initial import of bozohttpd 20100920. the only change missing in here…

… is:

        o  fix dynamic CGI content maps, from rudolf

libexec/httpd/CHANGES

@@ -1,10 +1,15 @@
-$eterna: CHANGES,v 1.76 2010/06/21 06:45:45 mrg Exp $
+$eterna: CHANGES,v 1.77 2010/09/20 22:26:28 mrg Exp $
 
 changes since bozohttpd 20100617:
 	o  properly fully disable multi-file mode for now
 	o  fix the -t and -U options when used without the -e option, broken since
 	   the library-ifcation
 	o  be explicit that logs go to the FTP facility in syslog
+	o  use scandir() with alphasort() for sorted directory lists, from moof
+	o  fix a serious error in vhost handling; "Host:.." would allow access to
+	   the next level directory from the virtual root directory, from seanb
+	o  fix some various non standard compile time errors, from rudolf
+	o  fix dynamic CGI content maps, from rudolf
 
 changes since bozohttpd 20100509:
 	o  fix some compile issues

libexec/httpd/Makefile

@@ -1,9 +1,9 @@
-#	$eterna: Makefile,v 1.29 2010/05/10 02:24:30 mrg Exp $
+#	$eterna: Makefile,v 1.30 2010/07/11 00:34:27 mrg Exp $
 #
 # berkeley (netbsd) makefile.  see Makefile.boot for other systems.
 
 # compile-time options are:
-#	DEBUG			/* include debugging support */
+#	NO_DEBUG		/* don't include debugging support */
 #	NO_USER_SUPPORT		/* don't support /~user requests */
 #	NO_CGIBIN_SUPPORT	/* don't support cgi-bin requests */
 #	NO_DIRINDEX_SUPPORT	/* don't support directory indexing */
@@ -14,7 +14,7 @@
 #
 # these are usually set via the "COPTS" variable, or some other method
 # for setting CFLAGS relevant to your make, eg
-#   % make COPTS="-DDEBUG -DDO_HTPASSWD"
+#   % make COPTS="-DDO_HTPASSWD"
 
 PROG?=	bozohttpd
 MAN=	bozohttpd.8

libexec/httpd/bozohttpd.8

@@ -1,4 +1,4 @@
-.\"	$eterna: bozohttpd.8,v 1.98 2010/06/21 06:47:23 mrg Exp $
+.\"	$eterna: bozohttpd.8,v 1.99 2010/09/20 22:26:28 mrg Exp $
 .\"
 .\" Copyright (c) 1997-2010 Matthew R. Green
 .\" All rights reserved.
@@ -24,7 +24,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.Dd June 17, 2010
+.Dd September 20, 2010
 .Dt BOZOHTTPD 8
 .Os BOZOS
 .Sh NAME
@@ -456,7 +456,7 @@ The focus has always been simplicity and security, with minimal features
 and regular code audits.
 This manual documents
 .Nm
-version 20100621.
+version 20100920.
 .Sh AUTHORS
 .Nm
 was written by Matthew R. Green
@@ -473,6 +473,10 @@ Christoph Badura
 .Aq bad@bsd.de
 provided Range: header support
 .It
+Sean Boudreau
+.Aq seanb@NetBSD.org
+provided an security fix for virtual hosting
+.It
 Julian Coleman
 .Aq jdc@coris.org.uk
 provided an IPv6 bugfix
@@ -547,6 +551,10 @@ Tyler Retzlaff
 .Aq rtr@eterna.com.au
 provided SSL support, cgi-bin fixes and much other random other stuff
 .It
+rudolf
+.Aq netbsd@eq.cz
+provided minor compile fixes and a CGI content map fix
+.It
 Steve Rumble
 .Aq rumble@ephemeral.org
 provided the

libexec/httpd/bozohttpd.c

@@ -1,4 +1,4 @@
-/*	$eterna: bozohttpd.c,v 1.174 2010/06/21 06:47:23 mrg Exp $	*/
+/*	$eterna: bozohttpd.c,v 1.176 2010/09/20 22:26:28 mrg Exp $	*/
 
 /*
  * Copyright (c) 1997-2010 Matthew R. Green
@@ -107,7 +107,7 @@
 #define INDEX_HTML		"index.html"
 #endif
 #ifndef SERVER_SOFTWARE
-#define SERVER_SOFTWARE		"bozohttpd/20100621"
+#define SERVER_SOFTWARE		"bozohttpd/20100920"
 #endif
 #ifndef DIRECT_ACCESS_FILE
 #define DIRECT_ACCESS_FILE	".bzdirect"
@@ -327,13 +327,12 @@ void
 bozo_clean_request(bozo_httpreq_t *request)
 {
 	struct bozoheaders *hdr, *ohdr = NULL;
-	bozohttpd_t *httpd = request->hr_httpd;
 
 	if (request == NULL)
 		return;
 
 	/* If SSL enabled cleanup SSL structure. */
-	bozo_ssl_destroy(httpd);
+	bozo_ssl_destroy(request->hr_httpd);
 
 	/* clean up request */
 #define MF(x)	if (request->x) free(request->x)
@@ -609,10 +608,6 @@ bozo_read_request(bozohttpd_t *httpd)
 				str,
 				host ? host : addr ? addr : "<local>",
 				port ? port : "<stdin>");
-#if 0
-			debug((httpd, DEBUG_FAT,
-				"read_req, getting request: ``%s''", str));
-#endif
 
 			/* we allocate return space in file and query only */
 			parse_request(httpd, str, &method, &file, &query, &proto);
@@ -953,9 +948,7 @@ check_virtual(bozo_httpreq_t *request)
 {
 	bozohttpd_t *httpd = request->hr_httpd;
 	char *file = request->hr_file, *s;
-	struct dirent **list;
 	size_t len;
-	int i;
 
 	if (!httpd->virtbase)
 		goto use_slashdir;
@@ -990,18 +983,33 @@ check_virtual(bozo_httpreq_t *request)
 	    request->hr_host, httpd->virtbase, request->hr_file));
 	if (strncasecmp(httpd->virthostname, request->hr_host, len) != 0) {
 		s = 0;
-		for (i = scandir(httpd->virtbase, &list, 0, 0); i--; list++) {
-			debug((httpd, DEBUG_OBESE, "looking at dir``%s''",
-			    (*list)->d_name));
-			if (strncasecmp((*list)->d_name, request->hr_host,
-			    len) == 0) {
-				/* found it, punch it */
-				httpd->virthostname = (*list)->d_name;
-				if (asprintf(&s, "%s/%s", httpd->virtbase,
-						httpd->virthostname) < 0)
-					bozo_err(httpd, 1, "asprintf");
-				break;
+		DIR *dirp;
+		struct dirent *d;
+
+		if ((dirp = opendir(httpd->virtbase)) != NULL) {
+			while ((d = readdir(dirp)) != NULL) {
+				if (strcmp(d->d_name, ".") == 0 ||
+				    strcmp(d->d_name, "..") == 0) {
+					continue;
+				}
+				debug((httpd, DEBUG_OBESE, "looking at dir``%s''",
+			 	   d->d_name));
+				if (strncasecmp(d->d_name, request->hr_host,
+				    len) == 0) {
+					/* found it, punch it */
+					debug((httpd, DEBUG_OBESE, "found it punch it"));
+					httpd->virthostname = d->d_name;
+					if (asprintf(&s, "%s/%s", httpd->virtbase,
+					    httpd->virthostname) < 0)
+						bozo_err(httpd, 1, "asprintf");
+					break;
+				}
 			}
+			closedir(dirp);
+		}
+		else {
+			debug((httpd, DEBUG_FAT, "opendir %s failed: %s",
+			    httpd->virtbase, strerror(errno)));
 		}
 		if (s == 0) {
 			if (httpd->unknown_slash)
@@ -1520,7 +1528,7 @@ bozo_print_header(bozo_httpreq_t *request,
 	bozo_flush(httpd, stdout);
 }
 
-#ifdef DEBUG
+#ifndef NO_DEBUG
 void
 debug__(bozohttpd_t *httpd, int level, const char *fmt, ...)
 {
@@ -1541,7 +1549,7 @@ debug__(bozohttpd_t *httpd, int level, const char *fmt, ...)
 	va_end(ap);
 	errno = savederrno;
 }
-#endif /* DEBUG */
+#endif /* NO_DEBUG */
 
 /* these are like warn() and err(), except for syslog not stderr */
 void

libexec/httpd/bozohttpd.h

@@ -1,4 +1,4 @@
-/*	$eterna: bozohttpd.h,v 1.35 2010/06/17 00:49:30 mrg Exp $	*/
+/*	$eterna: bozohttpd.h,v 1.37 2010/09/20 22:26:28 mrg Exp $	*/
 
 /*
  * Copyright (c) 1997-2010 Matthew R. Green
@@ -160,13 +160,13 @@ typedef struct bozoprefs_t {
 
 #define	strornull(x)	((x) ? (x) : "<null>")
 
-#ifdef DEBUG
+#ifndef NO_DEBUG
 void	debug__(bozohttpd_t *, int, const char *, ...)
 			__attribute__((__format__(__printf__, 3, 4)));
 #define debug(x)	debug__ x
 #else
 #define	debug(x)	
-#endif /* DEBUG */
+#endif /* NO_DEBUG */
 
 void	bozo_warn(bozohttpd_t *, const char *, ...)
 		__attribute__((__format__(__printf__, 2, 3)));
@@ -235,7 +235,7 @@ void	bozo_add_content_map_cgi(bozohttpd_t *, const char *, const char *);
 #ifdef NO_DAEMON_MODE
 #define bozo_daemon_init(x)				/* nothing */
 #define bozo_daemon_fork(x)				0
-#define bozo_daemon_closefds()				/* nothing */
+#define bozo_daemon_closefds(x)				/* nothing */
 #else
 void	bozo_daemon_init(bozohttpd_t *);
 int	bozo_daemon_fork(bozohttpd_t *);
@@ -253,7 +253,7 @@ int	bozo_user_transform(bozo_httpreq_t *, int *);
 
 /* dir-index-bozo.c */
 #ifdef NO_DIRINDEX_SUPPORT
-#define bozo_dir_index(a, b, c, d)		0
+#define bozo_dir_index(a, b, c)				0
 #else
 int	bozo_dir_index(bozo_httpreq_t *, const char *, int);
 #endif /* NO_DIRINDEX_SUPPORT */