summaryrefslogtreecommitdiff
path: root/www/bozohttpd
AgeCommit message (Collapse)AuthorFilesLines
2022-05-18update to bozohttpd 20220517. changes include:mrg2-7/+6
o remove obsolete .bzdirect handling. o new "-m tlsversion" option to set the minimum TLS version available. partially from <sunil@nimmagadda.net>. o extend the list of available ciphers to include most of the openssl "HIGH" with some additional disables. retain the current list of bad options. should deal with PR#51278. o don't assume host BUFSIZ is sufficient. small BUFSIZ leads to always happens errors in the testsuite. switch all these buffers to be 4KiB sized. reported by embr <git@liclac.eu> o fix a denial of service attack against initial request contents, now bounded at 16KiB. reported by Justin Parrott in PR#56085 o new support for content types: .tar.bz2, .tar.xz, .tar.lz, .tar.zst, .tbz2, .txz, .tlz, .zipx, .xz, .zst, .sz, .lz, .lzma, .lzo, .7z, .lzo, .cab, .dmg, .jar, and .rar. should fix netbsd PR#56026: MIME type of .tar.xz file on ny{cdn,ftp}.NetBSD.org is invalid o fix various NULL derefs from malformed headers. mostly from <emily@ingalls.rocks>. o fix memory leaks in library interface: add bozo_cleanup().
2021-10-26www: Replace RMD160 checksums with BLAKE2s checksumsnia1-2/+2
All checksums have been double-checked against existing RMD160 and SHA512 hashes Not committed (merge conflicts): www/nghttp2/distinfo Unfetchable distfiles (almost certainly fetched conditionally...): ./www/nginx-devel/distinfo array-var-nginx-module-0.05.tar.gz ./www/nginx-devel/distinfo echo-nginx-module-0.62.tar.gz ./www/nginx-devel/distinfo encrypted-session-nginx-module-0.08.tar.gz ./www/nginx-devel/distinfo form-input-nginx-module-0.12.tar.gz ./www/nginx-devel/distinfo headers-more-nginx-module-0.33.tar.gz ./www/nginx-devel/distinfo lua-nginx-module-0.10.19.tar.gz ./www/nginx-devel/distinfo naxsi-1.3.tar.gz ./www/nginx-devel/distinfo nginx-dav-ext-module-3.0.0.tar.gz ./www/nginx-devel/distinfo nginx-rtmp-module-1.2.2.tar.gz ./www/nginx-devel/distinfo nginx_http_push_module-1.2.10.tar.gz ./www/nginx-devel/distinfo ngx_cache_purge-2.5.1.tar.gz ./www/nginx-devel/distinfo ngx_devel_kit-0.3.1.tar.gz ./www/nginx-devel/distinfo ngx_http_geoip2_module-3.3.tar.gz ./www/nginx-devel/distinfo njs-0.5.0.tar.gz ./www/nginx-devel/distinfo set-misc-nginx-module-0.32.tar.gz ./www/nginx/distinfo array-var-nginx-module-0.05.tar.gz ./www/nginx/distinfo echo-nginx-module-0.62.tar.gz ./www/nginx/distinfo encrypted-session-nginx-module-0.08.tar.gz ./www/nginx/distinfo form-input-nginx-module-0.12.tar.gz ./www/nginx/distinfo headers-more-nginx-module-0.33.tar.gz ./www/nginx/distinfo lua-nginx-module-0.10.19.tar.gz ./www/nginx/distinfo naxsi-1.3.tar.gz ./www/nginx/distinfo nginx-dav-ext-module-3.0.0.tar.gz ./www/nginx/distinfo nginx-rtmp-module-1.2.2.tar.gz ./www/nginx/distinfo nginx_http_push_module-1.2.10.tar.gz ./www/nginx/distinfo ngx_cache_purge-2.5.1.tar.gz ./www/nginx/distinfo ngx_devel_kit-0.3.1.tar.gz ./www/nginx/distinfo ngx_http_geoip2_module-3.3.tar.gz ./www/nginx/distinfo njs-0.5.0.tar.gz ./www/nginx/distinfo set-misc-nginx-module-0.32.tar.gz
2021-10-07www: Remove SHA1 hashes for distfilesnia1-2/+1
2021-06-06bozohttpd: define LICENSE, add lua and ssl options, honor CFLAGSnia2-11/+30
2021-03-03update to bozohttpd 20210227.mrg3-12/+12
changes in bozohttpd 20210227: o new support for content types: .tar.bz2, .tar.xz, .tar.lz, .tar.zst, .tbz2, .txz, .tlz, .zipx, .xz, .zst, .sz, .lz, .lzma, .lzo, .7z, .lzo, .cab, .dmg, .jar, and .rar. should fix netbsd PR#56026: MIME type of .tar.xz file on ny{cdn,ftp}.NetBSD.org is invalid changes in bozohttpd 20210211: o fix various NULL derefs from malformed headers. mostly from <emily@ingalls.rocks>. o fix memory leaks in library interface: add bozo_cleanup().
2020-10-15update to bozohttpd 20201014. changes include:mrg4-23/+22
o also set -D_GNU_SOURCE in Makefile.boot. from hadrien.lacour@posteo.net. o fix array size botch (assertion, not exploitable.) from martin@netbsd.org. o also match %2F as well as %2f. from leah@vuxu.org. o many manual and help fixes. clean ups for higher lint levels, consistency/style clean ups. various option fixes including made -f imply -b. from <henrik@gulbra.net> for freebsd. o add .m4a and .m4v file extensions. o make this work on sun2 by reducing mmap window there. o fix SSL shutdown sequence. from spz@netbsd.org. o add readme support to directory indexing. from jmcneill@netbsd.org o add blocklist(8) support. from jruoho@netbsd.org.
2020-01-18*: Recursive revision bump for openssl 1.1.1.jperkin1-1/+2
2019-06-11update to bozohttpd 20190228. changes include:mrg2-7/+7
o extend timeout facility to ssl and stop servers hanging forever if the client never sends anything. reported by Steffen in netbsd PR#50655. o don't display special files in the directory index. they aren't served, but links to them are generated. o fix CGI '+' parameter handling, some error checking, and a double free. from rajeev_v_pillai@yahoo.com o more directory indexing clean up. from rajeev_v_pillai@yahoo.com
2018-12-19update to bozohttpd 20181215. changes include:mrg2-7/+7
o fix .htpasswd bypass for authenticated users. reported by JP, from leot@netbsd.org o avoid possible null dereference when receiving a big request that timeout. reported by maya@netbsd.org, from leot@netbsd.org o fix handling of -T option, from leot@netbsd.org o cleanups and portability improvements, from maya@netbsd.org o change directory indexing to use html tables, from rajeev_v_pillai@yahoo.com
2018-11-25update to bozohttpd 20181125: fix the -X/-x options.mrg2-7/+7
2018-11-24upgrade to 20181124. fixes -i bug, and minor compile issues.mrg2-7/+7
2018-11-23update to bozohttpd 20181123. changes include:mrg4-33/+14
o add url remap support via .bzremap file, from martin@netbsd.org o handle redirections for any protocol, not just http: o fix a denial of service attack against header contents, which is now bounded at 16KiB. reported by JP o reduce default timeouts, and add expand timeouts to handle the initial line, each header, and the total time spent o add -T option to expose new timeout settings o minor RFC fixes related to timeout handling o fix special file (.htpasswd, .bz*) bypass. reported by JP. anyone using .htpasswd files should update ASAP.
2017-02-05Adjust SERVER_SOFTWARE to intended versionleot3-2/+21
Bump PKGREVISION Requested by <mrg>
2017-02-01update to bozohttpd 20170201. from CHANGES:mrg2-7/+7
o fix an infinite loop in cgi processing o fixes and clean up for the testsuite o no longer sends encoding header for compressed formats
2016-06-08Remove the stability entity, it has no meaning outside of an official context.jperkin1-1/+0
2016-06-08Change the service_bundle name to "export" to reduce diffs between thejperkin1-1/+1
original manifest.xml file and the output from "svccfg export".
2016-06-08Add or fix manpath entries to use the correct path.jperkin1-1/+1
2016-04-15update bozohttpd to 20160415. changes include:mrg3-28/+7
o add search-word support for CGI o fix a security issue in CGI suffix handler support which would allow remote code execution, from shm@netbsd.org o -C option supports now CGI scripts only o add CGI support for ~user translation (-E switch) o add redirects to ~user translation o fix bugs around ~user translation o add schema detection for absolute redirects o fixed few memory leaks o bunch of minor tweaks o removed -r support o smarter redirects
2016-03-05Bump PKGREVISION for security/openssl ABI bump.jperkin1-1/+2
2016-02-08Add SMF manifest.jperkin1-0/+35
2015-11-04Add SHA512 digests for distfiles for www categoryagc1-1/+2
Problems found locating distfiles: Package haskell-cgi: missing distfile haskell-cgi-20001206.tar.gz Package nginx: missing distfile array-var-nginx-module-0.04.tar.gz Package nginx: missing distfile encrypted-session-nginx-module-0.04.tar.gz Package nginx: missing distfile headers-more-nginx-module-0.261.tar.gz Package nginx: missing distfile nginx_http_push_module-0.692.tar.gz Package nginx: missing distfile set-misc-nginx-module-0.29.tar.gz Package nginx-devel: missing distfile echo-nginx-module-0.58.tar.gz Package nginx-devel: missing distfile form-input-nginx-module-0.11.tar.gz Package nginx-devel: missing distfile lua-nginx-module-0.9.16.tar.gz Package nginx-devel: missing distfile nginx_http_push_module-0.692.tar.gz Package nginx-devel: missing distfile set-misc-nginx-module-0.29.tar.gz Package php-owncloud: missing distfile owncloud-8.2.0.tar.bz2 Otherwise, existing SHA1 digests verified and found to be the same on the machine holding the existing distfiles (morden). All existing SHA1 digests retained for now as an audit trail.
2015-10-17fix patch to use strlen instead of d_reclen which is the length of the wholerichard2-8/+10
allocated structure including padding. Thanks joerg@.
2015-10-16SunOS doesn't define d_namlen element of dirent structurerichard2-1/+19
but uses d_reclen instead, so define an alias.
2015-03-25update bozohttpd to 20150320 version. changes include:mrg2-6/+6
changes in bozohttpd 20150320: o fix redirection handling o support transport stream (.ts) and video object (.vob) files o directory listings show correct file sizes for large files changes in bozohttpd 20140717: o properly handle SSL errors ok @agc.
2014-10-09Remove pkgviews: don't set PKG_INSTALLATION_TYPES in Makefiles.wiz1-3/+1
2014-07-08update to bozohttpd 20140708. changes include minor bug fixes, .svgmrg2-7/+6
support, and fixes for truncation issues handling .htaccess and .bz*direct files.
2014-02-12Recursive PKGREVISION bump for OpenSSL API version bump.tron1-1/+2
2014-02-02update to bozohttpd 20140201. fixes a core dump.mrg2-6/+6
2014-01-07Fix build on SunOS, no <paths.h> and needs socket libraries.jperkin3-2/+21
2014-01-02update to bozohttpd 20140102. changes include:mrg4-16/+22
o update a few content types o add support for directly calling lua scripts to handle processes, from mbalmer@netbsd.org o properly escape generated HTML o add authentication for redirections, from martin@netbsd.org o handle chained ssl certifications, from elric@netbsd.org o add basic support for gzipped files, from elric@netbsd.org o properly escape generated URIs XXX: could integrate this with lua, but left undone for now.
2013-07-11update to bozohttpd 20130711. changes include:mrg2-7/+6
o properly escape generated HTML o add authentication for redirections, from martin@netbsd.org o handle chained ssl certifications, from elric@netbsd.org o add basic support for gzipped files, from elric@netbsd.org o properly escape generated URIs
2013-02-06PKGREVISION bumps for the security/openssl 1.0.1d update.jperkin1-1/+2
2012-10-28Drop superfluous PKG_DESTDIR_SUPPORT, "user-destdir" is default these days.asau1-2/+1
2011-11-18update to bozohttpd 20111118. changes include:mrg2-6/+6
o add -P <pidfile> option, from jmmv@netbsd.org o avoid crashes with http basic auth, from pooka@netbsd.org o add support for REDIRECT_STATUS variable, from tls@netbsd.org o support .mp4 files in the default map o directory indexes with files with : are now displayed properly, from reed@netbsd.org o allow -I option to be useful in non-inetd mode as well
2010-09-20update to bozohttpd 20100920. changes include:mrg2-6/+6
o use scandir() with alphasort() for sorted directory lists, from moof o fix a serious error in vhost handling; "Host:.." would allow access to the next level directory from the virtual root directory, from seanb o fix some various non standard compile time errors, from rudolf o fix dynamic CGI content maps, from rudolf
2010-06-22update to bozohttpd 20100621. changes include:mrg2-6/+6
o properly fully disable multi-file mode for now o fix the -t and -U options when used without the -e option, broken since the library-ifcation o be explicit that logs go to the FTP facility in syslog
2010-06-17update to bozohttpd 20100617. changes include:mrg2-6/+6
o fix some compile issues o fix SSL mode. from rtr o fix some cgi-bin issues, as seen with cvsweb o disable multi-file daemon mode for now, it breaks o return 404's instead of 403's when chdir of ~user dirs fail o remove "noreturn" attribute from bozo_http_error() that was causing incorrect runtime behaviour with approval from agc.
2010-05-15update to bozohttpd 20100512. includes this important fix:mrg2-6/+6
o fix SSL mode. from rtr.
2010-05-10update this to bozohttpd 20100510. there's no real change here exceptmrg3-18/+9
some compile fixes that aren't relevant for the pkgsrc (but probably should be...)
2010-05-10import bozohttpd 20100509. it has these changes:mrg4-21/+20
o major rework and clean up of internal interfaces. move the main program into main.c, the remaining parts are useable as library. add bindings for lua. by Alistair G. Crooks <agc@netbsd.org> o fix http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=566325 special thanks to al for the majority of these changes.
2010-01-17Recursive PKGREVISION bump for jpeg update to 8.wiz1-1/+2
2009-05-23update to bozohttpd 20090522. change include:mrg2-6/+6
o close more leaking file descriptors for CGI and daemon mode o add subdirs for build "debug" and "small" versions o clean up a bad merge / duplicate code o make mmap() usage portable, fixes linux & ranges: support o document the -f option o daemon mode now serves 6 files per child
2009-04-18update to bozohttpd 20090418. changes include:mrg3-19/+17
o avoid dying in daemon mode for some uncommon, but recoverable, errors o close leaking file descriptors for CGI and daemon mode o handle poll errors properly o don't try to handle more than one request per process yet
2009-04-18update to bozohttpd 20090417.mrg3-32/+6
changes since bozohttpd 20080303: o make bozohttpd internally more modular, preparing the way to handle more than one request per process o fix http-auth, set $REMOTE_USER not $REMOTEUSER. also fix cgi-bin with cvsweb, from Holger Weiss <holger@CIS.FU-Berlin.DE> o fix an uninitialised variable use in daemon mode o fix ssl mode with newer OpenSSL o mmap large files in manageable sizes so we can serve any size file o refactor url processing to handle query strings correctly for CGI from Sergey Katsev at Coyote Point o add If-Modified-Since support, from Joerg Sonnenberger <joerg@netbsd.org> o many more manual fixes, from NetBSD
2008-03-07Drop the inet6 option and mark this package as simply "IPV6_READY"jlam2-10/+6
because it doesn't care about the IP family.
2008-03-07incorporate a fix from the master bozohttpd repo: fix files with spaces.mrg3-2/+28
(or any special char, with no ?.)
2008-03-03Update www/bozohttpd to version 20080303. Changes from version 20060517jlam3-22/+32
include: + Add full DESTDIR support. + Split out package options into a separate options.mk file. * Fix some cgi header processing * Add simple Range: header processing
2008-01-18Per the process outlined in revbump(1), perform a recursive revbumptnn1-2/+2
on packages that are affected by the switch from the openssl 0.9.7 branch to the 0.9.8 branch. ok jlam@
2007-09-08* Use Makefile.boot instead of Makefile so that we don't need BSD makejlam4-17/+37
to build bozohttpd. * Use a custom do-install target to install the binary and the manpage. * Replace the pre-build target with a subst framework class. Bump the PKGREVISION to 1 now that we no longer build or install the catman page.
2007-09-07auth-bozo.c cheats and assumes that libcrypto.so is linked againstjlam2-1/+28
libcrypt.so and so just include <unistd.h> is enough to use crypt(). This doesn't work when the assumption fails. Since we always build with SSL support in pkgsrc, just use the DES_crypt() from the OpenSSL libraries.
generated by cgit v1.2.3 (git 2.39.1) at 2025-04-08 16:19:27 +0000