1$NetBSD: CHANGES,v 1.54 2022/11/02 20:38:21 andvar Exp $ 2 3changes in bozohttpd 20220104: 4 o remove obsolete .bzdirect handling. 5 6changes in bozohttpd 20210824: 7 o new "-m tlsversion" option to set the minimum TLS version 8 available. partially from <sunil@nimmagadda.net>. 9 o extend the list of available ciphers to include most of the 10 openssl "HIGH" with some additional disables. retain the current 11 list of bad options. should deal with PR#51278. 12 13changes in bozohttpd 20210504: 14 o don't assume host BUFSIZ is sufficient. small BUFSIZ leads to 15 always happens errors in the testsuite. switch all these buffers 16 to be 4KiB sized. reported by embr <git@liclac.eu> 17 18changes in bozohttpd 20210403: 19 o fix a denial of service attack against initial request contents, 20 now bounded at 16KiB. reported by Justin Parrott in PR#56085 21 22changes in bozohttpd 20210227: 23 o new support for content types: .tar.bz2, .tar.xz, .tar.lz, 24 .tar.zst, .tbz2, .txz, .tlz, .zipx, .xz, .zst, .sz, .lz, .lzma, 25 .lzo, .7z, .lzo, .cab, .dmg, .jar, and .rar. should fix 26 netbsd PR#56026: 27 MIME type of .tar.xz file on ny{cdn,ftp}.NetBSD.org is invalid 28 29changes in bozohttpd 20210211: 30 o fix various NULL derefs from malformed headers. mostly from 31 <emily@ingalls.rocks>. 32 o fix memory leaks in library interface: add bozo_cleanup(). 33 34changes in bozohttpd 20201014: 35 o also set -D_GNU_SOURCE in Makefile.boot. from 36 hadrien.lacour@posteo.net. 37 o fix array size botch (assertion, not exploitable.) from 38 martin@netbsd.org. 39 o also match %2F as well as %2f. from leah@vuxu.org. 40 o many manual and help fixes. clean ups for higher lint levels, 41 consistency/style clean ups. various option fixes including made 42 -f imply -b. from <henrik@gulbra.net> for freebsd. 43 44changes in bozohttpd 20200912: 45 o add .m4a and .m4v file extensions. 46 47changes in bozohttpd 20200820: 48 o make this work on sun2 by reducing mmap window there. 49 o fix SSL shutdown sequence. from spz@netbsd.org. 50 o add readme support to directory indexing. from jmcneill@netbsd.org 51 o add blocklist(8) support. from jruoho@netbsd.org. 52 53changes in bozohttpd 20190228: 54 o extend timeout facility to ssl and stop servers hanging forever 55 if the client never sends anything. reported by Steffen in netbsd 56 PR#50655. 57 o don't display special files in the directory index. they aren't 58 served, but links to them are generated. 59 o fix CGI '+' parameter handling, some error checking, and a double 60 free. from rajeev_v_pillai@yahoo.com 61 o more directory indexing clean up. from rajeev_v_pillai@yahoo.com 62 63changes in bozohttpd 20181215: 64 o fix .htpasswd bypass for authenticated users. reported by JP, 65 from leot@netbsd.org 66 o avoid possible null dereference when receiving a big request that 67 timeout. reported by maya@netbsd.org, from leot@netbsd.org 68 o fix handling of -T option, from leot@netbsd.org 69 o cleanups and portability improvements, from maya@netbsd.org 70 o change directory indexing to use html tables, from 71 rajeev_v_pillai@yahoo.com 72 73changes in bozohttpd 20181125: 74 o fixes for option parsing introduced in bozohttpd 20181123 75 76changes in bozohttpd 20181121: 77 o add url remap support via .bzremap file, from martin@netbsd.org 78 o handle redirections for any protocol, not just http: 79 o fix a denial of service attack against header contents, which 80 is now bounded at 16KiB. reported by JP 81 o reduce default timeouts, and add expand timeouts to handle the 82 initial line, each header, and the total time spent 83 o add -T option to expose new timeout settings 84 o minor RFC fixes related to timeout handling 85 o fix special file (.htpasswd, .bz*) bypass. reported by JP 86 87changes in bozohttpd 20170201: 88 o fix an infinite loop in cgi processing 89 o fixes and clean up for the testsuite 90 o no longer sends encoding header for compressed formats 91 92changes in bozohttpd 20160517: 93 o add a bozo_get_version() function which returns the version number 94 95changes in bozohttpd 20160415: 96 o add search-word support for CGI 97 o fix a security issue in CGI suffix handler support which would 98 allow remote code execution, from shm@netbsd.org 99 o -C option supports now CGI scripts only 100 101changes in bozohttpd 20151028: 102 o add CGI support for ~user translation (-E switch) 103 o add redirects to ~user translation 104 o fix bugs around ~user translation 105 o add schema detection for absolute redirects 106 o fixed few memory leaks 107 o bunch of minor tweaks 108 o removed -r support 109 o smarter redirects 110 111changes in bozohttpd 20150320: 112 o fix redirection handling 113 o support transport stream (.ts) and video object (.vob) files 114 o directory listings show correct file sizes for large files 115 116changes in bozohttpd 20140717: 117 o properly handle SSL errors 118 119changes in bozohttpd 20140708: 120 o fixes for virtual host support, from rajeev_v_pillai@yahoo.com 121 o avoid printing double errors, from shm@netbsd.org 122 o fix a security issue in basic HTTP authentication which would allow 123 authentication to be bypassed, from shm@netbsd.org 124 125changes in bozohttpd 20140201: 126 o support .svg files 127 o fix a core dump when requests timeout 128 129changes in bozohttpd 20140102: 130 o update a few content types 131 o add support for directly calling lua scripts to handle 132 processes, from mbalmer@netbsd.org 133 o properly escape generated HTML 134 o add authentication for redirections, from martin@netbsd.org 135 o handle chained ssl certifications, from elric@netbsd.org 136 o add basic support for gzipped files, from elric@netbsd.org 137 o properly escape generated URIs 138 139changes in bozohttpd 20111118: 140 o add -P <pidfile> option, from jmmv@netbsd.org 141 o avoid crashes with http basic auth, from pooka@netbsd.org 142 o add support for REDIRECT_STATUS variable, from tls@netbsd.org 143 o support .mp4 files in the default map 144 o directory indexes with files with : are now displayed properly, from 145 reed@netbsd.org 146 o allow -I option to be useful in non-inetd mode as well 147 148changes in bozohttpd 20100920: 149 o properly fully disable multi-file mode for now 150 o fix the -t and -U options when used without the -e option, broken since 151 the library-ifcation 152 o be explicit that logs go to the FTP facility in syslog 153 o use scandir() with alphasort() for sorted directory lists, from moof 154 o fix a serious error in vhost handling; "Host:.." would allow access to 155 the next level directory from the virtual root directory, from seanb 156 o fix some various non standard compile time errors, from rudolf 157 o fix dynamic CGI content maps, from rudolf 158 159changes in bozohttpd 20100617: 160 o fix some compile issues 161 o fix SSL mode. from rtr 162 o fix some cgi-bin issues, as seen with cvsweb 163 o disable multi-file daemon mode for now, it breaks 164 o return 404's instead of 403's when chdir of ~user dirs fail 165 o remove "noreturn" attribute from bozo_http_error() that was 166 causing incorrect runtime behaviour 167 168changes in bozohttpd 20100509: 169 o major rework and clean up of internal interfaces. move the main 170 program into main.c, the remaining parts are useable as library 171 add bindings for lua. by Alistair G. Crooks <agc@netbsd.org> 172 o fix http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=566325 173 174changes in bozohttpd 20090522: 175 o avoid dying in daemon mode for some uncommon, but recoverable, errors 176 o close leaking file descriptors for CGI and daemon mode 177 o handle poll errors properly 178 o don't try to handle more than one request per process yet 179 o add subdirs for build "debug" and "small" versions 180 o clean up a bad merge / duplicate code 181 o make mmap() usage portable, fixes linux & ranges: support 182 o document the -f option 183 o daemon mode now serves 6 files per child 184 185changes in bozohttpd 20090417: 186 o make bozohttpd internally more modular, preparing the way 187 to handle more than one request per process 188 o fix http-auth, set $REMOTE_USER not $REMOTEUSER. also fix 189 cgi-bin with cvsweb, from Holger Weiss <holger@CIS.FU-Berlin.DE> 190 o fix an uninitialised variable use in daemon mode 191 o fix ssl mode with newer OpenSSL 192 o mmap large files in manageable sizes so we can serve any size file 193 o refactor url processing to handle query strings correctly for CGI 194 from Sergey Katsev at Coyote Point 195 o add If-Modified-Since support, from Joerg Sonnenberger 196 <joerg@netbsd.org> 197 o many more manual fixes, from NetBSD 198 199changes in bozohttpd 20080303: 200 o fix some cgi header processing, from <thelsdj@gmail.com> 201 o add simple Range: header processing, from <bad@bsd.de> 202 o man page fixes, from NetBSD 203 o clean up various parts, from NetBSD 204 205changes in bozohttpd 20060710: 206 o prefix some function names with "bozo" 207 o align directory indexing <hr> markers 208 o clean up some code GCC4 grumbled about 209 210changes in bozohttpd 20060517: 211 o don't allow "/.." or "../" files 212 o don't write ":80" into urls for the http port 213 o fix a fd leak when fork() fails 214 o make directory indexing mode not look so ugly 215 o build a text version of the manual page 216 o make "make clean" work properly 217 218changes in bozohttpd 20050410: 219 o fix some off-by-one errors from <roland.illig@gmx.de> 220 o properly support nph- CGI 221 o make content maps case insensitive 222 o fix proto header merging to include the missing comma 223 o major source reorganisation; most features are in separate files now 224 o new -V flag that makes unknown virtualhosts use slashdir 225 from <rumble@ephemeral.org> 226 o HTTP/1.x protocol headers are now properly merged for CGI 227 228changes in bozohttpd 20040808: 229 o CGI status is now properly handled (-a flag has been removed) 230 o CGI file upload support works 231 o %xy translations are no longer ever applied after the first '?', 232 ala RFC2396. from lukem 233 o daemon mode (-b) should no longer hang spinning forever if it 234 sees no children. from lukem 235 o new .bzabsredirect file support. from <martin@netbsd.org> 236 o return a 404 error if we see %00 or %2f (/) 237 o don't print 2 "200" headers for CGI 238 o support .torrent files 239 240changes in bozohttpd 20040218: 241 o new .bzredirect file support for sane directory redirection 242 o new -Z option that enables SSL mode, from <rtr@eterna.com.au> 243 o the -C option has been changed to take two explicit options, rather 244 than a single option with a space separating the suffix and the 245 interpreter. ``-C ".foo /path/to/bar"'' should now be written 246 as ``-C .foo /path/to/bar'' 247 o the -M option has been changed like -C and no longer requires or 248 supports a single argument with space-separated options 249 o with -a, still print the 200 OK. from <rtr@eterna.com.au> 250 o with -r, if a .bzdirect file appears in a directory, allow direct 251 access to this directory 252 253changes in bozohttpd 20031005: 254 o fixes for basic authorisation. from <ecu@ipv42.net> 255 o always display file size in directory index mode 256 o add .xbel, .xml & .xsl -> text/xml mappings. from 257 <wiz@danbala.ifoer.tuwien.ac.at> 258 259changes in bozohttpd 20030626: 260 o fix a recent core dump when given no input 261 o add new -r flag that ensures referrer is set to this host 262 o fix several compile time errors with -DNO_CGIBIN_SUPPORT 263 o fix some man page details. from lukem@wasabisystems.com 264 o re-add a missing memset(), fixing a core dump. from lukem 265 o support HTTP basic authorisation, disabled by default. from lukem 266 o print the port number in redirects and errors. from lukem 267 o only syslog the basename of the program. from lukem 268 o add __attribute__() format checking. from lukem 269 o fix cgibin SCRIPT_NAME to have a leading /. from zakj@nox.cx 270 o simplify some code in -C to avoid a core dump. from lukem 271 o add a .css -> css/text entry to the content_map[]. from zakj@nox.cx 272 273changes in bozohttpd 20030409: 274 o -d without DEBUG enabled only prints one warning and continues 275 o one can now define the C macro SERVER_SOFTWARE when building to 276 change the Server: header and CGI variable of the same name 277 o add new -s flag the force logging output to stderr. from zakj@nox.cx 278 o add new -a flag for CGI bin that stops bozohttpd from outputting 279 any HTTP reply, the CGI program must output these. from zakj@nox.cx 280 o new REQUEST_URI and DATE_GMT environment variables for CGI. from 281 zakj@nox.cx 282 o add a "Makefile.boot" that should work with any make program 283 o build on linux again 284 o fix core dumps when using -C 285 286changes in bozohttpd 20030313: 287 o deprecate -r flag; make this the default and silently ignore -r now 288 o add support for file extensions to call CGI programs (from lukem) 289 o add dynamic support to add new content map entries, allowing both 290 new file types and non /cgi-bin CGI programs to be run with the 291 new -C "suffix cgihandler" and -M "suffix type encoding encoding11" 292 options 293 o in -b mode, set the http date after accept() returns, not before we 294 call accept() 295 o in -b mode, bind all addresses found not just the first one 296 o unsupport old hostname API 297 o in -b mode, set the SO_REUSEADDR socket option (lukem) 298 o allow -x (index.html) mode to work with CGI handlers 299 300changes in bozohttpd 20021106: 301 o add .bz2 support 302 o properly escape <, > and & in error messages, partly from 303 Nicolas Jombart <ecu@mariejeanne.net> 304 o new -H flag to hide .* files in directory index mode 305 o fix buffer reallocation when parsing a request, to avoid 306 overflowing the buffer with carriage returns (\r) 307 o do not decode "%XY"-style cgi-bin data beyond the "?" 308 309changes in bozohttpd 5.15 (20020913): 310 o add .ogg support -> `application/x-ogg' 311 o fix CGI requests with "/" in the query part 312 313changes in bozohttpd 5.14 (20020823): 314 o allow -X mode to work for "/" 315 o work on systems without MADV_SEQUENTIAL 316 o make a local cut-down copy of "queue.h" (fixes linux & solaris 317 support at the very least) 318 o portability fixes for pre-ipv6 socket api systems (eg, solaris 7) 319 o portability fixes for missing _PATH_DEFPATH, LOG_FTP and __progname 320 o better documentation on virtual host support 321 322changes in bozohttpd 5.13 (20020804): 323 o support .mp3 files (type audio/mpeg) 324 o use stat() to find out if something is a directory, for -X mode 325 326changes in bozohttpd 5.12 (20020803): 327 o constification 328 o fixes & enhancements for directory index mode (-X) 329 330changes in bozohttpd 5.11 (20020730): 331 o more man page fixes from Thomas Klausner 332 <wiz@danbala.ifoer.tuwien.ac.at> 333 o de-K&R C-ification 334 o fix Date: header for daemon mode 335 o fix core dump when asking for /cgi-bin/ when CGI isn't configured 336 o use a valid Server: header 337 338changes in bozohttpd 5.10 (20020710): 339 - add freebsd support 340 - fix a couple of header typos 341 - many cgi-bin fixes from lukem@netbsd.org 342 - add -T chrootdir and -U user, plus several minor other cleanups 343 with signals and return values. from xs@kittenz.org 344 - add -e that does not clear the environment for -T/-U 345 - fix a formatting error noticed by ISIHARA Takanori <ishit@oak.dti.ne.jp> 346 347changes in bozohttpd 5.09 (20010922): 348 - add a daemon mode 349 - document how to use bozohttpd in netbsd inetd with more than 40 350 connections per minute and also with cgibin 351 - man page fixes from wiz@netbsd.org 352 353changes in bozohttpd 5.08 (20010812): 354 - add directory index generation support (-X) from ad@netbsd.org 355 - add .pa as an alias for .pac 356 - make server software version configurable (RFC) 357 358changes in bozohttpd 5.07 (20010610): 359 - add .png support 360 - new "-x index.html" flag to change default file 361 - new "-p public_html" flag to change default ~user directory 362 - fixes cgi-bin support and more from chuck@research.att.com 363 - add many new content-types, now support most common ones 364 365changes in bozohttpd 5.06 (20000825): 366 - add IPv6 support from itojun@iijlab.net 367 - man page fixes from jlam@netbsd.org 368 369changes in bozohttpd 5.05 (20000815): 370 - fix a virtual host bug, from kleink@netbsd.org 371 372changes in bozohttpd 5.04 (20000427): 373 - fix virtual host support; URI takes precedence over Host: 374 375changes in bozohttpd 5.03 (20000427): 376 - fix a bug with chdir() 377 378changes in bozohttpd 5.02 (20000426): 379 - .pac support from simonb 380 381changes in bozohttpd 5.01 (20000421): 382 - .swf support 383 - virtual hosting support 384