Releases: omar-polo/gmid
“Lightbulb Sun” bugfix release
signify(1) pubkeys for this release: RWTy3UJQzpxBUAymBwb2EGLLm0b3H/1n8hzhaC9HYFYzNuTavGt9QSwC
(note: no aarch64 precompiled binaries this time)
Bug Fixes
- fix a possible out-of-bound access in the CGI handling. It was introduced last October during a refactoring, but due to how many malloc(3) implementations works this hasn't been found until now. Otto' malloc is more strict fortunately.
“Lightbulb Sun” bugfix release
signify(1) pubkeys for this release: RWTy3UJQzpxBUAymBwb2EGLLm0b3H/1n8hzhaC9HYFYzNuTavGt9QSwC
(note: no aarch64 precompiled binaries this time)
Bug Fixes
- fix a CGI timing issue: if a connection handled by a CGI scripts is interrupted with the right timing it causes the server process to exit with "fatal in client_by_id: invalid id X".
New Features
- add a new block
type { ... }
to define mime types mapping.
Improvements
- use shell built-in
command
instead of which(1), prodded by cage and @chilledfrogs. - configure script: allow to set MANDIR from cmdline (@chilledfrogs)
- add systemd-sysusers sample file in contrib/ (@eniehack )
- [linux/seccomp] allow fstatat64(2), llseek(2) and sigreturn(2), needed by glibc on armv7. (@Toby222)
- [linux/seccomp] tightens rules by allowing openat(2) only with the O_RDONLY flag.
“Lightbulb Sun” bugfix release
signify(1) pubkeys for this release: RWTy3UJQzpxBUAymBwb2EGLLm0b3H/1n8hzhaC9HYFYzNuTavGt9QSwC
(aarch64 binary will be released later)
Bug fixes
- fix landlock usage on linux: don't assume that access capabilities not listed are implicitly denied, because they are not. Mickaël Salaün, the landlock author, found the same error on game of trees:
In a nutshell, the ruleset's handled_access_fs is required for backward and forward compatibility (i.e. the kernel and user space may not know each other's supported restrictions), hence the need to be explicit about the denied-by-default access rights.
In practice this affects only linux and only partially: thanks to the design of the daemon and the seccomp filter the effects of this mistake in handling landlock are fortunately limited. However, in theory at least, gmid could be for e.g. tricked into truncating existing files, so it's highly suggested to update.
Improvements
All by @CyberTailor, thanks!
- don't skip unit tests when SKIP_RUNTIME_TEST is set
- add
gg
to the regress target dependencies - fix the "implicit declaration of asprintf" warning
- sync vim syntax
“Lightbulb Sun”
signify(1) pubkeys for this release: RWTy3UJQzpxBUAymBwb2EGLLm0b3H/1n8hzhaC9HYFYzNuTavGt9QSwC
The following is a partial list of new features and improvements. For a comprehensive list, see the ChangeLog file.
New Features
- reverse proxying support: gmid now can relay gemini requests to other hosts.
- install gg too: it's a simple gemini client ("gemini get") initially developed as part of the regression suite.
- added OCSP stapling support (by @The-King-of-Toasters, thanks!)
- add gencert, a simple script to generate self-signed certs.
- add renew-certs, a script to automatically renew self-signed certs.
- multiple -n partially dump the parsed configuration.
Improvements
- reworked the fastcgi subsystem, now it's completely asynchronous.
- refactored the internal of the server too.
- refactored the regression suite (in particular reduced the timeout for single tests from 30 to 10 seconds.)
- configure: add support for
--prefix=...
autoconf-style flag. - relax the "wont proxy" check: don't check that the port in the request is the same we're listening on. Suggested by Allen Sobot, thanks!
- relax the strict ordering of options, locations and proxy blocks inside a server block.
Bug fixes
- don't pass through illegal replies from CGI scripts.
- fix the "double slash" error in logs.
- fix the configure for cross-compilation: don't run the test binaries just built. Suggested by Nikolay Korotkiy (@sikmir), thanks!
- (seccomp) allow
ugetrlimit(2)
, needed by glibc on arm7l. By Max, thanks!
“Space-dye Vest” fifth bugfix release
This version includes the following bugfix:
- don't die when a connection is closed before being accepted by gmid. (i.e. handle
ECONNRESET
)
“Space-dye Vest” fourth bugfix release
This version includes the following bugfix:
- fix a possible out-of-bound access when handling a request for a non-existent file in the root directory of a vhost that's matched by the
cgi
option
and the relative regression test.
“Space-dye Vest” third bugfix release
Improvements
- follows symlinks
- improved documentation and added key generation example (thanks! Anna)
Bugfix
- fix syslog logging on FreeBSD. Reported by Karl Jeacle, thanks!
- don't crash if
-c
is missing in configtest mode (-n
). Reported by heph, thanks! - allow fstat64 on linux (needed by glibc on aarch64). Reported by pine, thanks!
“Space-dye Vest” second bugfix release
This version incudes the following bugfix:
- An un-initialized field in the configless code path leads to a crash on the first request.
and the relative regression test.
“Space-dye Vest” bugfix release
This version includes two bugfixes:
- use ${MAKE} to recursively call make
- fix the misleading example in the man page: macros name may not be
reserved words
Both bugs found and fixed by Anna “CyberTailor”, thanks!
“Space-dye Vest”
NB: there's an error in the man page, a 1.7.1 version with fixes is being worked on.
Starting from this version gmid doesn't depend on lex anymore, but
yacc is still needed.
New features
- initial fastcgi support! (it's still young!)
- added user-defined macros, either via
-Dname=val
or directly in
the configuration file. - new
include
keyword to load additional configuration files. - new
env
rule to define environment vars for CGI scripts. - new
alias
rule to define hostname aliases for a server. - allow
root
to be specified per-location block. - pidfile support with the new
-P
cli flag. - define
TLS_VERSION
,TLS_CIPHER
andTLS_CIPHER_STRENGTH
for CGI
scripts.
Improvements
- remove limits on the number of virtual hosts and location blocks
that can be defined. - print the datetime when logging to stderr.
- use
text/x-patch
for.patch
and.diff
files. - sort the auto index alphabetically.
- various improvements to the log management.
- drop the dependency on lex.
- added
--help
as synonym of-h
and-V
/--version
to print the
version. - c-like handling of strings in the configuration file: when two or
more strings are next to each-others, are automatically joined into
a single string. This is particularly useful with$
-macros.
Bug fixes
- correctly handle CGI scripts that replies with the maxium header
length allowed. - fixed the
static
target. - fixed recursive mkdirs for configless mode (i.e. create
~/.local/share/gmid
) - logs sent to syslog now have proper priority (before every message
ended up as LOG_CRIT). Found by Anna "CyberTailor", thanks! - ensure
%p
(path) is always absolute inblock return
rules. - fix automatic certificate generation, it caused problems on some
adroid devices. Found by Gnuserland, thanks! - document the
log
rule. - the seccomp filter was reworked and now it's known to work properly
on a vast range of architectures (to be more specific: all the
architectures supported by alpine linux), see github issue #4.
Prompted and tested by @begss, thanks! - various improvements to the configure script, notified and fixed by
Anna "CyberTailor", thanks! - added a timeout to the regression tests.
Breaking changes
- if duplicate rules are found in the configuration file, an error is
now raised instead of silently using only the last value. - (sort of)
gg
moved toregress
as it's only used in the
regression suite. - (notice) the
mime "mime-type" "extension"
rule was deprecated and
replaced by the newmap "mime-type" to-ext "extension"
. The
mime
rule will be removed in a future version because its syntax
is incompatible with the new string auto-concat mechanism.