CVS commit: [netbsd-10] src/libexec/httpd

Module Name:	src
Committed By:	martin
Date:		Thu May  7 17:29:08 UTC 2026

Modified Files:
	src/libexec/httpd [netbsd-10]: CHANGES auth-bozo.c bozohttpd.8
	    bozohttpd.c bozohttpd.h daemon-bozo.c lua-bozo.c ssl-bozo.c

Log Message:
Pull up following revision(s) (requested by mrg in ticket #1265):

	libexec/httpd/CHANGES: revision 1.57
	libexec/httpd/daemon-bozo.c: revision 1.23
	libexec/httpd/bozohttpd.8: revision 1.101
	libexec/httpd/lua-bozo.c: revision 1.16
	libexec/httpd/auth-bozo.c: revision 1.29
	libexec/httpd/bozohttpd.h: revision 1.74
	libexec/httpd/ssl-bozo.c: revision 1.35
	libexec/httpd/ssl-bozo.c: revision 1.36
	libexec/httpd/ssl-bozo.c: revision 1.37
	libexec/httpd/bozohttpd.c: revision 1.150
	libexec/httpd/bozohttpd.c: revision 1.151
	libexec/httpd/bozohttpd.c: revision 1.152

Fix iteration over protos[] to prevent out-of-bounds access

Fix use-after-free in the "<a  rel="nofollow" href="http://"">http://"</a>; case

Fix double free of uri (later handled by bozo_clean_request())

Fix off-by-one in case user provided '\x80' in the auth string
log the correct port when using https.
fixes PR#59644.

make the default min TLS version 1.1, as it was documented to be.
fixes PR#58878.

call this bozohttpd 20260503, and update the CHANGES for the last 2 years
o  fix the default minimum TLS version to 1.1 from 1.3.  the
   manual already said 1.1 was the default.  fixes PR#58878.
o  log the correct port with TLS connections.  fixes PR#59644.
o  fix use-after-free, double-free, and bounds checking problems.
   from shm.
o  better lint support.
o  several updates for the manual.  from lukem.
add D Bohdan to the contributors list.


To generate a diff of this commit:
cvs rdiff -u -r1.54.2.1 -r1.54.2.2 src/libexec/httpd/CHANGES
cvs rdiff -u -r1.27.6.1 -r1.27.6.2 src/libexec/httpd/auth-bozo.c
cvs rdiff -u -r1.92.2.1 -r1.92.2.2 src/libexec/httpd/bozohttpd.8
cvs rdiff -u -r1.142.2.1 -r1.142.2.2 src/libexec/httpd/bozohttpd.c
cvs rdiff -u -r1.73 -r1.73.2.1 src/libexec/httpd/bozohttpd.h
cvs rdiff -u -r1.22 -r1.22.6.1 src/libexec/httpd/daemon-bozo.c
cvs rdiff -u -r1.15 -r1.15.20.1 src/libexec/httpd/lua-bozo.c
cvs rdiff -u -r1.32.2.1 -r1.32.2.2 src/libexec/httpd/ssl-bozo.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.