Commit Graph

313 Commits

Author SHA1 Message Date
mrg b0f74aaafd clean up issues detected by address sanitizer (just some memory
leaks that only apply to the library version.)

XXX: the handling of hr_file and its variants is more crappy
again - the prior clean up is slightly less clean now, but at
least it does not leak memory.

XXX2: cgi-bin test hangs with address sanitizer.  don't know
why yet..
2021-02-11 09:57:52 +00:00
mrg 12d8621dac changes in bozohttpd 20210210:
o  fix various NULL derefs from malformed headers.  mostly from
	   <emily@ingalls.rocks>.
2021-02-11 09:23:55 +00:00
mrg 3b6cf52f57 also set -D_DEFAULT_SOURCE to open up more headers.
allow passing $(EXTRALIBS).
2021-01-17 00:15:14 +00:00
hannken cf205aa356 Bozohttpd clobbers files greater than 4GB on 32bit archs.
Make sure the alignment mask derived from pagesize is an off_t.
2020-11-19 10:45:36 +00:00
wiz 8f3596c5ac New sentence, new line. Fix xref. 2020-10-15 09:54:22 +00:00
mrg 4864410bbc various updates from <henrik@gulbra.net> / freebsd. the list from Henrik:
bozohttpd.8:
    o Added -d flag to the man page
    o Moved -E flag in man page to keep alphabetic order
    o Grammar fix for description of -E flag in man page
    o Moved a word in the man description for the -f flag
    o Made -f imply -b as a backwards-compatible shortcut
    o Updated man description of -n to mention Lua scripts
    o Moved -z below -Z to keep the uppercase options first

bozohttpd.c:
    o Removed obsolete comment about ~user missing cgi-bin support
    o Removed "/* ARGSUSED */" lines; was that a macro or a reminder?
    o Added USE_ARG macro call for sig, which was otherwise not used
    o Added USE_ARG macro call for msg (only used if debug is enabled)

bozohttpd.h:
    o Fixed typo in the include guard (BOZOHTTOPD_H_ -> BOZOHTTPD_H_)
    o Renamed have_all to have_core; it didn't mean "all" options

content-bozo.c:
    o Added USE_ARG macro call for signo, which was otherwise not used
    o Made -f imply -b as a backwards-compatible shortcut

main.c:
    o Simplified -b text to be symmetric with that for the -f option
    o Updated -C text to make "suffix" explicit; it's better than "arg"
    o Changed to only show the -E description if have_user is true
    o Always show the -e option, which incorrectly used the -E logic
    o Renamed have_all to have_core; it didn't mean "all" options
    o Added three missing tabs for the description of the -G option
    o Updated -L text to make "prefix" explicit; it's better than "arg"
    o Updated -M text to make "suffix" explicit; it's slightly better
    o Added a previously missing description for the -n option
    o Documented the otherwise obscure valid types for the -T option
    o Shortened "username" to "user" to match the actual help text
    o Moved handling of -c below that for -C to standardize the order
    o Broke the enabling test for -C into two lines for consistency
    o Inverted the enabling test for -E; this is what was meant, right?
    o Removed the enabling test for -e, which should always be enabled

ssl-bozo.c:
    o Added USE_ARG for httpd, which is not used if SSL has been excluded
2020-10-15 04:21:53 +00:00
mrg bf53dc2363 set -D_GNU_SOURCE in Makefile.boot. from hadrien.lacour@posteo.net.
also match %2F as well as %2f.  from leah@vuxu.org.
introduce defines for "80" and "443".  copyright maint.
2020-10-15 02:19:23 +00:00
rhialto 7f9df6b3cc bozohttpd: correct .m4a to audio/mp4. 2020-09-12 14:44:25 +00:00
rhialto d4ca506457 bozohttpd: add .m4a and .m4v file extensions. 2020-09-12 12:39:28 +00:00
mrg ea8f81f33c avoid passing NULL pointers to printf() like functions and %s. 2020-09-05 13:38:24 +00:00
leot 056172a33c Fix a typo in a comment 2020-08-25 20:02:33 +00:00
mrg 1172b145cf call this bozohttpd/20200820 2020-08-20 07:57:01 +00:00
mrg 0370405840 compare mmap return again MAP_FAILED not -1 or 0. 2020-08-20 07:56:26 +00:00
mrg 560f0b4f2d update for recent changes. 2020-08-20 07:55:10 +00:00
spz 0acfa6caa5 send close_notify for the ssl connection before closing the TCP connection
Thanks to Dr. Thomas Orgis for reporting the issue.
2020-08-20 05:46:31 +00:00
jruoho 5f5a8e24b4 Add -DNO_BLOCKLIST_SUPPORT also to small/Makefile. 2020-07-13 10:35:17 +00:00
wiz 8062a6751f Use Nx. 2020-07-13 09:41:18 +00:00
jruoho 830b8c5218 Do not report status code 500 to blocklistd(8) Add -DNO_BLOCKLIST_SUPPORT
to Makefile.boot.
2020-07-13 09:38:57 +00:00
jruoho c0b4b2d279 Add blocklistd(8) support. 2020-07-11 08:10:52 +00:00
jmcneill 026e4ac043 Add -R flag to specify a README file to add at the bottom of directory
autoindex listings.
2020-07-06 23:31:36 +00:00
fox fe9ca5aa84 libexec/httpd: Fix the possible -Werror=stringop-truncation
Error was reported when build.sh was run with MKLIBCSANITIZER=yes flag.

Reviewed by: kamil@, mrg@
2020-06-07 23:33:02 +00:00
mrg e563647e37 remove some XXX comments. one isn't relevant, and the other two
have been incorrect for a long while now.
2019-12-06 05:53:20 +00:00
mrg 50851f2ac3 set -D_GNU_SOURCE, needed for linux systems and should be
harmless or ignored elsewhere.

from perry.
2019-10-30 07:28:13 +00:00
martin 9e275c0f36 Account for cgihandler being set when counting the number of CGI environment
headers we are about to set. Avoids an assertion failure (and overruninng
the array) later.
2019-03-29 14:46:44 +00:00
mrg 58a223ca24 add $NetBSD$ 2019-03-27 04:50:30 +00:00
mrg 8b21018e17 on m68010 set BOZO_WRSZ to 16k and BOZO_WRSZ to 64k. 2019-03-08 03:12:28 +00:00
mrg 767fb2605a call this bozohttpd 20190228, and merge the CHANGES entries from the
previous release.
2019-02-28 09:16:42 +00:00
mrg 08dbfa234a add ssl specific timeout value (30s). if SSL_accept() doesn't
work with in this timeout value, ssl setup now fails.

mostly different from, but inspired from the patch in PR 50655
2019-02-28 08:28:21 +00:00
dholland ad8aa774f5 fix duplicated chunk from merge 2019-01-27 04:33:29 +00:00
pgoyette d91f98a871 Merge the [pgoyette-compat] branch 2019-01-27 02:08:33 +00:00
mrg 00e064adab o don't display special files in the directory index. they aren't
served, but links to them are generated.
2019-01-22 05:32:57 +00:00
mrg 8f49d6e252 rework size_arrays():
- avoid calloc, use bozomalloc
- minor CSE
- fix bozoprefs->size setting when increasing the size (new total was
  being added to the prior total.)  found by clang static analyzer
  from rajeev_v_pillai.

pass httpd to size_arrays() now.
free(NULL) is legal.
2019-01-18 06:04:10 +00:00
mrg 5335936687 fix a few problems pointed out by clang static analyzer, from rajeev_v_pillai:
- bozostrnsep() may return with "in = NULL", so check for it.
- nul terminating in bozo_escape_rfc3986() can be simpler
- don't use uniinit variables in check_remap()
- don't use re-used freed data in check_virtual().  this one is tricky as
  the original code was:
	free(request->hr_file);
	request->hr_file = bozostrdup(httpd, request, s ? s : "/");
  however, bozostrdup() may reference request->hr_file.
2019-01-18 05:48:31 +00:00
mrg 9b91523ebd - call this 20190116
- adjust the directory indexing again:
  - don't include "index.html" in html headers
  - additional escaping of names
  - re-add top/bottom borders
  - adds an aquamarine table header
  - Zebra-stripes table rows using CSS instead of code
  all from "Rajeev V. Pillai" <rajeev_v_pillai@yahoo.com>
2019-01-17 07:46:16 +00:00
mrg d1eeb82409 add 'check' target to toplevel makefile.
fix the t11.out output now that CGI parsing works better.
2019-01-17 07:39:00 +00:00
mrg 9c0805993a - fix CGI '+' param and error handling.
- remove unused parameter to daemon_poll_err().

both from "Rajeev V. Pillai" <rajeev_v_pillai@yahoo.com>
2019-01-17 07:34:06 +00:00
mrg 4aff0e8a96 remove reference to deleted -r option. fixes PR#53840 from J. Lewis Muir. 2019-01-08 06:04:29 +00:00
mrg 48003606bd minor rewording. fix alphabeta ordering of contributors. 2018-12-19 12:40:32 +00:00
mrg ff386e5b59 fix an old spell-o and a new format-o. 2018-12-18 23:11:40 +00:00
leot 6816df1bc3 Document last changes and bump version to 20181215
Suggested by <mrg>, thanks! (Possible mistakes are mine though!)
2018-12-15 12:52:36 +00:00
leot 9644d25eb4 Fix handling of bozo_set_timeout() timeouts (and `-T' option parsing) 2018-12-15 12:43:24 +00:00
leot 6c2202365c Avoid .htpasswd exposure to authenticated users when .htpasswd is
in the slashdir too.

Problem reported by JP via tech-security@ and discussed with <mrg>, thanks!
2018-12-15 12:39:22 +00:00
leot 1f52a22c8c Avoid possible NULL dereference when sending a big request that timeout.
Problem reported by <maya> and reviewed by <maya> and <mrg>, thanks!
2018-12-15 09:28:27 +00:00
maya d6e51063d8 strings.h for strcasecmp (on linux) 2018-12-15 02:03:24 +00:00
maya 69e8cec185 Check against BOZO_HEADERS_MAX_SIZE in a way that isn't prone to overflow.
Note that this isn't reachable in practice as big requests time out.
2018-12-15 01:02:34 +00:00
maya 6807b854c1 Don't pass ${HOST} to test scripts.
htnl_cmp compares against the output of `hostname`.

This makes the tests pass on my machine.
2018-12-14 23:57:22 +00:00
mrg 34ece249a9 use html tables for directory index.
from "Rajeev V. Pillai" <rajeev_v_pillai@yahoo.com>

call this bozohttpd 20181204.
2018-12-04 02:52:42 +00:00
mrg 3d201ca797 avoid sign extension in % handling (and printing 0xFFFFFF before
wanted values.)  from Rajeev V. Pillai.
2018-12-04 00:26:15 +00:00
mrg a0c45e363d normalise some messages. 2018-11-25 23:48:14 +00:00
mrg cd79b847e8 add option fixes here. 2018-11-25 23:37:09 +00:00