[pkgsrc/trunk]: pkgsrc/www/bozohttpd update to bozohttpd 20181123. changes i...

[mrg <mrg%pkgsrc.org@localhost>]

details:   https://anonhg.NetBSD.org/pkgsrc/rev/e328ebee15d0
branches:  trunk
changeset: 315416:e328ebee15d0
user:      mrg <mrg%pkgsrc.org@localhost>
date:      Fri Nov 23 21:30:26 2018 +0000

description:
update to bozohttpd 20181123.  changes include:

o  add url remap support via .bzremap file, from martin%netbsd.org@localhost
o  handle redirections for any protocol, not just http:
o  fix a denial of service attack against header contents, which
   is now bounded at 16KiB.  reported by JP
o  reduce default timeouts, and add expand timeouts to handle the
   initial line, each header, and the total time spent
o  add -T option to expose new timeout settings
o  minor RFC fixes related to timeout handling
o  fix special file (.htpasswd, .bz*) bypass.  reported by JP.

anyone using .htpasswd files should update ASAP.

diffstat:

 www/bozohttpd/Makefile                  |   5 ++---
 www/bozohttpd/distinfo                  |  13 ++++++-------
 www/bozohttpd/patches/patch-aa          |  24 ------------------------
 www/bozohttpd/patches/patch-auth-bozo.c |  24 ++++++++++++++++++++++++
 www/bozohttpd/patches/patch-bozohttpd.c |  17 -----------------
 5 files changed, 32 insertions(+), 51 deletions(-)

diffs (111 lines):

diff -r c7c225c68a6f -r e328ebee15d0 www/bozohttpd/Makefile
--- a/www/bozohttpd/Makefile    Fri Nov 23 19:30:41 2018 +0000
+++ b/www/bozohttpd/Makefile    Fri Nov 23 21:30:26 2018 +0000
@@ -1,8 +1,7 @@
-# $NetBSD: Makefile,v 1.88 2017/02/05 13:32:16 leot Exp $
+# $NetBSD: Makefile,v 1.89 2018/11/23 21:30:26 mrg Exp $
 #
 
-DISTNAME=      bozohttpd-20170201
-PKGREVISION=   1
+DISTNAME=      bozohttpd-20181123
 CATEGORIES=    www
 MASTER_SITES=  ${MASTER_SITE_LOCAL}
 EXTRACT_SUFX=  .tar.bz2
diff -r c7c225c68a6f -r e328ebee15d0 www/bozohttpd/distinfo
--- a/www/bozohttpd/distinfo    Fri Nov 23 19:30:41 2018 +0000
+++ b/www/bozohttpd/distinfo    Fri Nov 23 21:30:26 2018 +0000
@@ -1,10 +1,9 @@
-$NetBSD: distinfo,v 1.67 2017/02/05 13:32:16 leot Exp $
+$NetBSD: distinfo,v 1.68 2018/11/23 21:30:26 mrg Exp $
 
-SHA1 (bozohttpd-20170201.tar.bz2) = 725f1a4d1f8782126079608b479cf196ccb5e1d6
-RMD160 (bozohttpd-20170201.tar.bz2) = e1605eeb335896cf099cfd2eabd011fb9277e918
-SHA512 (bozohttpd-20170201.tar.bz2) = f8fba17a454b3825bf0562072bf0acf5890639d83e3bc5c6b7e87f13860d37a3dfc3fd155bd9873d5201b85f31185b24677c22db1cb303fd556f22afa8b7895e
-Size (bozohttpd-20170201.tar.bz2) = 55730 bytes
-SHA1 (patch-aa) = 2e70d3d10aa8bc228331cc1a229ef04106aca210
+SHA1 (bozohttpd-20181123.tar.bz2) = 1f79b928d918ef2c2b25f5d3be0e0339f9cf4c3e
+RMD160 (bozohttpd-20181123.tar.bz2) = 8df5e75a967cf171c859e41a5519c6a9eba91c47
+SHA512 (bozohttpd-20181123.tar.bz2) = 322ab15ee190d08c2371d2f9106d2bd4e3d37f4c630d53f67587218e71d4c13ca7ad54e2e6aadf0b19dd320bc78c671e8b19d9afcf3e740e67efa1b1aad637d2
+Size (bozohttpd-20181123.tar.bz2) = 58992 bytes
 SHA1 (patch-ab) = a1a56a188084440ab907995c7728e435961c5fbd
-SHA1 (patch-bozohttpd.c) = d9b38dab98910f6f372bffd3a472a2c73c79c4a3
+SHA1 (patch-auth-bozo.c) = fb3fa40bee34d156cf91d615d905bb908eb70e4d
 SHA1 (patch-cgi-bozo.c) = 420f981575d7fa1a96ac7049116b9bf64de719df
diff -r c7c225c68a6f -r e328ebee15d0 www/bozohttpd/patches/patch-aa
--- a/www/bozohttpd/patches/patch-aa    Fri Nov 23 19:30:41 2018 +0000
+++ /dev/null   Thu Jan 01 00:00:00 1970 +0000
@@ -1,24 +0,0 @@
-$NetBSD: patch-aa,v 1.19 2010/05/10 03:42:18 mrg Exp $
-
---- auth-bozo.c.orig   2010-05-09 19:51:28.000000000 -0700
-+++ auth-bozo.c        2010-05-09 20:13:45.000000000 -0700
-@@ -38,6 +38,10 @@
- #include <stdlib.h>
- #include <unistd.h>
- 
-+#ifndef NO_SSL_SUPPORT
-+#include <openssl/des.h>
-+#endif
-+
- #include "bozohttpd.h"
- 
- #ifndef AUTH_FILE
-@@ -99,7 +103,7 @@
-                           request->hr_authpass));
-                       if (strcmp(request->hr_authuser, user) != 0)
-                               continue;
--                      if (strcmp(crypt(request->hr_authpass, pass),
-+                      if (strcmp(DES_crypt(request->hr_authpass, pass),
-                                       pass) != 0)
-                               break;
-                       fclose(fp);
diff -r c7c225c68a6f -r e328ebee15d0 www/bozohttpd/patches/patch-auth-bozo.c
--- /dev/null   Thu Jan 01 00:00:00 1970 +0000
+++ b/www/bozohttpd/patches/patch-auth-bozo.c   Fri Nov 23 21:30:26 2018 +0000
@@ -0,0 +1,24 @@
+$NetBSD: patch-auth-bozo.c,v 1.1 2018/11/23 21:30:27 mrg Exp $
+
+--- auth-bozo.c.orig   2018-11-23 13:10:04.000000000 -0800
++++ auth-bozo.c        2018-11-23 13:15:02.729491334 -0800
+@@ -40,6 +40,10 @@
+ #include <stdlib.h>
+ #include <unistd.h>
+ 
++#ifndef NO_SSL_SUPPORT
++#include <openssl/des.h>
++#endif
++
+ #include "bozohttpd.h"
+ 
+ static        ssize_t base64_decode(const unsigned char *, size_t,
+@@ -101,7 +105,7 @@
+                           request->hr_authpass));
+                       if (strcmp(request->hr_authuser, user) != 0)
+                               continue;
+-                      if (strcmp(crypt(request->hr_authpass, pass),
++                      if (strcmp(DES_crypt(request->hr_authpass, pass),
+                                       pass) != 0)
+                               break;
+                       fclose(fp);
diff -r c7c225c68a6f -r e328ebee15d0 www/bozohttpd/patches/patch-bozohttpd.c
--- a/www/bozohttpd/patches/patch-bozohttpd.c   Fri Nov 23 19:30:41 2018 +0000
+++ /dev/null   Thu Jan 01 00:00:00 1970 +0000
@@ -1,17 +0,0 @@
-$NetBSD: patch-bozohttpd.c,v 1.4 2017/02/05 13:32:16 leot Exp $
-
-Adjust SERVER_SOFTWARE to intended version.
-
-From -r1.86 of NetBSD's src/libexec/httpd/bozohttpd.c
-
---- bozohttpd.c.orig   2017-02-01 04:21:23.000000000 +0000
-+++ bozohttpd.c
-@@ -109,7 +109,7 @@
- #define INDEX_HTML            "index.html"
- #endif
- #ifndef SERVER_SOFTWARE
--#define SERVER_SOFTWARE               "bozohttpd/20170102"
-+#define SERVER_SOFTWARE               "bozohttpd/20170201"
- #endif
- #ifndef DIRECT_ACCESS_FILE
- #define DIRECT_ACCESS_FILE    ".bzdirect"