serve .iso as "application/octet-stream". bump version & copyright.

Add a -q option to make http quiet (no log messages).

Usefull when running multiple instances and some for (high traffic)
APIs e.g. to receive log data from appliences - it makes not sense
to duplic

Add a -q option to make http quiet (no log messages).

Usefull when running multiple instances and some for (high traffic)
APIs e.g. to receive log data from appliences - it makes not sense
to duplicate the whole log in the xferlog file (but we can't configure
that at the syslog level due to other httpd instances using that).

show more ...

extend the list of available ciphers to include most of the
openssl "HIGH" with some additional disables. retain the current
list of bad options. should deal with PR#51278.

implement tls minimum version setting.

mostly from sunil@nimmagadda.net in PR#55830, though i moved the
member into the main http structure, so that it doesn't trigger
sslinfo being allocated via co

implement tls minimum version setting.

mostly from sunil@nimmagadda.net in PR#55830, though i moved the
member into the main http structure, so that it doesn't trigger
sslinfo being allocated via command line without the rest of the
ssl being setup (which then leads to crashes.)

show more ...

various updates from <henrik@gulbra.net> / freebsd. the list from Henrik:

bozohttpd.8:
o Added -d flag to the man page
o Moved -E flag in man page to keep alphabetic order
o Grammar fix

various updates from <henrik@gulbra.net> / freebsd. the list from Henrik:

bozohttpd.8:
o Added -d flag to the man page
o Moved -E flag in man page to keep alphabetic order
o Grammar fix for description of -E flag in man page
o Moved a word in the man description for the -f flag
o Made -f imply -b as a backwards-compatible shortcut
o Updated man description of -n to mention Lua scripts
o Moved -z below -Z to keep the uppercase options first

bozohttpd.c:
o Removed obsolete comment about ~user missing cgi-bin support
o Removed "/* ARGSUSED */" lines; was that a macro or a reminder?
o Added USE_ARG macro call for sig, which was otherwise not used
o Added USE_ARG macro call for msg (only used if debug is enabled)

bozohttpd.h:
o Fixed typo in the include guard (BOZOHTTOPD_H_ -> BOZOHTTPD_H_)
o Renamed have_all to have_core; it didn't mean "all" options

content-bozo.c:
o Added USE_ARG macro call for signo, which was otherwise not used
o Made -f imply -b as a backwards-compatible shortcut

main.c:
o Simplified -b text to be symmetric with that for the -f option
o Updated -C text to make "suffix" explicit; it's better than "arg"
o Changed to only show the -E description if have_user is true
o Always show the -e option, which incorrectly used the -E logic
o Renamed have_all to have_core; it didn't mean "all" options
o Added three missing tabs for the description of the -G option
o Updated -L text to make "prefix" explicit; it's better than "arg"
o Updated -M text to make "suffix" explicit; it's slightly better
o Added a previously missing description for the -n option
o Documented the otherwise obscure valid types for the -T option
o Shortened "username" to "user" to match the actual help text
o Moved handling of -c below that for -C to standardize the order
o Broke the enabling test for -C into two lines for consistency
o Inverted the enabling test for -E; this is what was meant, right?
o Removed the enabling test for -e, which should always be enabled

ssl-bozo.c:
o Added USE_ARG for httpd, which is not used if SSL has been excluded

show more ...

set -D_GNU_SOURCE in Makefile.boot. from hadrien.lacour@posteo.net.
also match %2F as well as %2f. from leah@vuxu.org.
introduce defines for "80" and "443". copyright maint.

send close_notify for the ssl connection before closing the TCP connection
Thanks to Dr. Thomas Orgis for reporting the issue.

add ssl specific timeout value (30s). if SSL_accept() doesn't
work with in this timeout value, ssl setup now fails.

mostly different from, but inspired from the patch in PR 50655

many clean ups:
- keep a list of special files and their human names
- remove (void) casts on bozo_http_error()
- fix a few more misuses of bozo_http_error()
- rename check_mapping() to check_remap()

many clean ups:
- keep a list of special files and their human names
- remove (void) casts on bozo_http_error()
- fix a few more misuses of bozo_http_error()
- rename check_mapping() to check_remap() and perform some CSE
- switch away from ``%s'' to '%s'
- remove a bunch of #ifdef using new have_feature defines

show more ...

from CHANGES:

o reduce default timeouts, and add expand timeouts to handle the
initial line, each header, and the total time spent
o add -T option to expose new timeout settings
o minor RFC fi

from CHANGES:

o reduce default timeouts, and add expand timeouts to handle the
initial line, each header, and the total time spent
o add -T option to expose new timeout settings
o minor RFC fixes related to timeout handling responses

old timeouts:
60 seconds for initial request like, 60 seconds per header line,
and no whole timeout (though the recent total header size changes
do introduce one that would be about 11 hours.)
new timeouts:
30 seconds for initial request like, 10 seconds per header line,
and a total request time of 600 seconds.


the new global timeout is implemented using CLOCK_MONOTONIC, with
a fallback to CLOCK_REALTIME if monotonic time is unavailable.


reject multiple Host: headers. besides being protocol standard,
this closes one additional memory leak found by JP. add a simple
test to check this.


clean up option and usage handling some.

show more ...

- need string.h
- cast options to long for OpenSSL-1.1

rename bozo_err/bozo_warn/bozo_asprintf to bozoerr/etc.
new rule is that function that mirror libc-style functions get no underscore.

several clean ups:

- bozostrdup() gains a request parameter, and uses it to determine
what sort of error handling is required
- bozo_strdup() dies
- size_arrays() reduced slightly, pushing error h

several clean ups:

- bozostrdup() gains a request parameter, and uses it to determine
what sort of error handling is required
- bozo_strdup() dies
- size_arrays() reduced slightly, pushing error handling into the caller
- convert to size_t for some array indices
- bozo_set_pref() and bozo_init_prefs() gain httpd parameters
- apply a bunch of manual CSE to vastly reduce the number of times the
string "request->hr_httpd" appears.
- CGI parse_header() takes a request not httpd now

XXX: lua glue updated to call bozo_init_prefs() with htttpd parameter,
but i'm only guessing here.

show more ...

Introduce bozo_strdup and bozo_asprintf to add error checking and reduce
code duplication.

Note that bozo_strdup is different that bozostrdup; the _ routines exit
loging error to syslog or stderr, w

Introduce bozo_strdup and bozo_asprintf to add error checking and reduce
code duplication.

Note that bozo_strdup is different that bozostrdup; the _ routines exit
loging error to syslog or stderr, whereas the non _ routines send error
responses to the http client.

show more ...

- restrict the default list of ciphers to something more secure
- restrict ssl options
From Travis Paul

rewrite much of the SSL code:
- handle errors in many places they weren't properly
- make SSL_accept() an error the main code notices
- expand bozo_ssl_err() to include bozo_ssl_warn(), bozo_clear_ss

rewrite much of the SSL code:
- handle errors in many places they weren't properly
- make SSL_accept() an error the main code notices
- expand bozo_ssl_err() to include bozo_ssl_warn(), bozo_clear_ssl_queue()
- remove empty bozo_ssl_flush()

show more ...

use const and remove unnecessary braces.

- update CHANGES with recent changes
- update version to 20140102
- update copyrights
- use getcwd() over getwd()
- fix lean build (don't include lua)

Add BOZO_PRINTFLIKE for functions that pass an argument and va_arg to
a vprintf-like function.

Use a ``certificate chain file'' rather than a ``certificate file'' so
that bozohttpd can be used with non-toplevel certs.

merge bozohttpd 20111118

Don't check for __attribute__ being defined, it won't. Check for GCC 3.x
or compatible and define BOZO_PRINTFLIKE / BOZO_DEAD. Fix fallout.

Fix typo.

use const char [] for format.

XXX: gcc avoid non-literal strings