3 1a04137e 2022-03-27 op ## 2022/03/27 - 1.8.3 “Lightbulb Sun” bugfix release
7 1a04137e 2022-03-27 op * fix a possible out-of-bound access in the CGI handling. It was introduced last October during a refactoring, but due to how many malloc(3) implementations works this hasn't been found until now. Otto' malloc is more strict fortunately.
10 62a46b03 2022-03-26 op ## 2022/03/26 - 1.8.2 “Lightbulb Sun” bugfix release
14 62a46b03 2022-03-26 op * fix a CGI timing issue: if a connection handled by a CGI scripts is interrupted with the right timing it causes the server process to exit with "fatal in client_by_id: invalid id X".
16 62a46b03 2022-03-26 op ### New Features
18 62a46b03 2022-03-26 op * add a new block `type { ... }' to define mime types mapping.
20 62a46b03 2022-03-26 op ### Improvements
22 62a46b03 2022-03-26 op * use shell built-in `command' instead of which(1), prodded by cage and Allen Sobot.
23 62a46b03 2022-03-26 op * configure script: allow to set MANDIR from cmdline (Allen Sobot)
24 62a46b03 2022-03-26 op * add systemd-sysusers sample file in contrib/ (Nakaya)
25 62a46b03 2022-03-26 op * [linux/seccomp] allow fstatat64(2), llseek(2) and sigreturn(2), needed by glibc on armv7. (Tobias Berger)
26 62a46b03 2022-03-26 op * [linux/seccomp] tightens rules by allowing openat(2) only with the O_RDONLY flag.
29 c6ae2561 2022-02-10 op ## 2022/02/10 - 1.8.1 “Lightbulb Sun” bugfix release
33 c6ae2561 2022-02-10 op * fix landlock usage on linux: don't assume that access capabilities not listed are implicitly denied, because they are not. Mickaël Salaün, the landlock author, found the same error on game of trees:
35 c6ae2561 2022-02-10 op > In a nutshell, the ruleset's handled_access_fs is required for backward and forward compatibility (i.e. the kernel and user space may not know each other's supported restrictions), hence the need to be explicit about the denied-by-default access rights.
37 c6ae2561 2022-02-10 op In practice this affects only linux and only partially: thanks to the design of the daemon and the seccomp filter the effects of this mistake in handling landlock are fortunately limited. However, in theory at least, gmid could be for e.g. tricked into truncating existing files, so it's highly suggested to update.
39 c6ae2561 2022-02-10 op ## Improvements
41 c6ae2561 2022-02-10 op All by Anna “CyberTailor”, thanks!
43 c6ae2561 2022-02-10 op * don't skip unit tests when SKIP_RUNTIME_TEST is set
44 c6ae2561 2022-02-10 op * add `gg' to the regress target dependencies
45 c6ae2561 2022-02-10 op * fix the "implicit declaration of asprintf" warning
46 c6ae2561 2022-02-10 op * sync vim syntax
49 de721c43 2022-01-30 op ## 2022/01/30 - 1.8 “Lightbulb Sun”
51 de721c43 2022-01-30 op ### New Features
53 de721c43 2022-01-30 op * reverse proxying support: gmid now can relay gemini requests to other hosts.
54 de721c43 2022-01-30 op * install gg too: it's a simple gemini client ("gemini get") initially developed as part of the regression suite.
55 de721c43 2022-01-30 op * added OCSP stapling support (by @The-King-of-Toasters, thanks!)
56 de721c43 2022-01-30 op * add gencert, a simple script to generate self-signed certs.
57 de721c43 2022-01-30 op * add renew-certs, a script to automatically renew self-signed certs.
58 de721c43 2022-01-30 op * multiple -n partially dump the parsed configuration.
60 de721c43 2022-01-30 op ### Improvements
62 de721c43 2022-01-30 op * reworked the fastcgi subsystem, now it's completely asynchronous.
63 de721c43 2022-01-30 op * refactored the internal of the server too.
64 de721c43 2022-01-30 op * refactored the regression suite (in particular reduced the timeout for single tests from 30 to 10 seconds.)
65 de721c43 2022-01-30 op * configure: add support for --prefix=... autoconf-style flag.
66 de721c43 2022-01-30 op * relax the "wont proxy" check: don't check that the port in the request is the same we're listening on. Suggested and discussed with Allen Sobot, thanks!
67 de721c43 2022-01-30 op * relax the strict ordering of options, locations and proxy blocks inside a server block.
71 de721c43 2022-01-30 op * don't pass through illegal replies from CGI scripts.
72 de721c43 2022-01-30 op * fix the "double slash" error in logs.
73 de721c43 2022-01-30 op * fix the configure for cross-compilation: don't run the test binaries just built. Suggested by Nikolay Korotkiy (@sikmir), thanks!
74 de721c43 2022-01-30 op * (seccomp) allow ugetrlimit(2), needed by glibc on arm7l. By Max, thanks!
77 21dc3794 2022-01-28 op ## 2021/10/15 - 1.7.5 “Space-dye Vest” fifth bugfix release
79 21dc3794 2022-01-28 op This version includes the following bugfix
81 21dc3794 2022-01-28 op * don’t die when a connection is closed before being accepted by gmid (i.e. handle ‘ECONNRESET’)
84 21dc3794 2022-01-28 op ## 2021/09/24 - 1.7.4 “Space-dye Vest” fourth bugfix release
86 21dc3794 2022-01-28 op This version includes the following bugfix:
88 21dc3794 2022-01-28 op * fix a possible out-of-bound access when handling a request for a non-existent file in the root directory of a vhost that's matched by the cgi option
90 21dc3794 2022-01-28 op and the relative regression test.
93 21dc3794 2022-01-28 op ## 2021/09/19 - 1.7.3 “Space-dye Vest” third bugfix release
95 21dc3794 2022-01-28 op ### Improvements
97 21dc3794 2022-01-28 op * follows symlinks
98 21dc3794 2022-01-28 op * improved documentation and added key generation example (thanks! Anna)
102 21dc3794 2022-01-28 op * fix syslog logging on FreeBSD. Reported by Karl Jeacle, thanks!
103 21dc3794 2022-01-28 op * don't crash if ``-c'' is missing in configtest mode (-n). Reported by heph, thanks!
104 21dc3794 2022-01-28 op * allow fstat64 on linux (needed by glibc on aarch64). Reported by pine, thanks!
107 21dc3794 2022-01-28 op ## 2021/07/19 - 1.7.2 “Space-dye Vest” second bugfix release
109 21dc3794 2022-01-28 op This version incudes the following bugfix:
111 21dc3794 2022-01-28 op * an un-initialized field in the configless code path leads to a crash on the first request.
113 21dc3794 2022-01-28 op and the relative regression test.
116 21dc3794 2022-01-28 op ## 2021/07/11 - 1.7.1 “Space-dye Vest” bugfix release
118 21dc3794 2022-01-28 op This version includes two bugfixes:
119 21dc3794 2022-01-28 op * use ${MAKE} to recursively call make.
120 21dc3794 2022-01-28 op * fix the misleading example in the manpage: macros may not be reserved words
123 21dc3794 2022-01-28 op ## 2021/07/10 - 1.7 “Space-dye Vest”
125 21dc3794 2022-01-28 op Starting from this version gmid doesn't depend on lex anymore, but yacc is still needed.
127 21dc3794 2022-01-28 op ### New features
129 21dc3794 2022-01-28 op * initial fastcgi support! (it's still young!)
130 21dc3794 2022-01-28 op * added user-defined macros, either via ‘-Dname=val’ or directly in the configuration file.
131 21dc3794 2022-01-28 op * new ‘include’ keyword to load additional configuration files.
132 21dc3794 2022-01-28 op * new ‘env’ rule to define environment vars for CGI scripts.
133 21dc3794 2022-01-28 op * new ‘alias’ rule to define hostname aliases for a server.
134 21dc3794 2022-01-28 op * allow ‘root’ to be specified per-location block.
135 21dc3794 2022-01-28 op * pidfile support with the new ‘-P’ cli flag.
136 21dc3794 2022-01-28 op * define ‘TLS_VERSION’, ‘TLS_CIPHER’ and ‘TLS_CIPHER_STRENGTH’ for CGI scripts.
138 21dc3794 2022-01-28 op ### Improvements
140 21dc3794 2022-01-28 op * remove limits on the number of virtual hosts and location blocks that can be defined.
141 21dc3794 2022-01-28 op * print the datetime when logging to stderr.
142 21dc3794 2022-01-28 op * use ‘text/x-patch’ for ‘.patch’ and ‘.diff’ files.
143 21dc3794 2022-01-28 op * sort the auto index alphabetically.
144 21dc3794 2022-01-28 op * various improvements to the log management.
145 21dc3794 2022-01-28 op * drop the dependency on lex.
146 21dc3794 2022-01-28 op * added ‘--help’ as synonym of ‘-h’ and ‘-V’/‘--version‘ to print the version.
147 21dc3794 2022-01-28 op * c-like handling of strings in the configuration file: when two or more strings are next to each-others, are automatically joined into a single string. This is particularly useful with $-macros.
149 21dc3794 2022-01-28 op ### Bug fixes
151 21dc3794 2022-01-28 op * correctly handle CGI scripts that replies with the maxium header length allowed.
152 21dc3794 2022-01-28 op * fixed the static target.
153 21dc3794 2022-01-28 op * fixed recursive mkdirs for configless mode (i.e. create ‘~/.local/share/gmid’)
154 21dc3794 2022-01-28 op * logs sent to syslog now have proper priority (before every message ended up as LOG_CRIT). Found by Anna “CyberTailor”, thanks!
155 21dc3794 2022-01-28 op * ensure ‘%p’ (path) is always absolute in ‘block return’ rules.
156 21dc3794 2022-01-28 op * fix automatic certificate generation, it caused problems on some adroid devices. Found by Gnuserland, thanks!
157 21dc3794 2022-01-28 op * document the ‘log’ rule.
158 21dc3794 2022-01-28 op * the seccomp filter was reworked and now it's known to work properly on a vast range of architectures (to be more specific: all the architectures supported by alpine linux), see github issue #4. Prompted and tested by @begss, thanks!
159 21dc3794 2022-01-28 op * various improvements to the configure script, notified and fixed by Anna “CyberTailor”, thanks!
160 21dc3794 2022-01-28 op * added a timeout to the regression tests.
162 21dc3794 2022-01-28 op ### Breaking changes
164 21dc3794 2022-01-28 op * if duplicate rules are found in the configuration file, an error is now raised instead of silently using only the last value.
165 21dc3794 2022-01-28 op * (sort of) ‘gg’ moved to ‘regress’ as it's only used in the regression suite.
166 21dc3794 2022-01-28 op * (notice) the “mime "mime-type" "extension"” rule was deprecated and replaced by the new “map "mime-type" to-ext "extension"”. The ‘mime’ rule will be removed in a future version because its syntax is incompatible with the new string auto-concat mechanism.
