1$NetBSD: CHANGES,v 1.40 2019/02/28 09:16:42 mrg Exp $ 2 3changes in bozohttpd 20190228: 4 o extend timeout facility to ssl and stop servers hanging forever 5 if the client never sends anything. reported by Steffen in netbsd 6 PR#50655. 7 o don't display special files in the directory index. they aren't 8 served, but links to them are generated. 9 o fix CGI '+' parameter handling, some error checking, and a double 10 free. from rajeev_v_pillai@yahoo.com 11 o more directory indexing clean up. from rajeev_v_pillai@yahoo.com 12 13changes in bozohttpd 20181215: 14 o fix .htpasswd bypass for authenticated users. reported by JP, 15 from leot@netbsd.org 16 o avoid possible null dereference when receiving a big request that 17 timeout. reported by maya@netbsd.org, from leot@netbsd.org 18 o fix handling of -T option, from leot@netbsd.org 19 o cleanups and portability improvements, from maya@netbsd.org 20 o change directory indexing to use html tables, from 21 rajeev_v_pillai@yahoo.com 22 23changes in bozohttpd 20181125: 24 o fixes for option parsing introduced in bozohttpd 20181123 25 26changes in bozohttpd 20181121: 27 o add url remap support via .bzremap file, from martin@netbsd.org 28 o handle redirections for any protocol, not just http: 29 o fix a denial of service attack against header contents, which 30 is now bounded at 16KiB. reported by JP 31 o reduce default timeouts, and add expand timeouts to handle the 32 initial line, each header, and the total time spent 33 o add -T option to expose new timeout settings 34 o minor RFC fixes related to timeout handling 35 o fix special file (.htpasswd, .bz*) bypass. reported by JP 36 37changes in bozohttpd 20170201: 38 o fix an infinite loop in cgi processing 39 o fixes and clean up for the testsuite 40 o no longer sends encoding header for compressed formats 41 42changes in bozohttpd 20160517: 43 o add a bozo_get_version() function which returns the version number 44 45changes in bozohttpd 20160415: 46 o add search-word support for CGI 47 o fix a security issue in CGI suffix handler support which would 48 allow remote code execution, from shm@netbsd.org 49 o -C option supports now CGI scripts only 50 51changes in bozohttpd 20151028: 52 o add CGI support for ~user translation (-E switch) 53 o add redirects to ~user translation 54 o fix bugs around ~user translation 55 o add schema detection for absolute redirects 56 o fixed few memory leaks 57 o bunch of minor tweaks 58 o removed -r support 59 o smarter redirects 60 61changes in bozohttpd 20150320: 62 o fix redirection handling 63 o support transport stream (.ts) and video object (.vob) files 64 o directory listings show correct file sizes for large files 65 66changes in bozohttpd 20140717: 67 o properly handle SSL errors 68 69changes in bozohttpd 20140708: 70 o fixes for virtual host support, from rajeev_v_pillai@yahoo.com 71 o avoid printing double errors, from shm@netbsd.org 72 o fix a security issue in basic HTTP authentication which would allow 73 authentication to be bypassed, from shm@netbsd.org 74 75changes in bozohttpd 20140201: 76 o support .svg files 77 o fix a core dump when requests timeout 78 79changes in bozohttpd 20140102: 80 o update a few content types 81 o add support for directly calling lua scripts to handle 82 processes, from mbalmer@netbsd.org 83 o properly escape generated HTML 84 o add authentication for redirections, from martin@netbsd.org 85 o handle chained ssl certifications, from elric@netbsd.org 86 o add basic support for gzipped files, from elric@netbsd.org 87 o properly escape generated URIs 88 89changes in bozohttpd 20111118: 90 o add -P <pidfile> option, from jmmv@netbsd.org 91 o avoid crashes with http basic auth, from pooka@netbsd.org 92 o add support for REDIRECT_STATUS variable, from tls@netbsd.org 93 o support .mp4 files in the default map 94 o directory indexes with files with : are now displayed properly, from 95 reed@netbsd.org 96 o allow -I option to be useful in non-inetd mode as well 97 98changes in bozohttpd 20100920: 99 o properly fully disable multi-file mode for now 100 o fix the -t and -U options when used without the -e option, broken since 101 the library-ifcation 102 o be explicit that logs go to the FTP facility in syslog 103 o use scandir() with alphasort() for sorted directory lists, from moof 104 o fix a serious error in vhost handling; "Host:.." would allow access to 105 the next level directory from the virtual root directory, from seanb 106 o fix some various non standard compile time errors, from rudolf 107 o fix dynamic CGI content maps, from rudolf 108 109changes in bozohttpd 20100617: 110 o fix some compile issues 111 o fix SSL mode. from rtr 112 o fix some cgi-bin issues, as seen with cvsweb 113 o disable multi-file daemon mode for now, it breaks 114 o return 404's instead of 403's when chdir of ~user dirs fail 115 o remove "noreturn" attribute from bozo_http_error() that was 116 causing incorrect runtime behaviour 117 118changes in bozohttpd 20100509: 119 o major rework and clean up of internal interfaces. move the main 120 program into main.c, the remaining parts are useable as library 121 add bindings for lua. by Alistair G. Crooks <agc@netbsd.org> 122 o fix http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=566325 123 124changes in bozohttpd 20090522: 125 o avoid dying in daemon mode for some uncommon, but recoverable, errors 126 o close leaking file descriptors for CGI and daemon mode 127 o handle poll errors properly 128 o don't try to handle more than one request per process yet 129 o add subdirs for build "debug" and "small" versions 130 o clean up a bad merge / duplicate code 131 o make mmap() usage portable, fixes linux & ranges: support 132 o document the -f option 133 o daemon mode now serves 6 files per child 134 135changes in bozohttpd 20090417: 136 o make bozohttpd internally more modular, preparing the way 137 to handle more than one request per process 138 o fix http-auth, set $REMOTE_USER not $REMOTEUSER. also fix 139 cgi-bin with cvsweb, from Holger Weiss <holger@CIS.FU-Berlin.DE> 140 o fix an uninitialised variable use in daemon mode 141 o fix ssl mode with newer OpenSSL 142 o mmap large files in manageable sizes so we can serve any size file 143 o refactor url processing to handle query strings correctly for CGI 144 from Sergey Katsev at Coyote Point 145 o add If-Modified-Since support, from Joerg Sonnenberger 146 <joerg@netbsd.org> 147 o many more manual fixes, from NetBSD 148 149changes in bozohttpd 20080303: 150 o fix some cgi header processing, from <thelsdj@gmail.com> 151 o add simple Range: header processing, from <bad@bsd.de> 152 o man page fixes, from NetBSD 153 o clean up various parts, from NetBSD 154 155changes in bozohttpd 20060710: 156 o prefix some function names with "bozo" 157 o align directory indexing <hr> markers 158 o clean up some code GCC4 grumbled about 159 160changes in bozohttpd 20060517: 161 o don't allow "/.." or "../" files 162 o don't write ":80" into urls for the http port 163 o fix a fd leak when fork() fails 164 o make directory indexing mode not look so ugly 165 o build a text version of the manual page 166 o make "make clean" work properly 167 168changes in bozohttpd 20050410: 169 o fix some off-by-one errors from <roland.illig@gmx.de> 170 o properly support nph- CGI 171 o make content maps case insensitive 172 o fix proto header merging to include the missing comma 173 o major source reorganisation; most features are in separate files now 174 o new -V flag that makes unknown virtualhosts use slashdir 175 from <rumble@ephemeral.org> 176 o HTTP/1.x protocol headers are now properly merged for CGI 177 178changes in bozohttpd 20040808: 179 o CGI status is now properly handled (-a flag has been removed) 180 o CGI file upload support works 181 o %xy translations are no longer ever applied after the first '?', 182 ala RFC2396. from lukem 183 o daemon mode (-b) should no longer hang spinning forever if it 184 sees no children. from lukem 185 o new .bzabsredirect file support. from <martin@netbsd.org> 186 o return a 404 error if we see %00 or %2f (/) 187 o don't print 2 "200" headers for CGI 188 o support .torrent files 189 190changes in bozohttpd 20040218: 191 o new .bzredirect file support for sane directory redirection 192 o new -Z option that enables SSL mode, from <rtr@eterna.com.au> 193 o the -C option has been changed to take two explicit options, rather 194 than a single option with a space separating the suffix and the 195 interpreter. ``-C ".foo /path/to/bar"'' should now be written 196 as ``-C .foo /path/to/bar'' 197 o the -M option has been changed like -C and no longer requires or 198 supports a single argument with space-separated options 199 o with -a, still print the 200 OK. from <rtr@eterna.com.au> 200 o with -r, if a .bzdirect file appears in a directory, allow direct 201 access to this directory 202 203changes in bozohttpd 20031005: 204 o fixes for basic authorisation. from <ecu@ipv42.net> 205 o always display file size in directory index mode 206 o add .xbel, .xml & .xsl -> text/xml mappings. from 207 <wiz@danbala.ifoer.tuwien.ac.at> 208 209changes in bozohttpd 20030626: 210 o fix a recent core dump when given no input 211 o add new -r flag that ensures referrer is set to this host 212 o fix several compile time errors with -DNO_CGIBIN_SUPPORT 213 o fix some man page details. from lukem@wasabisystems.com 214 o re-add a missing memset(), fixing a core dump. from lukem 215 o support HTTP basic authorisation, disabled by default. from lukem 216 o print the port number in redirects and errors. from lukem 217 o only syslog the basename of the program. from lukem 218 o add __attribute__() format checking. from lukem 219 o fix cgibin SCRIPT_NAME to have a leading /. from zakj@nox.cx 220 o simplify some code in -C to avoid a core dump. from lukem 221 o add a .css -> css/text entry to the content_map[]. from zakj@nox.cx 222 223changes in bozohttpd 20030409: 224 o -d without DEBUG enabled only prints one warning and continues 225 o one can now define the C macro SERVER_SOFTWARE when building to 226 change the Server: header and CGI variable of the same name 227 o add new -s flag the force logging output to stderr. from zakj@nox.cx 228 o add new -a flag for CGI bin that stops bozohttpd from outputting 229 any HTTP reply, the CGI program must output these. from zakj@nox.cx 230 o new REQUEST_URI and DATE_GMT environment variables for CGI. from 231 zakj@nox.cx 232 o add a "Makefile.boot" that should work with any make program 233 o build on linux again 234 o fix core dumps when using -C 235 236changes in bozohttpd 20030313: 237 o deprecate -r flag; make this the default and silently ignore -r now 238 o add support for file extentions to call CGI programs (from lukem) 239 o add dynamic support to add new content map entries, allowing both 240 new file types and non /cgi-bin CGI programs to be run with the 241 new -C "suffix cgihandler" and -M "suffix type encoding encoding11" 242 options 243 o in -b mode, set the http date after accept() returns, not before we 244 call accept() 245 o in -b mode, bind all addresses found not just the first one 246 o unsupport old hostname API 247 o in -b mode, set the SO_REUSEADDR socket option (lukem) 248 o allow -x (index.html) mode to work with CGI handlers 249 250changes in bozohttpd 20021106: 251 o add .bz2 support 252 o properly escape <, > and & in error messages, partly from 253 Nicolas Jombart <ecu@mariejeanne.net> 254 o new -H flag to hide .* files in directory index mode 255 o fix buffer reallocation when parsing a request, to avoid 256 overflowing the buffer with carriage returns (\r) 257 o do not decode "%XY"-style cgi-bin data beyond the "?" 258 259changes in bozohttpd 5.15 (20020913): 260 o add .ogg support -> `application/x-ogg' 261 o fix CGI requests with "/" in the query part 262 263changes in bozohttpd 5.14 (20020823): 264 o allow -X mode to work for "/" 265 o work on systems without MADV_SEQUENTIAL 266 o make a local cut-down copy of "queue.h" (fixes linux & solaris 267 support at the very least) 268 o portability fixes for pre-ipv6 socket api systems (eg, solaris 7) 269 o portability fixes for missing _PATH_DEFPATH, LOG_FTP and __progname 270 o better documentation on virtual host support 271 272changes in bozohttpd 5.13 (20020804): 273 o support .mp3 files (type audio/mpeg) 274 o use stat() to find out if something is a directory, for -X mode 275 276changes in bozohttpd 5.12 (20020803): 277 o constification 278 o fixes & enhancements for directory index mode (-X) 279 280changes in bozohttpd 5.11 (20020730): 281 o more man page fixes from Thomas Klausner 282 <wiz@danbala.ifoer.tuwien.ac.at> 283 o de-K&R C-ification 284 o fix Date: header for daemon mode 285 o fix core dump when asking for /cgi-bin/ when CGI isn't configured 286 o use a valid Server: header 287 288changes in bozohttpd 5.10 (20020710): 289 - add freebsd support 290 - fix a couple of header typos 291 - many cgi-bin fixes from lukem@netbsd.org 292 - add -T chrootdir and -U user, plus several minor other cleanups 293 with signals and return values. from xs@kittenz.org 294 - add -e that does not clear the environment for -T/-U 295 - fix a formatting error noticed by ISIHARA Takanori <ishit@oak.dti.ne.jp> 296 297changes in bozohttpd 5.09 (20010922): 298 - add a daemon mode 299 - document how to use bozohttpd in netbsd inetd with more than 40 300 connections per minute and also with cgibin 301 - man page fixes from wiz@netbsd.org 302 303changes in bozohttpd 5.08 (20010812): 304 - add directory index generation support (-X) from ad@netbsd.org 305 - add .pa as an alias for .pac 306 - make server software version configurable (RFC) 307 308changes in bozohttpd 5.07 (20010610): 309 - add .png support 310 - new "-x index.html" flag to change default file 311 - new "-p public_html" flag to change default ~user directory 312 - fixes cgi-bin support and more from chuck@research.att.com 313 - add many new content-types, now support most common ones 314 315changes in bozohttpd 5.06 (20000825): 316 - add IPv6 support from itojun@iijlab.net 317 - man page fixes from jlam@netbsd.org 318 319changes in bozohttpd 5.05 (20000815): 320 - fix a virtual host bug, from kleink@netbsd.org 321 322changes in bozohttpd 5.04 (20000427): 323 - fix virtual host support; URI takes precedence over Host: 324 325changes in bozohttpd 5.03 (20000427): 326 - fix a bug with chdir() 327 328changes in bozohttpd 5.02 (20000426): 329 - .pac spport from simonb 330 331changes in bozohttpd 5.01 (20000421): 332 - .swf support 333 - virtual hosting support 334