 18 19changes in bozohttpd 20210227: 20 o new support for content types: .tar.bz2, .tar.xz, .tar.lz, 21 .tar.zst, .tbz2, .txz, .tlz, .zipx, .xz, .zst, .sz, .lz, .lzma, 22 .lzo, .7z, .lzo, .cab, .dmg, .jar, and .rar. should fix 23 netbsd PR#56026: 24 MIME type of .tar.xz file on ny{cdn,ftp}.NetBSD.org is invalid 25 26changes in bozohttpd 20210211: 27 o fix various NULL derefs from malformed headers. mostly from 28 <emily@ingalls.rocks>. 29 o fix memory leaks in library interface: add bozo_cleanup(). 30 31changes in bozohttpd 20201014: 32 o also set -D_GNU_SOURCE in Makefile.boot. from 33 hadrien.lacour@posteo.net. 34 o fix array size botch (assertion, not exploitable.) from 35 martin@netbsd.org. 36 o also match %2F as well as %2f. from leah@vuxu.org. 37 o many manual and help fixes. clean ups for higher lint levels, 38 consistency/style clean ups. various option fixes including made 39 -f imply -b. from <henrik@gulbra.net> for freebsd. 40 41changes in bozohttpd 20200912: 42 o add .m4a and .m4v file extensions. 43 44changes in bozohttpd 20200820: 45 o make this work on sun2 by reducing mmap window there. 46 o fix SSL shutdown sequence. from spz@netbsd.org. 47 o add readme support to directory indexing. from jmcneill@netbsd.org 48 o add blocklist(8) support. from jruoho@netbsd.org. 49 50changes in bozohttpd 20190228: 51 o extend timeout facility to ssl and stop servers hanging forever 52 if the client never sends anything. reported by Steffen in netbsd 53 PR#50655. 54 o don't display special files in the directory index. they aren't 55 served, but links to them are generated. 56 o fix CGI '+' parameter handling, some error checking, and a double 57 free. from rajeev_v_pillai@yahoo.com 58 o more directory indexing clean up. from rajeev_v_pillai@yahoo.com 59 60changes in bozohttpd 20181215: 61 o fix .htpasswd bypass for authenticated users. reported by JP, 62 from leot@netbsd.org 63 o avoid possible null dereference when receiving a big request that 64 timeout. reported by maya@netbsd.org, from leot@netbsd.org 65 o fix handling of -T option, from leot@netbsd.org 66 o cleanups and portability improvements, from maya@netbsd.org 67 o change directory indexing to use html tables, from 68 rajeev_v_pillai@yahoo.com 69 70changes in bozohttpd 20181125: 71 o fixes for option parsing introduced in bozohttpd 20181123 72 73changes in bozohttpd 20181121: 74 o add url remap support via .bzremap file, from martin@netbsd.org 75 o handle redirections for any protocol, not just http: 76 o fix a denial of service attack against header contents, which 77 is now bounded at 16KiB. reported by JP 78 o reduce default timeouts, and add expand timeouts to handle the 79 initial line, each header, and the total time spent 80 o add -T option to expose new timeout settings 81 o minor RFC fixes related to timeout handling 82 o fix special file (.htpasswd, .bz*) bypass. reported by JP 83 84changes in bozohttpd 20170201: 85 o fix an infinite loop in cgi processing 86 o fixes and clean up for the testsuite 87 o no longer sends encoding header for compressed formats 88 89changes in bozohttpd 20160517: 90 o add a bozo_get_version() function which returns the version number 91 92changes in bozohttpd 20160415: 93 o add search-word support for CGI 94 o fix a security issue in CGI suffix handler support which would 95 allow remote code execution, from shm@netbsd.org 96 o -C option supports now CGI scripts only 97 98changes in bozohttpd 20151028: 99 o add CGI support for ~user translation (-E switch) 100 o add redirects to ~user translation 101 o fix bugs around ~user translation 102 o add schema detection for absolute redirects 103 o fixed few memory leaks 104 o bunch of minor tweaks 105 o removed -r support 106 o smarter redirects 107 108changes in bozohttpd 20150320: 109 o fix redirection handling 110 o support transport stream (.ts) and video object (.vob) files 111 o directory listings show correct file sizes for large files 112 113changes in bozohttpd 20140717: 114 o properly handle SSL errors 115 116changes in bozohttpd 20140708: 117 o fixes for virtual host support, from rajeev_v_pillai@yahoo.com 118 o avoid printing double errors, from shm@netbsd.org 119 o fix a security issue in basic HTTP authentication which would allow 120 authentication to be bypassed, from shm@netbsd.org 121 122changes in bozohttpd 20140201: 123 o support .svg files 124 o fix a core dump when requests timeout 125 126changes in bozohttpd 20140102: 127 o update a few content types 128 o add support for directly calling lua scripts to handle 129 processes, from mbalmer@netbsd.org 130 o properly escape generated HTML 131 o add authentication for redirections, from martin@netbsd.org 132 o handle chained ssl certifications, from elric@netbsd.org 133 o add basic support for gzipped files, from elric@netbsd.org 134 o properly escape generated URIs 135 136changes in bozohttpd 20111118: 137 o add -P <pidfile> option, from jmmv@netbsd.org 138 o avoid crashes with http basic auth, from pooka@netbsd.org 139 o add support for REDIRECT_STATUS variable, from tls@netbsd.org 140 o support .mp4 files in the default map 141 o directory indexes with files with : are now displayed properly, from 142 reed@netbsd.org 143 o allow -I option to be useful in non-inetd mode as well 144 145changes in bozohttpd 20100920: 146 o properly fully disable multi-file mode for now 147 o fix the -t and -U options when used without the -e option, broken since 148 the library-ifcation 149 o be explicit that logs go to the FTP facility in syslog 150 o use scandir() with alphasort() for sorted directory lists, from moof 151 o fix a serious error in vhost handling; "Host:.." would allow access to 152 the next level directory from the virtual root directory, from seanb 153 o fix some various non standard compile time errors, from rudolf 154 o fix dynamic CGI content maps, from rudolf 155 156changes in bozohttpd 20100617: 157 o fix some compile issues 158 o fix SSL mode. from rtr 159 o fix some cgi-bin issues, as seen with cvsweb 160 o disable multi-file daemon mode for now, it breaks 161 o return 404's instead of 403's when chdir of ~user dirs fail 162 o remove "noreturn" attribute from bozo_http_error() that was 163 causing incorrect runtime behaviour 164 165changes in bozohttpd 20100509: 166 o major rework and clean up of internal interfaces. move the main 167 program into main.c, the remaining parts are useable as library 168 add bindings for lua. by Alistair G. Crooks <agc@netbsd.org> 169 o fix http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=566325 170 171changes in bozohttpd 20090522: 172 o avoid dying in daemon mode for some uncommon, but recoverable, errors 173 o close leaking file descriptors for CGI and daemon mode 174 o handle poll errors properly 175 o don't try to handle more than one request per process yet 176 o add subdirs for build "debug" and "small" versions 177 o clean up a bad merge / duplicate code 178 o make mmap() usage portable, fixes linux & ranges: support 179 o document the -f option 180 o daemon mode now serves 6 files per child 181 182changes in bozohttpd 20090417: 183 o make bozohttpd internally more modular, preparing the way 184 to handle more than one request per process 185 o fix http-auth, set $REMOTE_USER not $REMOTEUSER. also fix 186 cgi-bin with cvsweb, from Holger Weiss <holger@CIS.FU-Berlin.DE> 187 o fix an uninitialised variable use in daemon mode 188 o fix ssl mode with newer OpenSSL 189 o mmap large files in manageable sizes so we can serve any size file 190 o refactor url processing to handle query strings correctly for CGI 191 from Sergey Katsev at Coyote Point 192 o add If-Modified-Since support, from Joerg Sonnenberger 193 <joerg@netbsd.org> 194 o many more manual fixes, from NetBSD 195 196changes in bozohttpd 20080303: 197 o fix some cgi header processing, from <thelsdj@gmail.com> 198 o add simple Range: header processing, from <bad@bsd.de> 199 o man page fixes, from NetBSD 200 o clean up various parts, from NetBSD 201 202changes in bozohttpd 20060710: 203 o prefix some function names with "bozo" 204 o align directory indexing <hr> markers 205 o clean up some code GCC4 grumbled about 206 207changes in bozohttpd 20060517: 208 o don't allow "/.." or "../" files 209 o don't write ":80" into urls for the http port 210 o fix a fd leak when fork() fails 211 o make directory indexing mode not look so ugly 212 o build a text version of the manual page 213 o make "make clean" work properly 214 215changes in bozohttpd 20050410: 216 o fix some off-by-one errors from <roland.illig@gmx.de> 217 o properly support nph- CGI 218 o make content maps case insensitive 219 o fix proto header merging to include the missing comma 220 o major source reorganisation; most features are in separate files now 221 o new -V flag that makes unknown virtualhosts use slashdir 222 from <rumble@ephemeral.org> 223 o HTTP/1.x protocol headers are now properly merged for CGI 224 225changes in bozohttpd 20040808: 226 o CGI status is now properly handled (-a flag has been removed) 227 o CGI file upload support works 228 o %xy translations are no longer ever applied after the first '?', 229 ala RFC2396. from lukem 230 o daemon mode (-b) should no longer hang spinning forever if it 231 sees no children. from lukem 232 o new .bzabsredirect file support. from <martin@netbsd.org> 233 o return a 404 error if we see %00 or %2f (/) 234 o don't print 2 "200" headers for CGI 235 o support .torrent files 236 237changes in bozohttpd 20040218: 238 o new .bzredirect file support for sane directory redirection 239 o new -Z option that enables SSL mode, from <rtr@eterna.com.au> 240 o the -C option has been changed to take two explicit options, rather 241 than a single option with a space separating the suffix and the 242 interpreter. ``-C ".foo /path/to/bar"'' should now be written 243 as ``-C .foo /path/to/bar'' 244 o the -M option has been changed like -C and no longer requires or 245 supports a single argument with space-separated options 246 o with -a, still print the 200 OK. from <rtr@eterna.com.au> 247 o with -r, if a .bzdirect file appears in a directory, allow direct 248 access to this directory 249 250changes in bozohttpd 20031005: 251 o fixes for basic authorisation. from <ecu@ipv42.net> 252 o always display file size in directory index mode 253 o add .xbel, .xml & .xsl -> text/xml mappings. from 254 <wiz@danbala.ifoer.tuwien.ac.at> 255 256changes in bozohttpd 20030626: 257 o fix a recent core dump when given no input 258 o add new -r flag that ensures referrer is set to this host 259 o fix several compile time errors with -DNO_CGIBIN_SUPPORT 260 o fix some man page details. from lukem@wasabisystems.com 261 o re-add a missing memset(), fixing a core dump. from lukem 262 o support HTTP basic authorisation, disabled by default. from lukem 263 o print the port number in redirects and errors. from lukem 264 o only syslog the basename of the program. from lukem 265 o add __attribute__() format checking. from lukem 266 o fix cgibin SCRIPT_NAME to have a leading /. from zakj@nox.cx 267 o simplify some code in -C to avoid a core dump. from lukem 268 o add a .css -> css/text entry to the content_map[]. from zakj@nox.cx 269 270changes in bozohttpd 20030409: 271 o -d without DEBUG enabled only prints one warning and continues 272 o one can now define the C macro SERVER_SOFTWARE when building to 273 change the Server: header and CGI variable of the same name 274 o add new -s flag the force logging output to stderr. from zakj@nox.cx 275 o add new -a flag for CGI bin that stops bozohttpd from outputting 276 any HTTP reply, the CGI program must output these. from zakj@nox.cx 277 o new REQUEST_URI and DATE_GMT environment variables for CGI. from 278 zakj@nox.cx 279 o add a "Makefile.boot" that should work with any make program 280 o build on linux again 281 o fix core dumps when using -C 282 283changes in bozohttpd 20030313: 284 o deprecate -r flag; make this the default and silently ignore -r now 285 o add support for file extensions to call CGI programs (from lukem) 286 o add dynamic support to add new content map entries, allowing both 287 new file types and non /cgi-bin CGI programs to be run with the 288 new -C "suffix cgihandler" and -M "suffix type encoding encoding11" 289 options 290 o in -b mode, set the http date after accept() returns, not before we 291 call accept() 292 o in -b mode, bind all addresses found not just the first one 293 o unsupport old hostname API 294 o in -b mode, set the SO_REUSEADDR socket option (lukem) 295 o allow -x (index.html) mode to work with CGI handlers 296 297changes in bozohttpd 20021106: 298 o add .bz2 support 299 o properly escape <, > and & in error messages, partly from 300 Nicolas Jombart <ecu@mariejeanne.net> 301 o new -H flag to hide .* files in directory index mode 302 o fix buffer reallocation when parsing a request, to avoid 303 overflowing the buffer with carriage returns (\r) 304 o do not decode "%XY"-style cgi-bin data beyond the "?" 305 306changes in bozohttpd 5.15 (20020913): 307 o add .ogg support -> `application/x-ogg' 308 o fix CGI requests with "/" in the query part 309 310changes in bozohttpd 5.14 (20020823): 311 o allow -X mode to work for "/" 312 o work on systems without MADV_SEQUENTIAL 313 o make a local cut-down copy of "queue.h" (fixes linux & solaris 314 support at the very least) 315 o portability fixes for pre-ipv6 socket api systems (eg, solaris 7) 316 o portability fixes for missing _PATH_DEFPATH, LOG_FTP and __progname 317 o better documentation on virtual host support 318 319changes in bozohttpd 5.13 (20020804): 320 o support .mp3 files (type audio/mpeg) 321 o use stat() to find out if something is a directory, for -X mode 322 323changes in bozohttpd 5.12 (20020803): 324 o constification 325 o fixes & enhancements for directory index mode (-X) 326 327changes in bozohttpd 5.11 (20020730): 328 o more man page fixes from Thomas Klausner 329 <wiz@danbala.ifoer.tuwien.ac.at> 330 o de-K&R C-ification 331 o fix Date: header for daemon mode 332 o fix core dump when asking for /cgi-bin/ when CGI isn't configured 333 o use a valid Server: header 334 335changes in bozohttpd 5.10 (20020710): 336 - add freebsd support 337 - fix a couple of header typos 338 - many cgi-bin fixes from lukem@netbsd.org 339 - add -T chrootdir and -U user, plus several minor other cleanups 340 with signals and return values. from xs@kittenz.org 341 - add -e that does not clear the environment for -T/-U 342 - fix a formatting error noticed by ISIHARA Takanori <ishit@oak.dti.ne.jp> 343 344changes in bozohttpd 5.09 (20010922): 345 - add a daemon mode 346 - document how to use bozohttpd in netbsd inetd with more than 40 347 connections per minute and also with cgibin 348 - man page fixes from wiz@netbsd.org 349 350changes in bozohttpd 5.08 (20010812): 351 - add directory index generation support (-X) from ad@netbsd.org 352 - add .pa as an alias for .pac 353 - make server software version configurable (RFC) 354 355changes in bozohttpd 5.07 (20010610): 356 - add .png support 357 - new "-x index.html" flag to change default file 358 - new "-p public_html" flag to change default ~user directory 359 - fixes cgi-bin support and more from chuck@research.att.com 360 - add many new content-types, now support most common ones 361 362changes in bozohttpd 5.06 (20000825): 363 - add IPv6 support from itojun@iijlab.net 364 - man page fixes from jlam@netbsd.org 365 366changes in bozohttpd 5.05 (20000815): 367 - fix a virtual host bug, from kleink@netbsd.org 368 369changes in bozohttpd 5.04 (20000427): 370 - fix virtual host support; URI takes precedence over Host: 371 372changes in bozohttpd 5.03 (20000427): 373 - fix a bug with chdir() 374 375changes in bozohttpd 5.02 (20000426): 376 - .pac spport from simonb 377 378changes in bozohttpd 5.01 (20000421): 379 - .swf support 380 - virtual hosting support 381