File manager - Edit - /home/ferretapmx/public_html/share.zip
Back
PK �M�\T?Ц � & licenses/alt-openldap11-2.4.46/LICENSEnu �[��� The OpenLDAP Public License Version 2.8, 17 August 2003 Redistribution and use of this software and associated documentation ("Software"), with or without modification, are permitted provided that the following conditions are met: 1. Redistributions in source form must retain copyright statements and notices, 2. Redistributions in binary form must reproduce applicable copyright statements and notices, this list of conditions, and the following disclaimer in the documentation and/or other materials provided with the distribution, and 3. Redistributions must contain a verbatim copy of this document. The OpenLDAP Foundation may revise this license from time to time. Each revision is distinguished by a version number. You may use this Software under terms of this license revision or under the terms of any subsequent revision of the license. THIS SOFTWARE IS PROVIDED BY THE OPENLDAP FOUNDATION AND ITS CONTRIBUTORS ``AS IS'' AND ANY EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OPENLDAP FOUNDATION, ITS CONTRIBUTORS, OR THE AUTHOR(S) OR OWNER(S) OF THE SOFTWARE BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. The names of the authors and copyright holders must not be used in advertising or otherwise to promote the sale, use or other dealing in this Software without specific, written prior permission. Title to copyright in this Software shall at all times remain with copyright holders. OpenLDAP is a registered trademark of the OpenLDAP Foundation. Copyright 1999-2003 The OpenLDAP Foundation, Redwood City, California, USA. All Rights Reserved. Permission to copy and distribute verbatim copies of this document is granted. PK �M�\`)��) ) ( licenses/alt-openldap11-2.4.46/COPYRIGHTnu �[��� Copyright 1998-2018 The OpenLDAP Foundation All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted only as authorized by the OpenLDAP Public License. A copy of this license is available in the file LICENSE in the top-level directory of the distribution or, alternatively, at <http://www.OpenLDAP.org/license.html>. OpenLDAP is a registered trademark of the OpenLDAP Foundation. Individual files and/or contributed packages may be copyright by other parties and/or subject to additional restrictions. This work is derived from the University of Michigan LDAP v3.3 distribution. Information concerning this software is available at <http://www.umich.edu/~dirsvcs/ldap/ldap.html>. This work also contains materials derived from public sources. Additional information about OpenLDAP can be obtained at <http://www.openldap.org/>. --- Portions Copyright 1998-2012 Kurt D. Zeilenga. Portions Copyright 1998-2006 Net Boolean Incorporated. Portions Copyright 2001-2006 IBM Corporation. All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted only as authorized by the OpenLDAP Public License. --- Portions Copyright 1999-2008 Howard Y.H. Chu. Portions Copyright 1999-2008 Symas Corporation. Portions Copyright 1998-2003 Hallvard B. Furuseth. Portions Copyright 2007-2011 Gavin Henry. Portions Copyright 2007-2011 Suretec Systems Ltd. All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that this notice is preserved. The names of the copyright holders may not be used to endorse or promote products derived from this software without their specific prior written permission. This software is provided ``as is'' without express or implied warranty. --- Portions Copyright (c) 1992-1996 Regents of the University of Michigan. All rights reserved. Redistribution and use in source and binary forms are permitted provided that this notice is preserved and that due credit is given to the University of Michigan at Ann Arbor. The name of the University may not be used to endorse or promote products derived from this software without specific prior written permission. This software is provided ``as is'' without express or implied warranty. PK �M�\�"l��B �B man/man5/ldap.conf.5nu �[��� .lf 1 stdin .TH LDAP.CONF 5 "2018/03/22" "OpenLDAP 2.4.46" .\" $OpenLDAP$ .\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. .\" Copying restrictions apply. See COPYRIGHT/LICENSE. .SH NAME ldap.conf, .ldaprc \- LDAP configuration file/environment variables .SH SYNOPSIS /opt/alt/openldap11/etc/openldap/ldap.conf, ldaprc, .ldaprc, $LDAP<option-name> .SH DESCRIPTION If the environment variable \fBLDAPNOINIT\fP is defined, all defaulting is disabled. .LP The .I ldap.conf configuration file is used to set system-wide defaults to be applied when running .I ldap clients. .LP Users may create an optional configuration file, .I ldaprc or .IR .ldaprc , in their home directory which will be used to override the system-wide defaults file. The file .I ldaprc in the current working directory is also used. .LP .LP Additional configuration files can be specified using the \fBLDAPCONF\fP and \fBLDAPRC\fP environment variables. \fBLDAPCONF\fP may be set to the path of a configuration file. This path can be absolute or relative to the current working directory. The \fBLDAPRC\fP, if defined, should be the basename of a file in the current working directory or in the user's home directory. .LP Environmental variables may also be used to augment the file based defaults. The name of the variable is the option name with an added prefix of \fBLDAP\fP. For example, to define \fBBASE\fP via the environment, set the variable \fBLDAPBASE\fP to the desired value. .LP Some options are user-only. Such options are ignored if present in the .I ldap.conf (or file specified by .BR LDAPCONF ). .LP Thus the following files and variables are read, in order: .nf variable $LDAPNOINIT, and if that is not set: system file /opt/alt/openldap11/etc/openldap/ldap.conf, user files $HOME/ldaprc, $HOME/.ldaprc, ./ldaprc, system file $LDAPCONF, user files $HOME/$LDAPRC, $HOME/.$LDAPRC, ./$LDAPRC, variables $LDAP<uppercase option name>. .fi Settings late in the list override earlier ones. .SH SYNTAX The configuration options are case-insensitive; their value, on a case by case basis, may be case-sensitive. .LP Blank lines are ignored. .br Lines beginning with a hash mark (`#') are comments, and ignored. .LP Valid lines are made of an option's name (a sequence of non-blanks, conventionally written in uppercase, although not required), followed by a value. The value starts with the first non-blank character after the option's name, and terminates at the end of the line, or at the last sequence of blanks before the end of the line. The tokenization of the value, if any, is delegated to the handler(s) for that option, if any. Quoting values that contain blanks may be incorrect, as the quotes would become part of the value. For example, .nf # Wrong - erroneous quotes: URI "ldap:// ldaps://" # Right - space-separated list of URIs, without quotes: URI ldap:// ldaps:// # Right - DN syntax needs quoting for Example, Inc: BASE ou=IT staff,o="Example, Inc",c=US # or: BASE ou=IT staff,o=Example2C Inc,c=US # Wrong - comment on same line as option: DEREF never # Never follow aliases .fi .LP A line cannot be longer than LINE_MAX, which should be more than 2000 bytes on all platforms. There is no mechanism to split a long line on multiple lines, either for beautification or to overcome the above limit. .SH OPTIONS The different configuration options are: .TP .B URI <ldap[si]://[name[:port]] ...> Specifies the URI(s) of an LDAP server(s) to which the .I LDAP library should connect. The URI scheme may be any of .BR ldap , .B ldaps or .BR ldapi , which refer to LDAP over TCP, LDAP over SSL (TLS) and LDAP over IPC (UNIX domain sockets), respectively. Each server's name can be specified as a domain-style name or an IP address literal. Optionally, the server's name can followed by a ':' and the port number the LDAP server is listening on. If no port number is provided, the default port for the scheme is used (389 for ldap://, 636 for ldaps://). For LDAP over IPC, .B name is the name of the socket, and no .B port is required, nor allowed; note that directory separators must be URL-encoded, like any other characters that are special to URLs; so the socket /usr/local/var/ldapi must be specified as ldapi://%2Fusr%2Flocal%2Fvar%2Fldapi A space separated list of URIs may be provided. .TP .B BASE <base> Specifies the default base DN to use when performing ldap operations. The base must be specified as a Distinguished Name in LDAP format. .TP .B BINDDN <dn> Specifies the default bind DN to use when performing ldap operations. The bind DN must be specified as a Distinguished Name in LDAP format. .B This is a user-only option. .TP .B DEREF <when> Specifies how alias dereferencing is done when performing a search. The .B <when> can be specified as one of the following keywords: .RS .TP .B never Aliases are never dereferenced. This is the default. .TP .B searching Aliases are dereferenced in subordinates of the base object, but not in locating the base object of the search. .TP .B finding Aliases are only dereferenced when locating the base object of the search. .TP .B always Aliases are dereferenced both in searching and in locating the base object of the search. .RE .TP .TP .B HOST <name[:port] ...> Specifies the name(s) of an LDAP server(s) to which the .I LDAP library should connect. Each server's name can be specified as a domain-style name or an IP address and optionally followed by a ':' and the port number the ldap server is listening on. A space separated list of hosts may be provided. .B HOST is deprecated in favor of .BR URI . .TP .B NETWORK_TIMEOUT <integer> Specifies the timeout (in seconds) after which the poll(2)/select(2) following a connect(2) returns in case of no activity. .TP .B PORT <port> Specifies the default port used when connecting to LDAP servers(s). The port may be specified as a number. .B PORT is deprecated in favor of .BR URI. .TP .B REFERRALS <on/true/yes/off/false/no> Specifies if the client should automatically follow referrals returned by LDAP servers. The default is on. Note that the command line tools .BR ldapsearch (1) &co always override this option. .\" This should only be allowed via ldap_set_option(3) .\".TP .\".B RESTART <on/true/yes/off/false/no> .\"Determines whether the library should implicitly restart connections (FIXME). .TP .B SIZELIMIT <integer> Specifies a size limit (number of entries) to use when performing searches. The number should be a non-negative integer. \fISIZELIMIT\fP of zero (0) specifies a request for unlimited search size. Please note that the server may still apply any server-side limit on the amount of entries that can be returned by a search operation. .TP .B TIMELIMIT <integer> Specifies a time limit (in seconds) to use when performing searches. The number should be a non-negative integer. \fITIMELIMIT\fP of zero (0) specifies unlimited search time to be used. Please note that the server may still apply any server-side limit on the duration of a search operation. .B VERSION {2|3} Specifies what version of the LDAP protocol should be used. .TP .B TIMEOUT <integer> Specifies a timeout (in seconds) after which calls to synchronous LDAP APIs will abort if no response is received. Also used for any .BR ldap_result (3) calls where a NULL timeout parameter is supplied. .SH SASL OPTIONS If OpenLDAP is built with Simple Authentication and Security Layer support, there are more options you can specify. .TP .B SASL_MECH <mechanism> Specifies the SASL mechanism to use. .TP .B SASL_REALM <realm> Specifies the SASL realm. .TP .B SASL_AUTHCID <authcid> Specifies the authentication identity. .B This is a user-only option. .TP .B SASL_AUTHZID <authcid> Specifies the proxy authorization identity. .B This is a user-only option. .TP .B SASL_SECPROPS <properties> Specifies Cyrus SASL security properties. The .B <properties> can be specified as a comma-separated list of the following: .RS .TP .B none (without any other properties) causes the properties defaults ("noanonymous,noplain") to be cleared. .TP .B noplain disables mechanisms susceptible to simple passive attacks. .TP .B noactive disables mechanisms susceptible to active attacks. .TP .B nodict disables mechanisms susceptible to passive dictionary attacks. .TP .B noanonymous disables mechanisms which support anonymous login. .TP .B forwardsec requires forward secrecy between sessions. .TP .B passcred requires mechanisms which pass client credentials (and allows mechanisms which can pass credentials to do so). .TP .B minssf=<factor> specifies the minimum acceptable .I security strength factor as an integer approximating the effective key length used for encryption. 0 (zero) implies no protection, 1 implies integrity protection only, 56 allows DES or other weak ciphers, 112 allows triple DES and other strong ciphers, 128 allows RC4, Blowfish and other modern strong ciphers. The default is 0. .TP .B maxssf=<factor> specifies the maximum acceptable .I security strength factor as an integer (see .B minssf description). The default is .BR INT_MAX . .TP .B maxbufsize=<factor> specifies the maximum security layer receive buffer size allowed. 0 disables security layers. The default is 65536. .RE .TP .B SASL_NOCANON <on/true/yes/off/false/no> Do not perform reverse DNS lookups to canonicalize SASL host names. The default is off. .SH GSSAPI OPTIONS If OpenLDAP is built with Generic Security Services Application Programming Interface support, there are more options you can specify. .TP .B GSSAPI_SIGN <on/true/yes/off/false/no> Specifies if GSSAPI signing (GSS_C_INTEG_FLAG) should be used. The default is off. .TP .B GSSAPI_ENCRYPT <on/true/yes/off/false/no> Specifies if GSSAPI encryption (GSS_C_INTEG_FLAG and GSS_C_CONF_FLAG) should be used. The default is off. .TP .B GSSAPI_ALLOW_REMOTE_PRINCIPAL <on/true/yes/off/false/no> Specifies if GSSAPI based authentication should try to form the target principal name out of the ldapServiceName or dnsHostName attribute of the targets RootDSE entry. The default is off. .SH TLS OPTIONS If OpenLDAP is built with Transport Layer Security support, there are more options you can specify. These options are used when an .B ldaps:// URI is selected (by default or otherwise) or when the application negotiates TLS by issuing the LDAP StartTLS operation. .LP When using OpenSSL, if neither \fBTLS_CACERT\fP nor \fBTLS_CACERTDIR\fP is set, the system-wide default set of CA certificates is used. .TP .B TLS_CACERT <filename> Specifies the file that contains certificates for all of the Certificate Authorities the client will recognize. .TP .B TLS_CACERTDIR <path> Specifies the path of a directory that contains Certificate Authority certificates in separate individual files. The .B TLS_CACERT is always used before .B TLS_CACERTDIR. The specified directory must be managed with the OpenSSL c_rehash utility. This parameter is ignored with GnuTLS. When using Mozilla NSS, <path> may contain a Mozilla NSS cert/key database. If <path> contains a Mozilla NSS cert/key database and CA cert files, OpenLDAP will use the cert/key database and will ignore the CA cert files. .TP .B TLS_CERT <filename> Specifies the file that contains the client certificate. .B This is a user-only option. When using Mozilla NSS, if using a cert/key database (specified with TLS_CACERTDIR), TLS_CERT specifies the name of the certificate to use: .nf TLS_CERT Certificate for Sam Carter .fi If using a token other than the internal built in token, specify the token name first, followed by a colon: .nf TLS_CERT my hardware device:Certificate for Sam Carter .fi Use certutil \-L to list the certificates by name: .nf certutil \-d /path/to/certdbdir \-L .fi .TP .B TLS_KEY <filename> Specifies the file that contains the private key that matches the certificate stored in the .B TLS_CERT file. Currently, the private key must not be protected with a password, so it is of critical importance that the key file is protected carefully. .B This is a user-only option. When using Mozilla NSS, TLS_KEY specifies the name of a file that contains the password for the key for the certificate specified with TLS_CERT. The modutil command can be used to turn off password protection for the cert/key database. For example, if TLS_CACERTDIR specifies /home/scarter/.moznss as the location of the cert/key database, use modutil to change the password to the empty string: .nf modutil \-dbdir ~/.moznss \-changepw 'NSS Certificate DB' .fi You must have the old password, if any. Ignore the WARNING about the running browser. Press 'Enter' for the new password. .TP .B TLS_CIPHER_SUITE <cipher-suite-spec> Specifies acceptable cipher suite and preference order. <cipher-suite-spec> should be a cipher specification for the TLS library in use (OpenSSL, GnuTLS, or Mozilla NSS). Example: .RS .RS .TP .I OpenSSL: TLS_CIPHER_SUITE HIGH:MEDIUM:+SSLv2 .TP .I GnuTLS: TLS_CIPHER_SUITE SECURE256:!AES-128-CBC .RE To check what ciphers a given spec selects in OpenSSL, use: .nf openssl ciphers \-v <cipher-suite-spec> .fi With GnuTLS the available specs can be found in the manual page of .BR gnutls\-cli (1) (see the description of the option .BR \-\-priority ). In older versions of GnuTLS, where gnutls\-cli does not support the option \-\-priority, you can obtain the \(em more limited \(em list of ciphers by calling: .nf gnutls\-cli \-l .fi When using Mozilla NSS, the OpenSSL cipher suite specifications are used and translated into the format used internally by Mozilla NSS. There isn't an easy way to list the cipher suites from the command line. The authoritative list is in the source code for Mozilla NSS in the file sslinfo.c in the structure .nf static const SSLCipherSuiteInfo suiteInfo[] .fi .RE .TP .B TLS_PROTOCOL_MIN <major>[.<minor>] Specifies minimum SSL/TLS protocol version that will be negotiated. If the server doesn't support at least that version, the SSL handshake will fail. To require TLS 1.x or higher, set this option to 3.(x+1), e.g., .nf TLS_PROTOCOL_MIN 3.2 .fi would require TLS 1.1. Specifying a minimum that is higher than that supported by the OpenLDAP implementation will result in it requiring the highest level that it does support. This parameter is ignored with GnuTLS. .TP .B TLS_RANDFILE <filename> Specifies the file to obtain random bits from when /dev/[u]random is not available. Generally set to the name of the EGD/PRNGD socket. The environment variable RANDFILE can also be used to specify the filename. This parameter is ignored with GnuTLS and Mozilla NSS. .TP .B TLS_REQCERT <level> Specifies what checks to perform on server certificates in a TLS session, if any. The .B <level> can be specified as one of the following keywords: .RS .TP .B never The client will not request or check any server certificate. .TP .B allow The server certificate is requested. If no certificate is provided, the session proceeds normally. If a bad certificate is provided, it will be ignored and the session proceeds normally. .TP .B try The server certificate is requested. If no certificate is provided, the session proceeds normally. If a bad certificate is provided, the session is immediately terminated. .TP .B demand | hard These keywords are equivalent. The server certificate is requested. If no certificate is provided, or a bad certificate is provided, the session is immediately terminated. This is the default setting. .RE .TP .B TLS_CRLCHECK <level> Specifies if the Certificate Revocation List (CRL) of the CA should be used to verify if the server certificates have not been revoked. This requires .B TLS_CACERTDIR parameter to be set. This parameter is ignored with GnuTLS and Mozilla NSS. .B <level> can be specified as one of the following keywords: .RS .TP .B none No CRL checks are performed .TP .B peer Check the CRL of the peer certificate .TP .B all Check the CRL for a whole certificate chain .RE .TP .B TLS_CRLFILE <filename> Specifies the file containing a Certificate Revocation List to be used to verify if the server certificates have not been revoked. This parameter is only supported with GnuTLS and Mozilla NSS. .SH "ENVIRONMENT VARIABLES" .TP LDAPNOINIT disable all defaulting .TP LDAPCONF path of a configuration file .TP LDAPRC basename of ldaprc file in $HOME or $CWD .TP LDAP<option-name> Set <option-name> as from ldap.conf .SH FILES .TP .I /opt/alt/openldap11/etc/openldap/ldap.conf system-wide ldap configuration file .TP .I $HOME/ldaprc, $HOME/.ldaprc user ldap configuration file .TP .I $CWD/ldaprc local ldap configuration file .SH "SEE ALSO" .BR ldap (3), .BR ldap_set_option (3), .BR ldap_result (3), .BR openssl (1), .BR sasl (3) .SH AUTHOR Kurt Zeilenga, The OpenLDAP Project .SH ACKNOWLEDGEMENTS .lf 1 ./../Project .\" Shared Project Acknowledgement Text .B "OpenLDAP Software" is developed and maintained by The OpenLDAP Project <http://www.openldap.org/>. .B "OpenLDAP Software" is derived from the University of Michigan LDAP 3.3 Release. .lf 521 stdin PK �M�\��lN N man/man5/ldif.5nu �[��� .lf 1 stdin .TH LDIF 5 "2018/03/22" "OpenLDAP 2.4.46" .\" $OpenLDAP$ .\" Copyright 1998-2018 The OpenLDAP Foundation All Rights Reserved. .\" Copying restrictions apply. See COPYRIGHT/LICENSE. .SH NAME ldif \- LDAP Data Interchange Format .SH DESCRIPTION The LDAP Data Interchange Format (LDIF) is used to represent LDAP entries and change records in text form. LDAP tools, such as .BR ldapadd (1) and .BR ldapsearch (1), read and write LDIF entry records. .BR ldapmodify (1) reads LDIF change records. .LP This manual page provides a basic description of LDIF. A formal specification of LDIF is published in RFC 2849. .SH ENTRY RECORDS .LP LDIF entry records are used to represent directory entries. The basic form of an entry record is: .LP .nf .ft tt dn: <distinguished name> <attrdesc>: <attrvalue> <attrdesc>: <attrvalue> <attrdesc>:: <base64-encoded-value> <attrdesc>:< <URL> ... .ft .fi .LP The value may be specified as UTF-8 text or as base64 encoded data, or a URI may be provided to the location of the attribute value. .LP A line may be continued by starting the next line with a single space or tab, e.g., .LP .nf .ft tt dn: cn=Barbara J Jensen,dc=exam ple,dc=com .ft .fi .LP Lines beginning with a sharp sign ('#') are ignored. .LP Multiple attribute values are specified on separate lines, e.g., .LP .nf .ft tt cn: Barbara J Jensen cn: Babs Jensen .ft .fi .LP If an value contains a non-printing character, or begins with a space or a colon ':', the <attrtype> is followed by a double colon and the value is encoded in base 64 notation. e.g., the value " begins with a space" would be encoded like this: .LP .nf .ft tt cn:: IGJlZ2lucyB3aXRoIGEgc3BhY2U= .ft .fi .LP If the attribute value is located in a file, the <attrtype> is followed by a ':<' and a file: URI. e.g., the value contained in the file /tmp/value would be listed like this: .LP .nf .ft tt cn:< file:///tmp/value .ft .fi Other URI schemes (ftp,http) may be supported as well. .LP Multiple entries within the same LDIF file are separated by blank lines. .SH ENTRY RECORD EXAMPLE Here is an example of an LDIF file containing three entries. .LP .nf .ft tt dn: cn=Barbara J Jensen,dc=example,dc=com cn: Barbara J Jensen cn: Babs Jensen objectclass: person description:< file:///tmp/babs sn: Jensen dn: cn=Bjorn J Jensen,dc=example,dc=com cn: Bjorn J Jensen cn: Bjorn Jensen objectclass: person sn: Jensen dn: cn=Jennifer J Jensen,dc=example,dc=com cn: Jennifer J Jensen cn: Jennifer Jensen objectclass: person sn: Jensen jpegPhoto:: /9j/4AAQSkZJRgABAAAAAQABAAD/2wBDABALD A4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQ ERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVG ... .ft .fi .LP Note that the description in Barbara Jensen's entry is read from file:///tmp/babs and the jpegPhoto in Jennifer Jensen's entry is encoded using base 64. .SH CHANGE RECORDS LDIF change records are used to represent directory change requests. Each change record starts with line indicating the distinguished name of the entry being changed: .LP .nf dn: <distinguishedname> .fi .LP .nf changetype: <[modify|add|delete|modrdn]> .fi .LP Finally, the change information itself is given, the format of which depends on what kind of change was specified above. For a \fIchangetype\fP of \fImodify\fP, the format is one or more of the following: .LP .nf add: <attributetype> <attrdesc>: <value1> <attrdesc>: <value2> ... \- .fi .LP Or, for a replace modification: .LP .nf replace: <attributetype> <attrdesc>: <value1> <attrdesc>: <value2> ... \- .fi .LP If no \fIattributetype\fP lines are given to replace, the entire attribute is to be deleted (if present). .LP Or, for a delete modification: .LP .nf delete: <attributetype> <attrdesc>: <value1> <attrdesc>: <value2> ... \- .fi .LP If no \fIattributetype\fP lines are given to delete, the entire attribute is to be deleted. .LP For a \fIchangetype\fP of \fIadd\fP, the format is: .LP .nf <attrdesc1>: <value1> <attrdesc1>: <value2> ... <attrdescN>: <value1> <attrdescN>: <value2> .fi .LP For a \fIchangetype\fP of \fImodrdn\fP or \fImoddn\fP, the format is: .LP .nf newrdn: <newrdn> deleteoldrdn: 0 | 1 newsuperior: <DN> .fi .LP where a value of 1 for deleteoldrdn means to delete the values forming the old rdn from the entry, and a value of 0 means to leave the values as non-distinguished attributes in the entry. The newsuperior line is optional and, if present, specifies the new superior to move the entry to. .LP For a \fIchangetype\fP of \fIdelete\fP, no additional information is needed in the record. .LP Note that attribute values may be presented using base64 or in files as described for entry records. Lines in change records may be continued in the manner described for entry records as well. .SH CHANGE RECORD EXAMPLE The following sample LDIF file contains a change record of each type of change. .LP .nf dn: cn=Babs Jensen,dc=example,dc=com changetype: add objectclass: person objectclass: extensibleObject cn: babs cn: babs jensen sn: jensen dn: cn=Babs Jensen,dc=example,dc=com changetype: modify add: givenName givenName: Barbara givenName: babs \- replace: description description: the fabulous babs \- delete: sn sn: jensen \- dn: cn=Babs Jensen,dc=example,dc=com changetype: modrdn newrdn: cn=Barbara J Jensen deleteoldrdn: 0 newsuperior: ou=People,dc=example,dc=com dn: cn=Barbara J Jensen,ou=People,dc=example,dc=com changetype: delete .fi .SH INCLUDE STATEMENT The LDIF parser has been extended to support an .B include statement for referencing other LDIF files. The .B include statement must be separated from other records by a blank line. The referenced file is specified using a file: URI and all of its contents are incorporated as if they were part of the original LDIF file. As above, other URI schemes may be supported. For example: .LP .nf dn: dc=example,dc=com objectclass: domain dc: example include: file:///tmp/example.com.ldif dn: dc=example,dc=org objectclass: domain dc: example .fi This feature is not part of the LDIF specification in RFC 2849 but is expected to appear in a future revision of this spec. It is supported by the .BR ldapadd (1), .BR ldapmodify (1), and .BR slapadd (8) commands. .SH SEE ALSO .BR ldap (3), .BR ldapsearch (1), .BR ldapadd (1), .BR ldapmodify (1), .BR slapadd (8), .BR slapcat (8), .BR slapd\-ldif (5). .LP "LDAP Data Interchange Format," Good, G., RFC 2849. .SH ACKNOWLEDGEMENTS .lf 1 ./../Project .\" Shared Project Acknowledgement Text .B "OpenLDAP Software" is developed and maintained by The OpenLDAP Project <http://www.openldap.org/>. .B "OpenLDAP Software" is derived from the University of Michigan LDAP 3.3 Release. .lf 278 stdin PK �M�\C���k �k ! doc/alt-openldap11-2.4.46/CHANGESnu �[��� OpenLDAP 2.4 Change Log OpenLDAP 2.4.46 Release (2018/03/22) Fixed libldap connection delete callbacks when TLS fails to start (ITS#8717) Fixed libldap to not reuse tls_session if TLS hostname check fails (ITS#7373) Fixed libldap cross-compiling with OpenSSL 1.1 (ITS#8687) Fixed libldap OpenSSL 1.1.1 compatibility with BIO_method (ITS#8791) Fixed libldap MozNSS CA certificate hash matching (ITS#7374) Fixed libldap MozNSS with PEM certs when also using an NSS cert db (ITS#7389) Fixed libldap MozNSS initialization (ITS#8484) Fixed libldap GnuTLS with GNUTLS_E_AGAIN (ITS#8650) Fixed libldap memory leak with cancel operations (ITS#8782) Fixed slapd Eventlog registry key creation on 64-bit Windows (ITS#8705) Fixed slapd to maintain SSF across SASL binds (ITS#8796) Fixed slapd syncrepl deadlock when updating cookie (ITS#8752) Fixed slapd syncrepl callback to always be last in the stack (ITS#8752) Fixed slapd telephoneNumberNormalize when the value is spaces and hyphens (ITS#8778) Fixed slapd CSN queue processing (ITS#8801) Fixed slapd-ldap TLS connection timeout with high latency connections (ITS#8720) Fixed slapd-ldap to ignore unknown schema when omit-unknown-schema is set (ITS#7520) Fixed slapd-mdb with an optimization for long lived read transactions (ITS#8226) Fixed slapd-meta assert when olcDbRewrite is modified (ITS#8404) Fixed slapd-sock with LDAP_MOD_INCREMENT operations (ITS#8692) Fixed slapo-accesslog cleanup to only occur on failed operations (ITS#8752) Fixed slapo-dds entryTTL to actually decrease as per RFC 2589 (ITS#7100) Fixed slapo-syncprov memory leak with delete operations (ITS#8690) Fixed slapo-syncprov to not clear pending operation when checkpointing (ITS#8444) Fixed slapo-syncprov to correctly record contextCSN values in the accesslog (ITS#8100) Fixed slapo-syncprov not to log checkpoints to accesslog db (ITS#8607) Fixed slapo-syncprov to process changes from this SID on REFRESH (ITS#8800) Fixed slapo-syncprov session log parsing to not block other operations (ITS#8486) Build Environment Fixed Windows build with newer MINGW version (ITS#8697) Fixed compiler warnings and removed unused variables (ITS#8578) Contrib Fixed ldapc++ Control structure (ITS#8583) Documentation Delete stub manpage for back-ldbm (ITS#8713) Fixed ldap_bind(3) to mention the LDAP_SASL_SIMPLE mechanism (ITS#8121) Fixed ldap.conf(5) to note SASL_MECH/SASL_REALM are no longer user-only (ITS#8818) Fixed slapd-config(5) typo for olcTLSCipherSuite (ITS#8715) Fixed slapo-syncprov(5) indexing requirements (ITS#5048) OpenLDAP 2.4.45 Release (2017/06/01) Added slapd support for OpenSSL 1.1.0 series (ITS#8353, ITS#8533, ITS#8634) Fixed libldap to fail ldap_result if the handle is already bad (ITS#8585) Fixed libldap to expose error if user specified CA doesn't exist (ITS#8529) Fixed libldap handling of Diffie-Hellman parameters (ITS#7506) Fixed libldap GnuTLS use after free (ITS#8385) Fixed libldap SASL initialization (ITS#8648) Fixed slapd bconfig rDN escape handling (ITS#8574) Fixed slapd segfault with invalid hostname (ITS#8631) Fixed slapd sasl SEGV rebind in same session (ITS#8568) Fixed slapd syncrepl filter handling (ITS#8413) Fixed slapd syncrepl infinite looping mods with delta-sync MMR (ITS#8432) Fixed slapd callback struct so older modules without writewait should function. Custom modules may need to be updated for sc_writewait callback (ITS#8435) Fixed slapd-ldap/meta broken LDAP_TAILQ macro (ITS#8576) Fixed slapd-mdb so it passes ITS6794 regression test (ITS#6794) Fixed slapd-mdb double free with size zero paged result (ITS#8655) Fixed slapd-meta uninitialized diagnostic message (ITS#8442) Fixed slapo-accesslog to honor pauses during purge for cn=config update (ITS#8423) Fixed slapo-accesslog with multiple modifications to the same attribute (ITS#6545) Fixed slapo-relay to correctly initialize sc_writewait (ITS#8428) Fixed slapo-sssvlv double free (ITS#8592) Fixed slapo-unique with empty modifications (ITS#8266) Build Environment Added test065 for proxyauthz (ITS#8571) Fix test008 to be portable (ITS#8414) Fix test064 to wait for slapd to start (ITS#8644) Fix its4336 regression test (ITS#8534) Fix its4337 regression test (ITS#8535) Fix regression tests to execute on all backends (ITS#8539) Contrib Added slapo-autogroup(5) man page (ITS#8569) Added passwd missing conversion scripts for apr1 (ITS#6826) Fixed contrib modules where the writewait callback was not correctly initialized (ITS#8435) Fixed smbk5pwd to build with newer OpenSSL releases (ITS#8525) Documentation admin24 fixed tls_cipher_suite bindconf option (ITS#8099) admin24 fixed typo cn=config to be slapd.d (ITS#8449) admin24 fixed slapo-syncprov information to be current (ITS#8253) admin24 fixed typo in access control docs (ITS#7341, ITS#8391) admin24 fixed minor typo in tuning guide (ITS#8499) admin24 fixed information about the limits option (ITS#7700) admin24 fixed missing options for syncrepl configuration (ITS#7700) admin24 fixed accesslog documentation to note it should not be replicated (ITS#8344) Fixed ldap.conf(5) missing information on SASL_NOCANON option (ITS#7177) Fixed ldapsearch(1) information on the V[V] flag behavior (ITS#7177, ITS#6339) Fixed slapd-config(5), slapd.conf(5) clarification on interval keyword for refreshAndPersist (ITS#8538) Fixed slapd-config(5), slapd.conf(5) clarify serverID requirements (ITS#8635) Fixed slapd-config(5), slapd.conf(5) clarification on loglevel settings (ITS#8123) Fixed slapo-ppolicy(5) to clearly note rootdn requirement (ITS#8565) Fixed slapo-memberof(5) to note it is not safe to use with replication (ITS#8613) Fixed slapo-syncprov(5) documentation to be current (ITS#8253) Fixed slapadd(8) manpage to note slapd-mdb (ITS#8215) Fixed various minor grammar issues in the man pages (ITS#8544) Fixed various typos (ITS#8587) OpenLDAP 2.4.44 Release (2016/02/05) Fixed slapd-bdb/hdb missing olcDbChecksum config attr (ITS#8337) Fixed slapd-mdb behavior with long lived read transactions (ITS#8226) Fixed slapd-mdb cleanup after failed transaction (ITS#8360) Fixed slapd-sql missing id_query/olcSqlIdQuery (ITS#8329) Fixed slapo-accesslog callback initialization (ITS#8351) Fixed slapo-ppolicy pwdMaxRecordedFailure must never be zero (ITS#8327) Fixed slapo-syncprov abandon processing (ITS#8354) Fixed slapo-syncprov ctxcsn snapshot on refresh (ITS#8281, ITS#8365) Documentation admin24 Stop linking to Berkeley DB downloads (ITS#8362) admin24 Update documentation for LMDB preference OpenLDAP 2.4.43 Release (2015/11/30) Fixed liblber remove obsolete assert (ITS#8240, ITS#8301) Fixed libldap file URLs on windows (ITS#8273) Fixed libldap microsecond timer for windows (ITS#8295) Fixed slap tools minor one time memory leak (ITS#8082) Fixed slapd to avoid redundant processing of abandon ops (ITS#8232) Fixed slapd syncrepl SEGV when present list is NULL (ITS#8231, ITS#8042) Fixed slapd segfault with invalid SASL URI (ITS#8218) Fixed slapd configuration parser with unbalanced quotes (ITS#8233) Fixed slapd syncrepl check with config db on windows (ITS#8277) Fixed slapd with mod Increment and inherited attribute type (ITS#8289) Fixed slapd-ldap SEGV after failed retry (ITS#8173) Fixed slapd-ldap to skip client controls in ldap_back_entry_get (ITS#8244) Fixed slapd-null to have an option to return a search entry (ITS#8249) Fixed slapd-relay to correctly handle quoted options (ITS#8284) Fixed slapo-accesslog delta-sync MMR with interrupted refresh phase (ITS#8281) Fixed slapo-dds segfault when using slapo-memberof (ITS#8133) Fixed slapo-ppolicy to allow purging of stale pwdFailureTime attributes (ITS#8185) Fixed slapo-ppolicy to release entry on failure (ITS#7537) Fixed slapo-ppolicy to fall back to default policy if there is a parsing error (ITS#8234) Fixed slapo-syncprov with interrupted refresh phase (ITS#8281) Fixed slapo-refint with subtree renames (ITS#8220) Fixed slapo-rwm missing olcDropUnrequested attribute (ITS#7889) Fixed slapo-rwm parsing to avoid double-escaping rewrite rules (ITS#7964) Build Environment Fixed ldif-filter option parsing (ITS#8292) Fixed slapd-tester EOL handling in test output for windows (ITS#8280) Fixed slapd-tester executable suffix for windows (ITS#8216) Fixed test061 timing issues (ITS#8297) Contrib Added libnettle support to pw-pbkdf2 (ITS#8198) Fixed smbk5pwd compiler warnings with libnettle (ITS#8235) Fixed passwd symbol collisions with other crypto libraries (ITS#8294) Documentation Updated guide to reflect changes to how TLS is handled with syncrepl (ITS#7897) OpenLDAP 2.4.42 Release (2015/08/14) Fixed liblber address length for CLDAP (ITS#8158) Fixed libldap dnssrv potential overflow with port number (ITS#7027,ITS#8195) Fixed slapd cn=config when updating olcAttributeTypes (ITS#8199) Fixed slapd-mdb to correctly update search candidates for scoped searches (ITS#8203) Fixed slapo-ppolicy with redundant mod ops on glued trees (ITS#8184) Fixed slapo-rwm crash when deleting rewrite rules (ITS#8213) Build Environment Fixed libdb detection with gcc 5.x (ITS#8056) OpenLDAP 2.4.41 Release (2015/06/21) Fixed ldapsearch to explicitly flush its buffer (ITS#8118) Fixed libldap async connections (ITS#8090) Fixed libldap double free of request during abandon (ITS#7967) Fixed libldap error string for LDAP_X_CONNECTING (ITS#8093) Fixed libldap segfault in ldap_sync_initialize (ITS#8001) Fixed libldap ldif-wrap off by one error (ITS#8003) Fixed libldap handling of TLS in async mode (ITS#8022) Fixed libldap null pointer dereference (ITS#8028) Fixed libldap mutex handling with LDAP_OPT_SESSION_REFCNT (ITS#8050) Fixed slapd slapadd config db import of minimal frontend entry (ITS#8150) Fixed slapd slapadd onetime leak with -w (ITS#8014) Fixed slapd sasl auxprop crash with invalid config (ITS#8092) Fixed slapd syncrepl delta-mmr issue with overlays and slapd.conf (ITS#7976) Fixed slapd syncrepl mutex for cookie state (ITS#7968) Fixed slapd syncrepl memory leaks (ITS#8035) Fixed slapd syncrepl to free presentlist at end of refresh mode (ITS#8038) Fixed slapd syncrepl to streamline presentlist (ITS#8042) Fixed slapd syncrepl concurrency when CHECK_CSN is enabled (ITS#8120) Fixed slapd rootdn checks for hidden backends (ITS#8108) Fixed slapd segfault when using matched values control (ITS#8046) Fixed slapd-ldap reconnection behavior on remote failure (ITS#8142) Fixed slapd-mdb minor case typo (ITS#8049) Fixed slapd-mdb one-level search (ITS#7975) Fixed slapd-mdb heap corruption (ITS#7965) Fixed slapd-mdb crash after deleting in-use schema (ITS#7995) Fixed slapd-mdb minor code cleanup (ITS#8011) Fixed slapd-mdb to return errors when using incorrect env flags (ITS#8016) Fixed slapd-mdb to correctly update search candidates (ITS#8036, ITS#7904) Fixed slapd-mdb when there were more than 65535 aliases in scope (ITS#8103) Fixed slapd-mdb alias deref when objectClass is not indexed (ITS#8146) Fixed slapd-meta TLS initialization with ldaps URIs (ITS#8022) Fixed slapd-meta to have better error logging (ITS#8131) Fixed slapd-perl conversion to cn=config (ITS#8105) Fixed slapd-sql autocommit config variable (ITS#8129,ITS#6613) Fixed slapo-collect segfault (ITS#7797) Fixed slapo-constraint with 0 count constraint (ITS#7780,ITS#7781) Fixed slapo-deref with empty attribute list (ITS#8027) Fixed slapo-memberof to correctly reject invalid members (ITS#8107) Fixed slapo-sock result parser for CONTINUE (ITS#8048) Fixed slapo-syncprov synprov_matchops usage of test_filter (ITS#8013) Fixed slapo-syncprov segfault on disconnect/abandon (ITS#5452,ITS#8012) Fixed slapo-syncprov memory leak (ITS#8039) Fixed slapo-syncprov segfault on disconnect/abandon (ITS#8043) Fixed slapo-syncprov deadlock when autogroup is in use (ITS#8063) Fixed slapo-syncprov potential loss of changes when under load (ITS#8081) Fixed slapo-unique enforcement of uniqueness with manageDSAit control (ITS#8057) Build Environment Fixed ftello reference for Win32 (ITS#8127) Enhanced contrib modules build paths (ITS#7782) Fixed contrib/autogroup internal operation identity (ITS#8006) Fixed contrib/autogroup to skip internal ops with accesslog (ITS#8065) Fixed contrib/passwd/sha2 compiler warning (ITS#8000) Fixed contrib/noopsrch compiler warning (ITS#7998) Fixed contrib/dupent compiler warnings (ITS#7997) Test suite: Added vrFilter test (ITS#8046) Contrib Added pbkdf2 sha256 and sha512 schemes (ITS#7977) Fixed autogroup modification callback responses (ITS#6970) Fixed nssov compare with usergroup (ITS#8079) Fixed nssov password change behavior (ITS#8080) Fixed nssov updated to 0.9.4 (ITS#8097) Documentation Added ldap_get_option(3) LDAP_FEATURE_INFO_VERSION information (ITS#8032) Added ldap_get_option(3) LDAP_OPT_API_INFO_VERSION information (ITS#8032) Fixed slapd-config(5), slapd.conf(5) tls_cipher_suite option (ITS#8099) Fixed slapd-meta(5), slapd-ldap(5) tls_cipher_suite option (ITS#8099) Fixed slapd-meta(5) fix minor typo (ITS#7769) OpenLDAP 2.4.40 Release (2014/09/20) Fixed libldap DNS SRV priority handling (ITS#7027) Fixed libldap don't leak libldap err codes (ITS#7676) Fixed libldap CR/LF handling (ITS#4635) Fixed libldap ldif-wrap length (ITS#7871) Fixed libldap GnuTLS ciphersuite parsing (ITS#7500) Fixed libldap GnuTLS with newer versions (ITS#7430,ITS#6359) Fixed libldif to correctly handle 4096 character lines (ITS#7859) Fixed librewrite reference counting (ITS#7723) Fixed slapacl with back-mdb reader transactions (ITS#7920) Fixed slapd syncrepl to send cookie on fallback (ITS#7849) Fixed slapd syncrepl SEGV when abandoning a connection (ITS#7928) Fixed slapd slapcat with external schema (ITS#7895) Fixed slapd schema RDN normalization (ITS#7935) Fixed slapd with repeated language tags (ITS#7941) Fixed slapd modrdn crash on naming attr with no matching rule (ITS#7850) Fixed slapd memory leak in control handling (ITS#7942) Fixed slapd-ldap removed dead code (ITS#7922) Fixed slapd-mdb to work concurrently with slapadd (ITS#7798) Fixed slapd-mdb with paged results (ITS#7705, ITS#7800) Fixed slapd-mdb slapcat with nonexistent indices (ITS#7870) Fixed slapd-mdb long lived reader transactions (ITS#7904) Fixed slapd-mdb memory leak on matchedDN (ITS#7872) Fixed slapd-mdb sorting of attribute values (ITS#7902) Fixed slapd-mdb to flag attribute values as sorted (ITS#7903) Fixed slapd-mdb index config handling (ITS#7912) Fixed slapd-mdb entry release handling (ITS#7915) Fixed slapd-mdb with aliases and referrals (ITS#7927) Fixed slapd-mdb alias dereferencing (ITS#7702) Fixed slapd-sock socket flushing (ITS#7937) Fixed slapo-accesslog attribute normalization (ITS#7934) Fixed slapo-accesslog internal search logging (ITS#7929) Fixed slapo-auditlog connection destroy logic (ITS#7906,ITS#7923) Fixed slapo-chain interaction with slapo-rwm (ITS#7930) Fixed slapo-constraint connection destroy logic (ITS#7906,ITS#7923) Fixed slapo-dds connection destroy logic (ITS#7906,ITS#7923) Fixed slapo-dyngroup connection destroy logic (ITS#7906,ITS#7923) Fixed slapo-memberof attr count (ITS#7893) Fixed slapo-memberof frontendDB handling (ITS#7249) Fixed slapo-memberof internal search logging (ITS#7929) Fixed slapo-pcache config processing (ITS#7919) Fixed slapo-pcache connection destroy logic (ITS#7906,ITS#7923) Added slapo-ppolicy ORDERING rules (ITS#7838) Fixed slapo-ppolicy timestamp resolution to use microseconds (ITS#7161) Fixed slapo-ppolicy connection destroy logic (ITS#7906,ITS#7923) Fixed slapo-refint to check for pauses in cn=config (ITS#7873) Fixed slapo-refint internal search logging (ITS#7929) Fixed slapo-refint connection destroy logic (ITS#7906,ITS#7923) Fixed slapo-seqmod connection destroy logic (ITS#7906,ITS#7923) Fixed slapo-slapover connection destroy logic (ITS#7906,ITS#7923) Fixed slapo-sock db_init (ITS#7868) Fixed slapo-sssvlv fix olcSssVlvMaxPerConn (ITS#7908) Fixed slapo-translucent double free (ITS#7587) Fixed slapo-translucent to work with manageDSAit (ITS#7864) Fixed slapo-translucent to use local backend with local entries (ITS#7915) Fixed slapo-unique connection destroy logic (ITS#7906,ITS#7923) Fixed slapcacl with invalid suffix (ITS#7827) Build Environment Remove support for gcrypt (ITS#7877) BDB 6.0.20 and later is not supported (ITS#7890) Fixed ODBC link check (ITS#7891) Fixed slapd.ldif frontend config (ITS#7933) Contrib Added pbkdf2 module (ITS#7742) Fixed autogroup double free (ITS#7831) Fixed autogroup modification callback responses (ITS#6970) Fixed ldapc++ memory leak in Async connection (ITS#7806) Fixed nssov install path (ITS#7858) Fixed passwd rpath (ITS#7885) Fixed apr1 do_phk_hash argument order (ITS#7869) Fixed slapd-sha2 buffer overrun (ITS#7851) Documentation Fixed slapd.ldif man page reference (ITS#7803) Fixed slapd.conf(5) man page to reference exattrs (ITS#7847) Fixed guide to work with mkrelease (ITS#7887) Fixed ldap_get_dn(3) ldap_ava definition (ITS#7860) OpenLDAP 2.4.39 Release (2014/01/26) Fixed libldap MozNSS crash (ITS#7783) Fixed libldap memory leak with SASL (ITS#7757) Fixed libldap assert in parse_passwdpolicy_control (ITS#7759) Fixed libldap shortcut NULL RDNs (ITS#7762) Fixed libldap deref to use correct control Fixed liblmdb keysizes with mdb_update_key (ITS#7756) Fixed slapd cn=config olcDbConfig modification (ITS#7750) Fixed slapd-bdb/hdb to bail out of search if config is paused (ITS#7761) Fixed slapd-bdb/hdb indexing issue with derived attributes (ITS#7778) Fixed slapd-mdb to bail out of search if config is paused (ITS#7761) Fixed slapd-mdb indexing issue with derived attributes (ITS#7778) Fixed slapd-perl to bail out of search if config is paused (ITS#7761) Fixed slapd-sql to bail out of search if config is paused (ITS#7761) Fixed slapo-constraint handling of softadd/softdel (ITS#7773) Fixed slapo-syncprov assert with findbase (ITS#7749) Build Environment Test suite: Use $(MAKE) for tests (ITS#7753) Documentation admin24 fix TLSDHParamFile to be correct (ITS#7684) OpenLDAP 2.4.38 Release (2013/11/16) Fixed liblmdb nordahead flag (ITS#7734) Fixed liblmdb to check cursor index before cursor_del (ITS#7733) Fixed liblmdb wasted space on split (ITS#7589) Fixed slapd for certs with a NULL issuerDN (ITS#7746) Fixed slapd cn=config with empty nested includes (ITS#7739) Fixed slapd syncrepl memory leak with delta-sync MMR (ITS#7735) Fixed slapd-bdb/hdb to stop processing on dn not found (ITS#7741) Fixed slapd-bdb/hdb with indexed ANDed filters (ITS#7743) Fixed slapd-mdb to stop processing on dn not found (ITS#7741) Fixed slapd-mdb dangling reader (ITS#7662) Fixed slapd-mdb matching rule for OlcDbEnvFlags (ITS#7737) Fixed slapd-mdb with indexed ANDed filters (ITS#7743) Fixed slapd-meta from blocking other threads (ITS#7740) Fixed slapo-syncprov assert with findbase (ITS#7749) OpenLDAP 2.4.37 Release (2013/10/27) Added liblmdb nordahead environment flag (ITS#7725) Fixed client tools CLDAP with IPv6 (ITS#7695) Fixed libldap CLDAP with IPv6 (ITS#7695) Fixed libldap lock ordering with abandon op (ITS#7712) Fixed liblmdb segfault with mdb_cursor_del (ITS#7718) Fixed liblmdb when converting to writemap (ITS#7715) Fixed liblmdb assert on MDB_NEXT with delete (ITS#7722) Fixed liblmdb wasted space on split (ITS#7589) Fixed slapd cn=config with olcTLSProtocolMin (ITS#7685) Fixed slapd-bdb/hdb optimize index updates (ITS#7329) Fixed slapd-ldap chaining with cn=config (ITS#7381, ITS#7434) Fixed slapd-ldap chaining with controls (ITS#7687) Fixed slapd-mdb optimize index updates (ITS#7329) Fixed slapd-meta chaining with cn=config (ITS#7381, ITS#7434) Fixed slapo-constraint to no-op on nonexistent entries (ITS#7692) Fixed slapo-dds assert on startup (ITS#7699) Fixed slapo-memberof to not replicate internal ops (ITS#7710) Fixed slapo-refint to not replicate internal ops (ITS#7710) Build Environment Fixed slapd-mdb ptr arithmetic on void *s (ITS#7720) Documentation ldapsearch(1) minor typo fix (ITS#7680) slapd-passwd(5) minor typo fix (ITS#7680) OpenLDAP 2.4.36 Release (2013/08/17) Added back-meta target filter patterns (ITS#7609) Added liblmdb mdb_txn_env to API (ITS#7660) Fixed libldap CLDAP with uninit'd memory (ITS#7582) Fixed libldap with UDP (ITS#7583) Fixed libldap OpenSSL TLS versions (ITS#7645) Fixed liblmdb MDB_PREV behavior (ITS#7556) Fixed liblmdb transaction issues (ITS#7515) Fixed liblmdb mdb_drop overflow page return (ITS#7561) Fixed liblmdb nested split (ITS#7592) Fixed liblmdb overflow page behavior (ITS#7620) Fixed liblmdb race condition with read and write txns (ITS#7635) Fixed liblmdb mdb_del behavior with MDB_DUPSORT and mdb_del (ITS#7658) Fixed slapd cn=config with unknown schema elements (ITS#7608) Fixed slapd cn=config with loglevel 0 (ITS#7611) Fixed slapd slapi filterlist free behavior (ITS#7636) Fixed slapd slapi control free behavior (ITS#7641) Fixed slapd schema countryString as directoryString (ITS#7659) Fixed slapd schema telephoneNumber as directoryString (ITS#7659) Fixed slapd-bdb/hdb to wait for read locks in tool mode (ITS#6365) Fixed slapd-mdb behavior with alias dereferencing (ITS#7577) Fixed slapd-mdb modrdn and base-scoped searches (ITS#7604) Fixed slapd-mdb refcount behavior (ITS#7628) Fixed slapd-meta binding flag is set (ITS#7524) Fixed slapd-meta with minimal config (ITS#7581) Fixed slapd-meta missing results messages (ITS#7591) Added slapd-meta TCP keepalive support (ITS#7513) Fixed slapo-sssvlv double free (ITS#7588) Fixed slaptest to list -Q option (ITS#7568) Build Environment Fixed slapd-meta declaration warnings (ITS#7654) Contrib Fixed nssov group enumeration bug (ITS#7569) Fixed autogroup when URI has no attrs (ITS#7580) Documentation admin24 Update database backend notes (ITS#7590) ldap.conf(5) fixed typos (ITS#7568) ldapmodify(1) remove replog reference (ITS#7562) ldif(5) remove replog reference (ITS#7562) slapd-config(5) remove replog reference (ITS#7562) slapd.conf(5) remove replog reference (ITS#7562) slapd-config(5) document TLSProtocolMin (ITS#5655,ITS#7645) slapd.conf(5) document TLSProtocolMin (ITS#5655,ITS#7645) OpenLDAP 2.4.35 Release (2013/03/31) Fixed liblmdb mdb_cursor_put with MDB_MULTIPLE (ITS#7551) Fixed liblmdb page rebalance (ITS#7536) Fixed liblmdb missing parens (ITS#7377) Fixed liblmdb mdb_cursor_del crash (ITS#7553) Fixed slapd syncrepl updateCookie status (ITS#7531) Fixed slapd connection logging (ITS#7543) Fixed slapd segfault on modify (ITS#7542, ITS#7432) Fixed slapd-mdb to reject undefined attrs (ITS#7540) Fixed slapo-pcache with +/- attrsets (ITS#7552) Build Environment don't install DB_CONFIG if no BDB backends (ITS#7533) Documentation slapschema(8) fix tool name (ITS#7534) admin24 fixed pcache example (ITS#7546) admin24 fixed config examples (ITS#7522) OpenLDAP 2.4.34 Release (2013/03/01) Fixed libldap connections with EINTR (ITS#7476) Fixed libldap lineno overflow in ldif_read_record (ITS#7497) Fixed liblmdb mdb_env_open flag handling (ITS#7453) Fixed liblmdb mdb_midl_sort array optimization (ITS#7432) Fixed liblmdb freelist with large entries (ITS#7455) Fixed liblmdb to check for filled dirty page list (ITS#7491) Fixed liblmdb to validate data limits (ITS#7485) Fixed liblmdb mdb_update_key for large keys (ITS#7505) Fixed ldapmodify to not core dump with invalid LDIF (ITS#7477) Fixed slapd syncrepl for old entries in MMR setup (ITS#7427) Fixed slapd signedness for index_substr_any_* (ITS#7449) Fixed slapd enforce SLAPD_MAX_DAEMON_THREADS (ITS#7450) Fixed slapd mutex in send_ldap_ber (ITS#6164) Added slapd-ldap onerr option (ITS#7492) Added slapd-ldap keepalive support (ITS#7501) Fixed slapd-ldif with empty dir (ITS#7451) Fixed slapd-mdb to reopen attr DBs after env reopen (ITS#7416) Fixed slapd-mdb handling of missing entries (ITS#7483,7496) Fixed slapd-mdb environment flag setting (ITS#7452) Fixed slapd-mdb with sub db slapcat (ITS#7469) Fixed slapd-mdb to correctly work with toolthreads > 2 (ITS#7488,ITS#7527) Fixed slapd-mdb subtree search speed (ITS#7473) Fixed slapd-meta conversion to cn=config (ITS#7525) Fixed slapd-meta segfault when modifying olcDbUri (ITS#7526) Fixed slapd-sql back-config support (ITS#7499) Fixed slapo-constraint handle uri and restrict correctly (ITS#7418) Fixed slapo-constraint with multi-master replication (ITS#7426) Fixed slapo-constraint segfault (ITS#7431) Fixed slapo-deref control initialization (ITS#7436) Fixed slapo-deref control exposure (ITS#7445) Fixed slapo-memberof with internal ops (ITS#7487) Fixed slapo-pcache matching rules for config db (ITS#7459) Fixed slapo-rwm modrdn cleanup (ITS#7414) Fixed slapo-sssvlv maxperconn parameter (ITS#7484) Build Environment Fixed slapo-constraint test suite (ITS#7423) Contrib Added nssov nssov_config support (ITS#7518) Added nssov password_prohibit_message (ITS#7518) Fixed ldapc++ with gcc-4.7 (ITS#7281,ITS#7304) Fixed nssov olcNssPamSession handling (ITS#7481) Fixed nssov connection DN (ITS#7518) Add missing Makefile for various modules (ITS#7308) Unify Makefile structure for modules (ITS#7309) Fixed slapo-allowed attribute replication (ITS#7493) Fixed slapo-passwd SHA2 to correctly zero buffer (ITS#7490) Documentation ldapurl(1) fix example usage (ITS#7454) ldap_get_option(3) fixed trailing whitespace (ITS#7411) slapd-config(5) olcExtraAttrs is per db (ITS#7421) slapd-overlays(5) update manpage index (ITS#7489) slapo-dynlist(5) Search behavior notes (ITS#7486) slapo-valsort(5) Document valsort control syntax (ITS#7523) OpenLDAP 2.4.33 Release (2012/10/10) Added slapd-meta cn=config support Fixed libldap MozNSS slot picking (ITS#7359) Fixed libldap MozNSS with tokenname:certnickname format (ITS#7360) Fixed liblmdb POSIX semaphore cleanup on environment close (ITS#7364) Fixed liblmdb mdb_page_split (ITS#7385, ITS#7229) Fixed slapd alock handling on Windows (ITS#7361) Fixed slapd acl handling with zero-length values (ITS#7350) Fixed slapd syncprov to not reference ops inside a lock (ITS#7172) Fixed slapd delta-syncrepl MMR with large attribute values (ITS#7354) Fixed slapd slapd_rw_destroy function (ITS#7390) Fixed slapd-ldap idassert bind handling (ITS#7403) Fixed slapd-mdb slapadd -q -w double free (ITS#7356) Fixed slapd-mdb to close read txn in reindex commit (ITS#7386) Fixed slapo-constraint with multiple modifications (ITS#7168) Build Environment Fixed build with Visual Studio (ITS#7358) Fixed liblmdb posix semaphore use on BSD system (ITS#7363) Add slapo-constraint test suite (ITS#7344, ITS#7366) Contrib Updated radius passwd module for NAS-Identifier (ITS#7357) Documentation slapo-refint(5) Note that refint is not replicated (ITS#7405) OpenLDAP 2.4.32 Release (2012/07/31) Added slappasswd loadable module support (ITS#7284) Fixed tools to not clobber SASL_NOCANON (ITS#7271) Fixed libldap function declarations (ITS#7293) Fixed libldap double free (ITS#7270) Fixed libldap debug level setting (ITS#7290) Fixed libldap MozNSS PEM/certdb handling (ITS#7276) Fixed libldap MozNSS cipher suite selection (ITS#7285) Fixed libldap MozNSS error handling (ITS#7287) Fixed libldap MozNSS cipher suite being ignored (ITS#7289) Fixed libldap MozNSS infinite loop (ITS#7291) Fixed libldap MozNSS context token for certdb (ITS#7312) Fixed libldap MozNSS store certificate object (ITS#7313) Fixed libldap MozNSS fix init and cleanup (ITS#7314) Fixed libldap MozNSS slot and pin usage (ITS#7315) Fixed libldap MozNSS to avoid infinite loop (ITS#7316) Fixed libldap MozNSS untrusted issuer error (ITS#7331) Fixed libldap gettime() regression (ITS#6262) Fixed libldap sasl handling (ITS#7118, ITS#7133) Fixed libldap to correctly free socket with TLS (ITS#7241) Fixed liblmdb leaf node handling (ITS#7266) Fixed liblmdb mutexes on Apple/Windows (ITS#7251) Fixed slapd config index renumbering (ITS#6987) Fixed slapd duplicate error response (ITS#7076) Fixed slapd parsing of PermissiveModify control (ITS#7298) Fixed slapd-bdb/hdb cache hang under high load (ITS#7222) Fixed slapd-bdb/hdb alias checking (ITS#7303) Fixed slapd-bdb/hdb olcDbConfig changes work immediately (ITS#7338) Fixed slapd-ldap to encode user DN during password change (ITS#7319) Fixed slapd-ldap assertion when proxying to MS AD (ITS#6851) Fixed slapd-ldap monitoring (ITS#7182, ITS#7225) Fixed slapd-mdb with tool mode (ITS#7255) Fixed slapd-mdb with approx indexing (ITS#7279) Fixed slapd-mdb dn2id delete (ITS#7302) Fixed slapd-mdb memory leak in online indexer (ITS#7323) Fixed slapd-mdb db corruption when hitting maxsize (ITS#7337) Fixed slapd-mdb aborts with online indexing (ITS#7339) Fixed slapd-perl panic (ITS#7325) Fixed slapo-accesslog memory leaks with sync replication (ITS#7292) Fixed slapo-syncprov memory leaks with sync replication (ITS#7292) Fixed contrib/smbk5pwd to not compile with MozNSS (ITS#7327) Fixed contrib/sha2 portability (ITS#7267) Fixed contrib/sha2 thread safety (ITS#7269) Added contrib/sha2 {SSHA256}, {SSHA384}, {SSHA512} support (ITS#7278) Build Environment Fixed test057 timing issues (ITS#7317) Fixed compilation with MS Visual Studio (ITS#7332) Contrib Added slapi_[get|free]_client_ip() (ITS#7305) Documentation slapo-sssvlv Added note about criticality (ITS#7253) admin24 Fix peername.regex typo (ITS#7282) Fixed slapd-config file include example (ITS#7318) slapd-ldap(5) Reference RFC4526 (ITS#7294) slapd-meta(5) Reference RFC4526 (ITS#7294) OpenLDAP 2.4.31 Release (2012/04/21) Added slapo-accesslog support for reqEntryUUID (ITS#6656) Fixed libldap IPv6 URL detection (ITS#7194) Fixed libldap rebinding on failed connection (ITS#7207) Fixed liblmdb alignment of MDB_db members (ITS#7191) Fixed liblmdb branch page merging on deletes (ITS#7190) Fixed liblmdb page split with MDB_APPEND (ITS#7213) Fixed liblmdb free page usage with entry deletion (ITS#7210) Fixed liblmdb to use IOV_MAX if it is defined and small (ITS#7196) Fixed liblmdb key alignment (ITS#7219) Fixed liblmdb mdb_page_split (ITS#7229) Fixed liblmdb with zero length IDLs (ITS#7230) Fixed slapd listener initialization (ITS#7233) Fixed slapd cn=config with olcTLSVerifyClient (ITS#7197) Fixed slapd delta-syncrepl fallback on non-leaf error (ITS#7195) Fixed slapd to reject MMR setups with bad serverID setting (ITS#7200) Fixed slapd approxIndexer key generation (ITS#7203) Fixed slapd modification of olcSuffix (ITS#7205) Fixed slapd schema validation with missing definitions (ITS#7224) Fixed slapd syncrepl -c with supplied CSN values (ITS#7245) Fixed slapd-bdb/hdb idlcache with only one element (ITS#7231) Fixed slapd-perl modify with binary values (ITS#7149) Fixed slapd-shell cn=config support (ITS#7201) Fixed slapd-shell modify with binary values (ITS#7149) Fixed slapo-accesslog deadlock with non-logged write ops (ITS#7088) Fixed slapo-syncprov sessionlog check (ITS#7218) Fixed slapo-syncprov entry leak (ITS#7234) Fixed slapo-syncprov startup initialization (ITS#7235) Build Environment Fixed test022 to check ldapsearch results (ITS#7228) Fixed test044 when back-monitor is disabled (ITS#7204) Documentation Fixed slapschema(8) formatting (ITS#7188) Fixed limdb functionality documentation (ITS#7238) Fixed ldap_get_option(3) note inheritance behavior (ITS#7240) OpenLDAP 2.4.30 Release (2012/02/29) Fixed libldap socket polling for writes (ITS#7167) Fixed liblutil string modifications (ITS#7174) Fixed slapd crash when attrsOnly is true (ITS#7143) Fixed slapd syncrepl delete handling (ITS#7052,ITS#7162) Fixed slapd-mdb slapadd with -q (ITS#7170) Fixed slapd-mdb slapadd with -w (ITS#7180) Fixed slapd-mdb slapindex with -q and -t (ITS#7176) Fixed slapo-pcache time-to-refesh handling (ITS#7178) Fixed slapo-syncprov loop detection (ITS#6024) Build Environment Fixed POSIX make support (ITS#7160) Fixed slapd-mdb build on POSIX (ITS#7160) Documentation Added option "-o" to ldap*(1) pages (ITS#7152) Fixed ldap*(1) page cleanup (ITS#7177) Fixed ldap_modify(3) prototypes (ITS#7173) OpenLDAP 2.4.29 Release (2012/02/12) Fixed libldap MozNSS deferred initialization handling (ITS#7136) Fixed libldap MozNSS with TLSCertificateKeyFile not set (ITS#7135) Fixed slapd cn=config modification of first schema element (ITS#7098) Fixed slapd operation reuse (ITS#7107) Fixed slapd blocked writers to not interfere with pool pause (ITS#7115) Fixed slapd connection loop connindex usage (ITS#7131) Fixed slapd double mutex unlock via connection_done (ITS#7125) Fixed slapd check order in connection_write (ITS#7113) Fixed slapd slapadd to exit on failure (ITS#7142) Fixed slapd syncrepl reference to freed memory (ITS#7127,ITS#7132) Fixed slapd syncrepl to ignore some errors on delete (ITS#7052) Fixed slapd syncrepl to handle missing oldRDN (ITS#7144) Fixed slapd-mdb to handle overlays in tool mode (ITS#7099) Fixed slapd-mdb segfaults with page splits (ITS#7121) Fixed slapd-mdb cleanup on transaction abort (ITS#7140) Fixed slapd-mdb with attribute descriptions (ITS#7146) Fixed slapd-meta to correctly handle multiple targets (ITS#7050) Fixed slapd-monitor compare op to update cached entry (ITS#7123) Fixed slapd-perl initialization (ITS#7075) Fixed slapd-sql to properly initialize be_cf_ocs (ITS#7158) Fixed slapo-dds to properly exit when in tool mode (ITS#7099) Fixed slapo-rwm not leave empty lots with normalized attrs (ITS#7143) Fixed slapo-syncprov with already abandoned operation (ITS#7150) Fixed contrib/smbk5pwd uninitialized keys in shadowLastChange (ITS#7138) Build Environment Fixed ldapsearch build on windows (ITS#7156) Fixed test001 to skip back-ldif (ITS#7101) Documentation admin24 Fix typo (ITS#7117) OpenLDAP 2.4.28 Release (2011/11/26) Fixed back-mdb out of order slapadd (ITS#7090) OpenLDAP 2.4.27 Release (2011/11/24) Added libldap support for draft-wahl-ldap-session (ITS#6984) Added slapd support for draft-wahl-ldap-session (ITS#6984) Added slapadd pipelining capability (ITS#7078) Added slapd Add-if-not-present (ITS#6561) Added slapd delta-syncrepl MMR (ITS#6734,ITS#7029,ITS#7031) Added slapd-mdb experimental backend (ITS#7079) Added slapd-passwd dynamic config support Added slapd-perl dynamic config support Added slapd-shell dynamic config support Added slapd-sock support as an overlay (ITS#6666) Added slapd-sql dynamic config support Added contrib/passwd APR1 support (ITS#6826) Fixed slapi linking on AIX (ITS#3272) Fixed ldapmodify crash with LDIF controls (ITS#7039) Fixed ldapsearch to honor timeout and timelimit (ITS#7009) Fixed libldap endless looping (ITS#7035) Fixed libldap TLS to not check hostname when using 'allow' (ITS#7014) Fixed libldap GnuTLS cert dn parse (ITS#7051) Fixed libldap MozNSS correctly destroy SSL_PeerCertificate (ITS#6980) Fixed libldap MozNSS with issuer expiration and verify never (ITS#6998) Fixed libldap MozNSS memory leak (ITS#7001) Fixed libldap MozNSS allow/try behavior (ITS#7002) Fixed libldap MozNSS to be thread safe (ITS#7022) Fixed libldap MozNSS SSL_ForceHandshake to use a mutex (ITS#7034) Fixed libldap MozNSS with wildcard certs (ITS#7006) Fixed liblutil MD5 initialization (ITS#6982) Fixed slapadd common code into slapcommon (ITS#6737) Fixed slapd backend connection initialization (ITS#6993) Fixed slapd frontend DB parsing in cn=config (ITS#7016) Fixed slapd hang with {numbered} overlay insertion (ITS#7030) Fixed slapd inet_ntop usage (ITS#6925) Fixed slapd cn=config deletion of bitmasks (ITS#7083) Fixed slapd cn=config modify replace/delete crash (ITS#7065) Fixed slapd schema UTF8StringNormalize with 0 length values (ITS#7059) Fixed slapd with dynamic acls for cn=config (ITS#7066) Fixed slapd response callbacks (ITS#6059,ITS#7062) Fixed slapd no_connection warnings with ldapi (ITS#6548,ITS#7092) Fixed slapd return code processing (ITS#7060) Fixed slapd sl_malloc various issues (ITS#6437) Fixed slapd startup behavior (ITS#6848) Fixed slapd syncrepl crash with non-replicated ops (ITS#6892) Fixed slapd syncrepl with modrdn (ITS#7000,ITS#6472) Fixed slapd syncrepl timeout when using refreshAndPersist (ITS#6999) Fixed slapd syncrepl deletes need a non-empty CSN (ITS#7052) Fixed slapd syncrepl glue for empty suffix (ITS#7037) Fixed slapd results cleanup (ITS#6763,ITS#7053) Fixed slapd validation of args for TLSCertificateFile (ITS#7012) Fixed slapd-bdb/hdb to build entry DN based on parent DN (ITS#5326) Fixed slapd-hdb with zero-length entries (ITS#7073) Fixed slapd-hdb duplicate entries in subtree IDL cache (ITS#6983) Fixed slapo-constraint conversion to back-config (ITS#6986) Fixed slapo-dds tag in refresh response (ITS#6886) Fixed slapo-dds TTL tolerance (ITS#7017) Fixed slapo-lastbind so authTimestamp is manageable (ITS#6873) Fixed slapo-pcache response cleanup (ITS#6981) Fixed slapo-ppolicy pwdAllowUserChange behavior (ITS#7021) Fixed slapo-sssvlv issue with greaterThanorEqual (ITS#6985) Fixed slapo-sssvlv to only return requested attrs (ITS#7061) Fixed slapo-syncprov DSA attribute filtering for Persist mode (ITS#7019) Fixed slapo-syncprov when consumer has newer state of our SID (ITS#7040) Fixed slapo-syncprov crash (ITS#7025) Fixed slapo-unique URI checking of "host" portion (ITS#7018) Fixed contrib/autogroup double-free (ITS#6972) Fixed contrib/smbk5pwd cn=config deletion of bitmasks (ITS#7083) Fixed contrib/smbk5pwd on 64-bit systems (ITS#7082) Build Environment Added missing LDIF form of schema files (ITS#7063) Fixed build for Solaris native compilers (ITS#6992) Fixed creation and installation of slapd.ldif (ITS#7015) Fixed libnet linking (ITS#7071) Documentation admin24 Fix table numbering (ITS#7003) slapd.conf(5) Fixed TLSCACertificateFile information (ITS#7023) ldapmodify(1) Fixed minor typo in -S option description (ITS#7086) ldap_sync(3) Document ldap_sync_destroy (ITS#7028) slapo-unique(5) Fix keyword quoting (ITS#7028) OpenLDAP 2.4.26 Release (2011/06/30) Added libldap LDAP_OPT_X_TLS_PACKAGE (ITS#6969) Fixed libldap MozNSS with CACertDir (ITS#6975) Fixed libldap MozNSS with PR_SetEnv (ITS#6862) Fixed libldap descriptor leak (ITS#6929) Fixed libldap socket leak (ITS#6930) Fixed libldap get option crash (ITS#6931) Fixed libldap lockup (ITS#6898) Fixed libldap ASYNC TLS setup (ITS#6828) Fixed libldap with missing \n terminations (ITS#6947) Fixed tools double free (ITS#6946) Fixed tools verbose output (ITS#6977) Fixed ldapmodify SEGV on invalid LDIF (ITS#6978) Added slapd extra_attrs database option (ITS#6513) Fixed slapd asserts (ITS#6932) Fixed slapd configfile param on windows (ITS#6933) Fixed slapd config with global chaining (ITS#6843) Fixed slapd uninitialized variables (ITS#6935) Fixed slapd config objectclass is readonly (ITS#6963) Fixed slapd entry response with control (ITS#6899) Fixed slapd with unknown attrs (ITS#6819) Fixed slapd normalization of schema RDN (ITS#6967) Fixed slapd operations cache to 10 op limit (ITS#6944) Fixed slapd syncrepl crash with non-replicated ops (ITS#6892) Fixed slapd-bdb/hdb with sparse index ranges (ITS#6961) Fixed slapd-monitor stray code cleanup (ITS#6974) Fixed back-ldap ppolicy updates (ITS#6711) Fixed back-ldap with id-assert (ITS#6817) Fixed slapd-meta reentry issues (ITS#6909) Fixed slapd-sql length of data type (ITS#6657,ITS#6691) Added slapo-accesslog filter matching (ITS#6815) Fixed slapo-accesslog with invalid attrs (ITS#6819) Added slapo-auditlog connID and peername logging (ITS#6936) Fixed slapo-memberof with accesslog (ITS#6329,ITS#6766,ITS#6915) Fixed slapo-pcache with unknown attrs (ITS#6823) Fixed slapo-pcache with '1.1', '+', and '*' attrs (ITS#6950) Fixed slapo-pcache buffersize issues (ITS#6951) Fixed slapo-pcache refresh (ITS#6953) Fixed slapo-pcache with pCacheBind (ITS#6954) Fixed slapo-pcache database corruption (ITS#6831) Fixed slapo-rwm with attributes with no equality rule (ITS#6943) Fixed slapo-sssvlv limits check when global (ITS#6973) Fixed slapo-syncprov with replicated subtrees (ITS#6872) Fixed slapo-unique with managedsait (ITS#6641) Fixed slapo-unique filter with zero-length values (ITS#6901) Added contrib/acl GSS naming extensions ACL module Fixed contrib/smbk5pwd with shadowLastChange (ITS#6955) Build Environment Fixed builds that do not have GETTIMEOFDAY (ITS#6885) Fixed libldap libfetch dependancy (ITS#6889) Documentation ldap_get_dn(3) add man page (ITS#6959) slapd-backends(5) update recommended database backend (ITS#6904) slapd-bdb(5) update recommended database backend (ITS#6904) slapd-hdb(5) update recommended database backend (ITS#6904) slapo-nssov(5) Fixed typo (ITS#6934) admin24 update that cn=config is preferred (ITS#6905) admin24 update information about indexes (ITS#6906) admin24 fix --enable-wrappers option (ITS#6971) admin24 fix typos (ITS#8562) admin24 fix replication sections to include back-mdb (ITS#8563) OpenLDAP 2.4.25 Release (2011/03/26) Fixed ldapsearch pagedresults loop (ITS#6755) Fixed tools for incompatible args (ITS#6849) Fixed libldap MozNSS crash (ITS#6863) Fixed slapd add objectclasses in order (ITS#6837) Added slapd ordering for uidNumber and gidNumber (ITS#6852) Fixed slapd segfault when adding values out of order (ITS#6858) Fixed slapd sortval handling (ITS#6845) Fixed slapd-bdb with slapadd/index quick option (ITS#6853) Fixed slapd-ldap chain cn=config support (ITS#6837) Fixed slapd-ldap chain with slapd.conf (ITS#6857) Fixed slapd-meta deadlock (ITS#6846) Fixed slapo-sssvlv with multiple requests (ITS#6850) Fixed contrib/lastbind install rules (ITS#6238) Fixed contrib/cloak install rules (ITS#6877) Build Environment Fixed windows NT threads build (ITS#6859) Fixed libldap/lberl/util if/else usage (ITS#6832) Fixed Windows odbc32 detection (ITS#6125) Fixed Windows msys build (ITS#6870) Fixed test020 exit codes (ITS#6404) Documentation admin24 guide ldapi usage (ITS#6839) admin24 guide conversion notes (ITS#6834) admin24 guide fix drawback math for syncrepl (ITS#6866) admin24 guide note manpages are definitive (ITS#6855) OpenLDAP 2.4.24 Release (2011/02/10) Added LDIF line wrapping setting (ITS#6645) Added MozNSS support (ITS#6714,ITS#6742,ITS#6790,ITS#6791) Added MozNSS support (ITS#6802,ITS#6811,ITS#6816,ITS#5696) Added libldap cert x500UniqueIdentifier handling (ITS#6741) Added libldap_r,libldap formal concurrency API (ITS#6625,ITS#5421) Added slapadd attribute value checking (ITS#6592) Added slapcat continue mode for problematic DBs (ITS#6482) Added slapd syncrepl suffixmassage support (ITS#6781) Added slapd multiple listener threads (ITS#6780) Added slapd extensible match for ordering rules (ITS#6532) Added slapd-meta paged results control forwarding (ITS#6664) Added slapd-meta subtree-include support (ITS#6801) Added slapd-null back-config support (ITS#6624) Added slapd-sql autocommit support (ITS#6612) Added slapd-sql support for long long keys (ITS#6617) Added slapo-sssvlv multiple sorts per connection (ITS#6686) Added contrib/autogroup LDAP URI with attribute filter (ITS#6536) Added contrib/dupent module (ITS#6630) Added contrib/lastbind (ITS#6238) Added contrib/kinit for kerberos tickets Added contrib/noopsrch for entry counting (ITS#6598) Fixed client tools control logging (ITS#6775) Fixed client tools one time leak (ITS#6778) Fixed liblber to not close invalid sockets (ITS#6585) Fixed liblber unmatched brace handling (ITS#6764) Fixed liblber error setting (ITS#6732) Fixed liblber memory debugging (ITS#6733) Fixed libldap connectionless warnings (ITS#6747) Fixed libldap dnssrv port format specifier (ITS#6644) Fixed libldap EOF handling (ITS#6723) Fixed libldap GnuTLS hang on socket close (ITS#6673) Fixed libldap sasl partial write handling (ITS#6639) Fixed libldap search leak (ITS#6453) Fixed libldap referral chasing (ITS#6602) Fixed libldap leak when chasing referrals (ITS#6744) Fixed libldap url parsing with NULL host (ITS#6653) Fixed libldap ldap_open_internal_connection (ITS#6788) Fixed libldap sync checking for BER errors (ITS#6738) Fixed libldap variable usage (ITS#6813) Fixed liblutil getpass prompts (ITS#6702) Fixed ldapsearch segfault with deref (ITS#6638) Fixed ldapsearch multiple controls parsing (ITS#6651) Fixed slapd SlapReply usage (ITS#6758) Fixed slapd acl parsing overflow (ITS#6611) Fixed slapd acl when resuming parsing (ITS#6804) Fixed slapd Compare operation (ITS#6753) Fixed slapd default config acls with overlays (ITS#6822) Fixed slapd assert control (ITS#5862) Fixed slapd assertions and debugging (ITS#6759) Fixed slapd config leak with olcDbDirectory (ITS#6634) Fixed slapd connectionless warnings (ITS#6747) Fixed slapd listeners destruction (ITS#6736) Fixed slapd to free controls if needed (ITS#6629) Fixed slapd to stop if given unknown options (ITS#6754) Fixed slapd filter leak (ITS#6635) Fixed slapd matching rules for strict ordering (ITS#6722) Fixed slapd when first acl is value dependent (ITS#6693) Fixed slapd modify to return actual error (ITS#6581) Fixed slapd modrdn with empty DN (ITS#6768) Fixed slapd c_authz_backend setting (ITS#6824) Fixed slapd sortvals of attributes with 1 value (ITS#6715) Fixed slapd syncrepl reuse of presence list (ITS#6707) Fixed slapd syncrepl uninitialized return code (ITS#6719) Fixed slapd syncrepl variable initialization (ITS#6739) Fixed slapd syncrepl refresh to use complete cookie (ITS#6807) Fixed slapd-bdb hasSubordinates generation (ITS#6712) Fixed slapd-bdb entry cache delete failure (ITS#6577) Fixed slapd-bdb entry cache leak on multi-core systems (ITS#6660) Fixed slapd-bdb error propagation to overlays (ITS#6633) Fixed slapd-bdb slapadd -q with glued dbs (ITS#6794) Fixed slapd-ldap debug output of timeout (ITS#6721) Fixed slapd-ldap DNSSRV referral chaining (ITS#6565) Fixed slapd-ldap chaining with bind failures (ITS#6607) Fixed slapd-ldap chaining with onelevel scope (ITS#6699) Fixed slapd-ldap chaining with ppolicy (ITS#6540) Fixed slapd-ldap with SASL/EXTERNAL (ITS#6642) Fixed slapd-ldap crasher on matchedDN (ITS#6793) Fixed slapd-ldap with unknown objectClasses (ITS#6814) Fixed slapd-ldif error strings (ITS#6731) Fixed slapd-ndb to honor rootpw setting (ITS#6661) Fixed slapd-ndb hasSubordinates generation (ITS#6712) Fixed slapd-ndb variable initialization (ITS#6806) Fixed slapd-ndb with out of order attributes (ITS#6821) Fixed slapd-meta anon retry with failed auth method (ITS#6643) Fixed slapd-meta rebind proc (ITS#6665) Fixed slapd-meta to correctly rebind as user (ITS#6574) Fixed slapd-meta with SASL/EXTERNAL (ITS#6642) Fixed slapd-meta matchedDN return code (ITS#6774) Fixed slapd-meta candidate selection (ITS#6799) Fixed slapd-meta attribute normalization (ITS#6818) Fixed slapd-monitor hasSubordinates generation (ITS#6712) Fixed slapd-monitor abandon processing (ITS#6783) Fixed slapd-monitor entry locks (ITS#6787) Fixed slapd-sock missing newline in Compare operation (ITS#6809) Fixed slapd-sql with null objectClass (ITS#6616) Fixed slapd-sql hasSubordinates generation (ITS#6712) Fixed slapo-accesslog with controls (ITS#6652) Fixed slapo-dynlist Compare operation (ITS#6752) Fixed slapo-dynlist entry handling (ITS#6752) Fixed slapo-memberof CSN generation (ITS#6766) Fixed slapo-memberof log messages (ITS#6748) Fixed slapo-memberof with an empty groupOfNames (ITS#6670) Fixed slapo-memberof with modrdn operations (ITS#6700) Fixed slapo-pcache callback freeing (ITS#6640) Fixed slapo-pcache to ignore undefined attrs (ITS#6600) Fixed slapo-pcache pointer freeing (ITS#6797) Fixed slapo-pcache with negative caching (ITS#6796) Fixed slapo-pcache monitoring cleanup (ITS#6808) Fixed slapo-ppolicy don't update opattrs on consumers (ITS#6608) Fixed slapo-ppolicy to allow userPassword deletion (ITS#6620) Fixed slapo-refint when last group member is deleted (ITS#6663) Fixed slapo-refint with subtree rename (ITS#6730) Fixed slapo-rwm double free (ITS#6720) Fixed slapo-rwm crasher (ITS#6632,ITS#6727) Fixed slapo-rwm entry handling (ITS#6760) Fixed slapo-rwm response hang (ITS#6792) Fixed slapo-sssvlv initialization (ITS#6649) Fixed slapo-sssvlv to not advertise when unused (ITS#6647) Fixed slapo-sssvlv result code (ITS#6685) Fixed slapo-syncprov to send error if consumer is newer (ITS#6606) Fixed slapo-syncprov filter race condition (ITS#6708) Fixed slapo-syncprov active mod race (ITS#6709) Fixed slapo-syncprov to refresh if context is dirty (ITS#6710) Fixed slapo-syncprov CSN updates to all replicas (ITS#6718) Fixed slapo-syncprov sessionlog ordering (ITS#6716) Fixed slapo-syncprov sessionlog with adds (ITS#6503) Fixed slapo-syncprov mutex (ITS#6438) Fixed slapo-syncprov mincsn check with MMR (ITS#6717) Fixed slapo-syncprov control leak (ITS#6795) Fixed slapo-syncprov error codes (ITS#6812) Fixed slapo-translucent entry leak (ITS#6746) Fixed contrib/autogroup install location (ITS#6684) Fixed contrib/autogroup crash with ppolicy (ITS#6684) Fixed contrib/autogroup with non-DN URIs (ITS#6684) Fixed contrib/autogroup with memberOf overlay (ITS#6684) Fixed contrib/cloak when returning multiple entries (ITS#6762) Fixed contrib/nssov to only close socket on shutdown (ITS#6676) Fixed contrib/nssov multi platform support (ITS#6604) Build Environment Added support for [unsigned] long long (ITS#6622) Added slapd support for BDB 5.0+ (ITS#6698) Fixed config.guess/sub to pick up newer OSes (ITS#6547) Fixed libldap mutex code - cleanup (ITS#6672) Fixed libldap unnecessary ifdef's (ITS#6603) Fixed slapd-tester EOF handling (ITS#6723) Fixed slapd-tester filter initialization (ITS#6735) Fixed test scripts with alternate testdir (ITS#6782) Removed antiquated SunOS LWP support (ITS#6669) Documentation admin24 guide fix examples (ITS#6681) admin24 guide typo fixes (ITS#6609) admin24 guide refint rootdn requirement (ITS#6364) admin24 add pcache overlay section (ITS#6521) ldap_open(3) document ldap_set_urllist_proc (ITS#6601) ldap.conf(5) GnuTLS cipher spec info (ITS#6525) slapd.conf(5) GnlTLS cipher spec info (ITS#6525) slapd.conf(5) multi-listener support (ITS#6780) slapd-config(5) GnuTLS cipher spec info (ITS#6525) slapd-config(5) multi-listener support (ITS#6780) slapd-meta(5) note deprecated items (ITS#6800) slapd-meta(5) document subtree-include (ITS#6801) slapo-pcache(5) note rootdn requirement (ITS#6522) slapo-refint(5) rootdn requirement (ITS#6364) OpenLDAP 2.4.23 Release (2010/06/30) Fixed libldap to return server's error code (ITS#6569) Fixed libldap memleaks (ITS#6568) Fixed liblutil off-by-one with delta (ITS#6541) Fixed slapd acls with glued databases (ITS#6468) Fixed slapd syncrepl rid logging (ITS#6533) Fixed slapd modrdn handling of invalid values (ITS#6570) Fixed slapd-bdb hasSubordinates computation (ITS#6549) Fixed slapd-bdb to use memcpy instead for strcpy (ITS#6474) Fixed slapd-bdb entry cache delete failure (ITS#6577) Fixed slapd-ldap to return control responses (ITS#6530) Fixed slapo-ppolicy to use Debug (ITS#6566) Fixed slapo-refint to zero out freed DN vals (ITS#6572) Fixed slapo-rwm to use Debug (ITS#6566) Fixed slapo-sssvlv to use Debug (ITS#6566) Fixed slapo-syncprov lost deletes in refresh phase (ITS#6555) Fixed slapo-valsort to use Debug (ITS#6566) Fixed contrib/nssov network.c missing patch (ITS#6562) Build Environment Fixed test043 attribute sorting (ITS#6553) Documentation slapd-config(5) note default rootdn (ITS#6546) OpenLDAP 2.4.22 Release (2010/04/24) Added slapd SLAP_SCHEMA_EXPOSE flag for hidden schema elements (ITS#6435) Added slapd tools selective iterations (ITS#6442) Added slapd syncrepl TCP keepalive (ITS#6389) Added slapo-ldap idassert-passthru (ITS#6456) Added slapo-pbind Fixed libldap gmtime re-entrancy (ITS#6262) Fixed libldap gssapi off by one error (ITS#6223) Fixed libldap GnuTLS serial length (ITS#6460) Fixed libldap MozNSS context and PEM support (ITS#6432) Fixed libldap referral on bind behavior(ITS#6510) Fixed slapd acl non-entry internal searches (ITS#6481) Fixed slapd acl attrval style initialization (ITS#6520) Fixed slapd certificateListValidate (ITS#6466) Fixed slapd empty URI parsing (ITS#6465) Fixed slapd glued misplaced entries (ITS#6506) Fixed slapd glued paged cookies (ITS#6507) Fixed slapd glued paged results (ITS#6504) Fixed slapd gmtime re-entrancy (ITS#6262) Fixed slapd to ignore controls with unrecognized flags (ITS#6480) Fixed slapd entry ownership (ITS#5340) Fixed slapd sasl auxprop_lookup (ITS#6441) Fixed slapd sasl auxprop ssf (ITS#5195) Fixed slapd syncrepl for attributes with no matching rule (ITS#6458) Fixed slapd syncrepl for unknown attrs and delta-sync (ITS#6473) Fixed slapd syncrepl loop with moddn (ITS#6472) Fixed slapo-accesslog to not replicate internal purges (ITS#6519) Fixed slapd-bdb contextCSN updates from updatedn (ITS#6469) Fixed slapd-bdb lockobj zeroing (ITS#6501) Fixed slapd-ldap/meta control criticality (ITS#6523) Fixed slapd-ldap/meta with ordered values (ITS#6516) Fixed slapo-collect entry ownership (ITS#5340,ITS#6423) Fixed slapo-dds with NULL backend (ITS#6490) Fixed slapo-dynlist entry ownership (ITS#5340,ITS#6423) Fixed slapo-memberof attr count (ITS#6508) Fixed slapo-pcache to release its own entries (ITS#6484) Fixed slapo-pcache with NULL backend (ITS#6490) Fixed slapo-rwm entry release handling (ITS#6484) Fixed slapo-rwm memory handling with rewrites (ITS#6526) Fixed slapo-rwm olcRwmMap handling (ITS#6436) Fixed slapo-rwm entry ownership (ITS#5340,ITS#6423) Fixed slapo-syncprov memory leak (ITS#6459) Fixed slapo-translucent counter increment (ITS#6497) Fixed slapo-valsort entry ownership (ITS#5340,ITS#6423) Fixed contrib/sha2 adds mechs for more hashes (ITS#6433) Fixed contrib/nssov to use nss-pam-ldapd (ITS#6488) Build Environment Added back-ldif, back-null test support (ITS#5810) Documentation admin24 avoid explicit moduleload statements (ITS#6486) admin24 broken link fixes (ITS#6493,ITS#6515) slapd.access(5) val.regex explanation (ITS#5804) OpenLDAP 2.4.21 Release (2009/12/20) Fixed liblutil for negative microsecond offsets (ITS#6405) Fixed slapd global settings to work without restart (ITS#6428) Fixed slapd looping with SSL/TLS connections (ITS#6412) Fixed slapd syncrepl freeing tasks from queue (ITS#6413) Fixed slapd syncrepl parsing of tls defaults (ITS#6419) Fixed slapd syncrepl uninitialized variables (ITS#6425) Fixed slapd-config Adds with Abstract classes (ITS#6408) Fixed slapo-dynlist behavior with simple filters (ITS#6421) Fixed slapd-ldif access outside database directory (ITS#6414) Fixed slapd-null extraneous assert (ITS#6403) Fixed slapo-translucent with back-null (ITS#6403) Fixed slapo-unique criteria checking (ITS#6270) Build Environment Deleted broken LBER_INVALID macro (ITS#6402) Fixed test058 kill usage (ITS#6420) Fixed meta regression test (ITS#6418) Documentation slapd-meta(5) Note deprecated functions (ITS#6424) admin24 fix set example for group of groups (ITS#6382) admin24 fix dynamic group documentation (ITS#6290) OpenLDAP 2.4.20 Release (2009/11/27) Fixed client tools with LDAP options (ITS#6283) Fixed liblber embedded NUL values in BerValues (ITS#6353) Fixed liblber inverted LBER_USE_DER test (ITS#6348) Fixed liblber to return failure on certain failures (ITS#6344) Fixed libldap connection initialization (ITS#6386) Fixed libldap sasl buffer sizing (ITS#6327,ITS#6334) Fixed libldap uninitialized return value (ITS#6355) Fixed libldap unlimited timeout (ITS#6388) Added slapd handling of hex server IDs (ITS#6297) Added slapd syncrepl contextCSN storing in subentry (ITS#6373) Fixed slapd asserts in minimal environment (ITS#6361) Fixed slapd authid-rewrite parsing (ITS#6392) Fixed slapd checks of str2filter (ITS#6391) Fixed slapd configArgs initialization (ITS#6363) Fixed slapd debug handling of LDAP_DEBUG_ANY (ITS#6324) Fixed slapd db_open with connection_fake_init (ITS#6381) Fixed slapd with embedded \0 in bervals (ITS#6378,ITS#6379) Fixed slapd inclusion of ac/unistd.h (ITS#6342) Fixed slapd invalid dn log message (ITS#6309) Fixed slapd lockup on shutdown (ITS#6372) Fixed slapd onetime leak (ITS#6398) Fixed slapd RID range to be decimal only (ITS#6394) Fixed slapd sl_free to better reclaim memory (ITS#6380) Fixed slapd syncrepl deletes in MirrorMode (ITS#6368) Fixed slapd syncrepl to use correct SID (ITS#6367) Fixed slapd termination for one level DNs (ITS#6338) Fixed slapd tls_accept to retry in certain cases (ITS#6304) Fixed slapd-bdb/hdb cache corruption (ITS#6341) Fixed slapd-bdb/hdb entry cache (ITS#6360) Fixed slapd-ldap leak (ITS#6326) Fixed slapd-relay bind segfault (ITS#6337) Fixed slapo-accesslog ensure CSNs are normalized (ITS#6400) Fixed slapo-memberof operational attr updates (ITS#6329) Fixed slapo-pcache entry dupe (ITS#6310) Fixed slapo-syncprov checkpoint conversion (ITS#6370) Fixed slapo-syncprov deadlock (ITS#6335) Fixed slapo-syncprov memory leak (ITS#6376) Fixed slapo-syncprov out of order changes (ITS#6346) Fixed slapo-syncprov psearch with stale cookie (ITS#6397) Build Environment Added additional operations for ITS#6332 Fixed memrchr define (ITS#6351) Fixed slapd MAXPATHLEN handling (ITS#6342) Added test050 rapid add/mod/del sequence (ITS#6368) Fixed test057 handling of memberof/refint (ITS#6343) Fixed slapd test error ignoring (ITS#6345) Fixed liblutil constant (ITS#5909) Documentation admin24 fix RFC4511 and other references (ITS#6399) ldap_get_dn(3) typos (ITS#5366) ldap.conf(5) clarify comment usage (ITS#6384) slapd.conf(5) note hex server IDs (ITS#6297) slapd-config(5) note hex server IDs (ITS#6297) OpenLDAP 2.4.19 Release (2009/10/06) Fixed client tools with null timeouts (ITS#6282) Fixed slapadd to warn about missing attrs for replicas (ITS#6281) Fixed slapd acl cache (ITS#6287) Fixed slapd tools to allow -n for conversion (ITS#6258) Fixed slapd-ldap with null timeouts (ITS#6282) Fixed slapd-ldap with strong binds with relay/translucent (ITS#6296) Fixed slapd-ldif buffer overflow (ITS#6303) Fixed slapo-auditlog comments when modifying (ITS#6286) Fixed slapo-dynlist lock leak (ITS#6308) Fixed slapo-pcache cache corruption (ITS#6242) Fixed slapo-sssvlv sort control dereferencing (ITS#6288) Fixed contrib/autogroup segfaults (ITS#6279) Fixed contrib/nssov getgroupbymembers (ITS#6291) Fixed contrib/smbk5pwd rpath linking (ITS#6323) Build Environment Fixed --enable-deref support (ITS#6311) Fixed contrib/autogroup default libtool path (ITS#6284) Deleted nadf.schema (ITS#6140) OpenLDAP 2.4.18 Release (2009/09/06) Fixed client tools common options (ITS#6049) Fixed liblber speed and other problems (ITS#6215) Added libldap MozNSS PEM support (ITS#6278) Added libldap option for SASL_USERNAME (ITS#6257) Fixed libldap error parsing (ITS#6197) Fixed libldap native getpass usage (ITS#4643) Fixed libldap tls_check_hostname for OpenSSL and MozNSS (ITS#6239) Added slapd tcp buffers support (ITS#6234) Fixed slapd allow mirrormode to be set to FALSE (ITS#5946) Fixed slapd certificate list parsing (ITS#6241) Fixed slapd writers blocking (ITS#6276) Fixed slapd dncachesize behavior to unlimited by default (ITS#6222) Fixed slapd incorrectly applying writetimeout when not set (ITS#6220) Fixed slapd with duplicate empty lines for olcDbConfig (ITS#6240) Fixed slapd server URL matching (ITS#5942) Fixed slapd subordinate needs a suffix (ITS#6216) Fixed slapd syncrepl decrement on possible NULL value (ITS#6256) Fixed slapd tools to properly close database (ITS#6214) Fixed slapd uninitialized SlapReply components (ITS#6101) Fixed slapd-meta starttls with targets (ITS#6190) Fixed slapd-monitor stats with glued subordinates (ITS#6243) Fixed slapd-ndb startup (ITS#6203) Fixed slapd-relay various issues (ITS#6133) Fixed slapd-relay response/cleanup callback mismatch (ITS#6154) Fixed slapd-sql with baseObject query (ITS#6172) Fixed slapd-sql with empty attribute (ITS#6163) Fixed slapo-dynlist uninitialized var (ITS#6266) Fixed slapo-pcache multiple enhancements (ITS#6152,ITS#5178) Fixed slapo-ppolicy updating operational attributes (ITS#6265) Fixed slapo-translucent attribute return (ITS#6254) Fixed slapo-translucent filter matching (ITS#6255) Fixed slapo-translucent to honor sizelimit (ITS#6253) Fixed slapo-unique filter matching (ITS#6077) Fixed tools off by one error (ITS#6233) Fixed tools resource leaks (ITS#6145) Added contrib/allowed (ITS#4730) Fixed contrib/autogroup with RE24 (ITS#6227) Fixed contrib/nss symbols (ITS#6273) Build Environment Tests note which backend is being tested (ITS#5810) Fixed test056-monitor with custom ports (ITS#6213) Documentation admin24 fix broken link (ITS#6264) ldap_open(3) document URI (ITS#6261) ldap_set/get_option(3) SASL/TLS options added (ITS#6260) man page format updates (ITS#6023) OpenLDAP 2.4.17 Release (2009/07/13) Fixed liblber to use ber_strnlen (ITS#6080) Fixed libldap GnuTLS private key init (ITS#6053) Fixed libldap openssl digest initialization (ITS#6192) Fixed libldap tls NULL error messages (ITS#6079) Fixed libldap_r missing stub (ITS#6188) Fixed liblutil opendir/closedir on windows (ITS#6041) Fixed liblutil for _GNU_SOURCE (ITS#5464,ITS#5666) Added slapd sasl auxprop support (ITS#6147) Added slapd schema checking tool (ITS#6150) Added slapd writetimeout keyword (ITS#5836) Fixed slapd abandon/cancel handling for some ops (ITS#6157) Fixed slapd access setstyle to expand (ITS#6179) Fixed slapd assert with closing connections (ITS#6111) Fixed slapd bind race condition (ITS#6189) Fixed slapd cancel behavior (ITS#6137) Fixed slapd cert validation (ITS#6098) Fixed slapd connection_destroy assert (ITS#6089) Fixed slapd csn normalization (ITS#6195) Fixed slapd errno handling (ITS#6037) Fixed slapd global alloc handling (ITS#6054) Fixed slapd hung writers (ITS#5836) Fixed slapd ldapi issues (ITS#6056) Fixed slapd moduleload with static backends and modules (ITS#6016) Fixed slapd normalization of updated schema attributes (ITS#5540) Fixed slapd olcLimits handling (ITS#6159) Fixed slapd olcLogLevel with hex levels (ITS#6162) Fixed slapd pagedresults stacked control with overlays (ITS#6056) Fixed slapd password-hash incorrect limit on arg length (ITS#6139) Fixed slapd readonly restrictions (ITS#6109) Fixed slapd sending cancelled operations results (ITS#6103) Fixed slapd slapi_entry_has_children (ITS#6132) Fixed slapd sockets usage on windows (ITS#6039) Fixed slapd some abandon and cancel race conditions (ITS#6104) Fixed slapd tls context after changes (ITS#6135) Fixed slapd-bdb/hdb adjust dncachesize if too low (ITS#6176) Fixed slapd-bdb/hdb crashes during delete (ITS#6177) Fixed slapd-bdb/hdb multiple olcIndex for same attr (ITS#6196) Fixed slapd-hdb freeing of already freed entries (ITS#6074) Fixed slapd-hdb entryinfo cleanup (ITS#6088) Fixed slapd-hdb dncache lockups (ITS#6095) Fixed slapd-ldap deadlock with non-responsive TLS URIs (ITS#6167) Fixed slapd-relay to return failure on failure (ITS#5328) Fixed slapd-sql with BACKSQL_ARBITRARY_KEY defined (ITS#6100) Fixed slapo-collect collectinfo ordering (ITS#6076) Fixed slapo-collect missing equality match rule (ITS#6075) Fixed slapo-dds entry expiration (ITS#6169) Fixed slapo-perl symbols (ITS#5658) Fixed slapo-ppolicy to honor pwdLockout (ITS#6168) Fixed slapo-ppolicy to return check modules error message (ITS#6082) Fixed slapo-refint refint_repair handling (ITS#6056) Added slapo-rwm rwm-drop-unrequested-attrs config option (ITS#6057) Fixed slapo-rwm dn passing (ITS#6070) Fixed slapo-rwm entry free (ITS#6058) Fixed slapo-rwm entry release (ITS#6081) Fixed slapo-translucent entry gathering (ITS#6156) Fixed tools returning ldif errors (ITS#5892) Fixed contrib/smbk5pwd use of private functions (ITS#5535) Build Environment Added test056-monitor (ITS#5540) Added test057-memberof-refint (ITS#5395) Fixed winsock detection for windows (ITS#6102, ITS#6078) Removed GSSAPI configure option (ITS#6091,ITS#6092,ITS#6093,ITS#5369) Documentation admin24 relocate configuration examples (ITS#6183) admin24 fixed example regex (ITS#6052) admin24 removed temporary back-monitor note (ITS#6130) admin24 slapd.conf to cn=config conversion process (ITS#6060) man page consistency fixes (ITS#6023) ldapcompare(1) note -e option (ITS#6107) ldapdelete(1) note -e option (ITS#6107) ldapmodify(1) note -e option (ITS#6107) ldapmodrdn(1) note -e option (ITS#6107) ldapsearch(1) output format description (ITS#6146) ldapurl(1) note -e option (ITS#6107) ldapwhoami(1) note -e option (ITS#6107) ldap_result(3) Add RETURN VALUE heading (ITS#6180) ldap.conf(5) improve sizelimit/timelimit limits (ITS#6127) slapd.access(5) Fix <setstyle> to use expand (ITS#6179) slapd.conf(5) document default modulepath (ITS#5829) slapd.conf(5) pidfile/argsfile description fix (ITS#5975) slapd-config(5) document default modulepath (ITS#5829) slapd-config(5) pidfile/argsfile description fix (ITS#5975) slapo-constraint(5) clarify URI example (ITS#6118) slapo-unique(5) explicitly note rootdn requirement (ITS#6108) slapadd(8) note it does indexing (ITS#6160) OpenLDAP 2.4.16 Release (2009/04/05) Fixed libldap GnuTLS with x509v1 CA certs (ITS#5992) Fixed libldap GnuTLS with CA chains (ITS#5991) Fixed libldap GnuTLS TLSVerifyClient try (ITS#5981) Fixed libldap segfault in checking cert/DN (ITS#5976) Fixed libldap peer cert double free (ITS#5849) Fixed libldap referral chasing (ITS#5980) Fixed slapd backglue with empty DBs (ITS#5986) Fixed slapd ctxcsn race condition (ITS#6001) Fixed slapd debug message (ITS#6027) Fixed slapd redundant module loading (ITS#6030) Fixed slapd schema_init freed value (ITS#6036) Fixed slapd syncrepl newCookie sync messages (ITS#5972) Fixed slapd syncrepl hang during shutdown (ITS#6011) Fixed slapd syncrepl too many MMR messages (ITS#6020) Fixed slapd syncrepl skipped entries with MMR (ITS#5988) Fixed slapd-bdb/hdb cachesize handling (ITS#5860) Fixed slapd-bdb/hdb with slapcat with empty dn (ITS#6006) Fixed slapd-bdb/hdb with NULL transactions (ITS#6012) Fixed slapd-ldap incorrect referral handling (ITS#6003,ITS#5916) Fixed slapd-ldap/meta with broken AD results (ITS#5977) Fixed slapd-ldap/meta with invalid attrs again (ITS#5959) Fixed slapo-accesslog interaction with ppolicy (ITS#5979) Fixed slapo-dynlist conversion to cn=config (ITS#6002) Fixed slapo-syncprov newCookie sync messages (ITS#5972) Fixed slapd-syncprov too many MMR messages (ITS#6020) Fixed slapo-syncprov replica lockout (ITS#5985) Fixed slapo-syncprov modtarget tracking (ITS#5999) Fixed slapo-syncprov multiple CSN propagation (ITS#5973) Fixed slapo-syncprov race condition (ITS#6045) Fixed slapo-syncprov sending cookies without CSN (ITS#6024) Fixed slapo-syncprov skipped entries with MMR (ITS#5988) Fixed tools passphrase free (ITS#6014) Build Environment Cleaned up alloc/free functions for Windows (ITS#6005) Fixed running of autosave files in testsuite (ITS#6026) Documentation admin24 clarified MMR URI requirements (ITS#5942,ITS#5987) Added ldapexop(1) manual page (ITS#5982) slapd-ldap/meta(5) added missing TLS options (ITS#5989) OpenLDAP 2.4.15 Release (2009/02/24) Fixed libldap alias dereferencing in C API again (ITS#5916) Fixed libldap GnuTLS compilation (ITS#5955) Fixed slapd bconfig conversion again (ITS#5346) Fixed slapd behavior with superior objectClasses again (ITS#5517) Fixed slapd RFC4512 behavior with same attr in RDN (ITS#5968) Fixed slapd corrupt contextCSN (ITS#5947) Fixed slapd syncrepl order to match on add/delete (ITS#5954) Fixed slapd adding rdn with other values (ITS#5965) Fixed slapd-bdb/hdb behavior with unallocatable shm (ITS#5956) Fixed slapd-ldap/meta with entries with invalid attrs (ITS#5959) Fixed slapd-relay control initialization (ITS#5724) Fixed slapo-pcache caching invalid entries (ITS#5927) Fixed slapo-syncprov csn updates (ITS#5969) Fixed slapo-rwm objectClass preservation (ITS#5760) Fixed slapo-rwm rwm_bva_rewrite handling (ITS#5960) Build Environment Fixed tester library linking for windows (ITS#5740) OpenLDAP 2.4.14 Release (2009/02/14) Added libldap option to disable SASL host canonicalization (ITS#5812) Added libldap TLS_PROTOCOL_MIN (ITS#5655) Added libldap GnuTLS support for TLS_CIPHER_SUITE (ITS#5887) Added libldap GnuTLS setting random file (ITS#5462) Added libldap alias dereferencing in C API (ITS#5916) Fixed libldap chasing multiple referrals (ITS#5853) Fixed libldap deref handling (ITS#5768) Fixed libldap NULL pointer deref (ITS#5934) Fixed libldap peer cert memory leak (ITS#5849) Fixed libldap interaction with GnuTLS CN IP-based matches (ITS#5789) Fixed libldap intermediate response behavior (ITS#5896) Fixed libldap IPv6 address handling (ITS#5937) Fixed libldap_r deref building (ITS#5768) Fixed libldap_r slapd lockup when paused during shutdown (ITS#5841) Added slapd syncrepl default retry setting (ITS#5825) Added slapd val.regex expansion (ITS#5804) Added slapd TLS_PROTOCOL_MIN (ITS#5655) Added slapd slapi_pw_find (ITS#2615,ITS#4359) Added slapd compatibility with MSAD ranged values (ITS#5927) Fixed slapd bconfig to return error codes (ITS#5867) Fixed slapd bconfig encoding incorrectly (ITS#5897) Fixed slapd bconfig dangling pointers (ITS#5924) Fixed slapd behavior with superior objectClasses (ITS#5517) Fixed slapd connection assert (ITS#5835) Fixed slapd epoll handling (ITS#5886) Fixed slapd frontend/backend options handling (ITS#5857) Fixed slapd glue with MMR (ITS#5925) Fixed slapd logging on Windows (ITS#5392) Fixed slapd listener comparison (ITS#5613) Fixed slapd manageDSAit with glue entries (ITS#5921) Fixed slapd relax behavior with structuralObjectClass (ITS#5792) Fixed slapd syncrepl rename handling (ITS#5809) Fixed slapd syncrepl MMR when adding new server (ITS#5850) Fixed slapd syncrepl MMR with deleted entries (ITS#5843) Fixed slapd syncrepl replication with glued DB (ITS#5866) Fixed slapd syncrepl replication with moddn (ITS#5901) Fixed slapd syncrepl replication with referrals (ITS#5881) Fixed slapd syncrepl replication with config tree (ITS#5935) Fixed slapd wake_sds close on Windows (ITS#5855) Fixed slapd-bdb/hdb dncachesize handling (ITS#5860) Fixed slapd-bdb/hdb RFC4528 control support (ITS#5861) Fixed slapd-bdb/hdb trickle task usage (ITS#5864) Fixed slapd-hdb idlcache with empty suffix (ITS#5859) Fixed slapd-ldap idassert-bind validity checking (ITS#5863) Fixed slapd-ldap/meta RFC4525 increment support (ITS#5912) Fixed slapd-ldap/meta search dereferencing (ITS#5916) Fixed slapd-ldap/meta with intermediate response (ITS#5931) Fixed slapd-ldif numerous bugs (ITS#5408) Fixed slapd-ldif rename on same DN (ITS#5319) Fixed slapd-ldif deadlock (ITS#5329) Fixed slapd-meta double response sending (ITS#5854) Fixed slapd-meta alias deref for retry (ITS#5889) Fixed slapd-relay recursion detection (ITS#5943) Fixed slapd-sock descriptor leak (ITS#5939) Fixed slapo-accesslog on glued dbs (ITS#5907) Fixed slapo-dynlist handling of flags (ITS#5898) Fixed slapo-memberof multiple instantiation (ITS#5903) Fixed slapo-pcache filter sorting (ITS#5756) Fixed slapo-ppolicy to not be global (ITS#5858) Fixed slapo-rwm double free (ITS#5923) Fixed slapo-rwm with back-config (ITS#5906) Fixed slapo-rwm olcRwmRewrite modification (ITS#5940) Added slapo-rwm newRDN rewriting (ITS#5834) Added slapadd progress meter (ITS#5922) Updated contrib/addpartial module (ITS#5764) Added contrib/cloak module (ITS#5872) Added contrib/smbk5pwd gcrypt support (ITS#5410) Added contrib/passwd sha2 support (ITS#5660) Build Environment Fixed test006 appending to log file (ITS#5910) Fixed test036,test039 behavior on error (ITS#5893) Fixed test048 sed pathname substitution (ITS#5910) Fixed test049,test050 to work on windows (ITS#5842) Updated test017,test018,test019 to cover more cases (ITS#5883) Removed patch for BerkeleyDB 4.7.25 (Official patch available) Fixed MSVC 9.0 build issues (ITS#5888) Fixed gss detection on Solaris (ITS#5846) Fixed uuid_create/uuid_unparse_lower detection (ITS#5905) Fixed liblutil tavl_delete to macroize constants (ITS#5909) Documentation admin24 added limits chapter (ITS#5818) admin24 access-control clarify global ACLS (ITS#5851,ITS#5852) admin24 search on nested naming contexts (ITS#5788) admin24 consistent loglevel documentation (ITS#5904) slapd-bdb/hdb expansion on dncachesize behavior (ITS#5721) slapo-constraint(5) example fix (ITS#5895) slap*(8) man pages should mention slapd-config (ITS#5828) slapacl(8c) fix wording (ITS#5918) slapd(8) document sid (ITS#5873) slapd.access(5) clarify global ACLS (ITS#5851,ITS#5852) slapadd/cat/index(8) note -n 0 for slapd-config (ITS#5891) Added SEE ALSO slapd-config(5) to relevant man pages (ITS#5914) OpenLDAP 2.4.13 Release (2008/11/24) Added libldap dereference control support (ITS#5768) Fixed libldap parameter checking (ITS#5817) Fixed liblutil hex conversion (ITS#5699) Fixed liblutil returning undefined data (ITS#5748) Fixed libldap error code return (ITS#5762) Fixed libldap interaction with GnuTLS CN IP-based matches (ITS#5789) Fixed libldap MAXHOSTNAMELEN typo (ITS#5815) Fixed libldap Ipv6 detection (ITS#5739) Fixed libldap setuid usage with .ldaprc (ITS#4750) Fixed slapacl crasher (ITS#5820) Fixed slapd acl checks on ADD (ITS#4556,ITS#5723) Fixed slapd acl application to newly created backends (ITS#5572) Fixed slapd #if/#elif issues in thread includes (ITS#5824) Added slapd keyword add_content_acl for add checks (ITS#4556,ITS#5723) Fixed slapd concurrent access to connections (ITS#5814) Fixed slapd config backend olcLogFile support (ITS#5765) Fixed slapd contextCSN pending list (ITS#5709) Fixed slapd control criticality (ITS#5785) Added slapd dn.this search limits (ITS#5734) Fixed slapd error status on shutdown (ITS#5745) Fixed slapd filter substring handling (ITS#5803) Fixed slapd nameUIDPretty bitstring parsing (ITS#5750) Fixed slapd null termination of password (ITS#5794) Fixed slapd overlay/database open with real structure (ITS#5724) Fixed slapd parsing of read entry control (ITS#5741) Added slapd PMI schema (ITS#5695) Added slapd private databases in global overlays (ITS#5735,ITS#5736) Fixed slapd rdn generation when it isn't specified (ITS#5819) Fixed slapd slapd.conf validation to LDIF (ITS#5755) Fixed slapd startup scan for CSN (ITS#5640) Fixed slapd statslog printing of released entry (ITS#5775) Added slapd support for certificateListExactMatch (ITS#5700) Fixed slapd syncrepl event loss (ITS#5710) Fixed slapd syncrepl MOD of attrs with no EQ rule (ITS#5781) Fixed slapd syncrepl rename handling (ITS#5809) Fixed slapd syncrepl schema checking (ITS#5798) Fixed slapd syncrepl filter leak (ITS#5826) Fixed slapd undef promote (ITS#5783,ITS#5795) Added slapd What failed? control (ITS#5784) Fixed slapd-bdb/hdb invalid db crash (ITS#5698) Added slapd-bdb/hdb dbpagesize keyword Added slapd-bdb/hdb checksum keyword Fixed slapd-bdb/hdb indexing of entryDN (ITS#5790) Fixed slapd-bdb/hdb lookup of entryDN with equality (ITS#5791) Fixed slapd-bdb/hdb uninitialized bli_flag Fixed slapd-ldap snprintf buffer overflow test (ITS#4467) Fixed slapd-ldap search stop on minor failure (ITS#5816) Fixed slapd-ldif file rename on windows (ITS#5774) Fixed slapd-null read controls support (ITS#5757) Fixed slapd-sql value length with right index (ITS#5779) Fixed slapo-chain/translucent back-config support (ITS#5736) Fixed slapo-chain SEGV with search references (ITS#5742) Fixed slapo-collect compile with C89 (ITS#5747) Added slapo-constraint support for LDAP URI constraints (ITS#5704) Added slapo-constraint support for constraining rename (ITS#5703) Added slapo-constraint support for relax control (ITS#5705) Added slapo-constraint "set" type (ITS#5702) Fixed slapo-constraint filter parsing error (ITS#5751) Added slapo-dynlist URI restriction ability (ITS#5761) Fixed slapo-ppolicy unaligned BerElement (ITS#5770) Fixed slapo-rwm objectClass preservation (ITS#5760) Fixed slapo-rwm rewriting undefined filter (ITS#5731) Fixed slapo-rwm rewritten DN-valued attrs (ITS#5772) Fixed slapo-rwm reusing freed filter (ITS#5732) Fixed slapo-rwm entry get (ITS#5773) Fixed slapo-syncprov runqueue removal (ITS#5776) Fixed slapo-syncprov unreplicatable ops (ITS#5709) Fixed slapo-syncprov psearch leak (ITS#5827) Added slapo-translucent try local bind when remote fails (ITS#5656) Added slapo-translucent support for PasswordModify exop (ITS#5656) Fixed tools simple bind without SASL (ITS#5753) Fixed tools unaligned BerElement (ITS#5770) Fixed contrib nssov crash on empty groups (ITS#5800) Fixed contrib nssov crash with nssov-map (ITS#5801) Fixed contrib nssov filter and search limits (ITS#5802) Added contrib smbk5pwd honor principal expiration (ITS#5766) Build Environment Added ldapurl command Added slapd GSSAPI refactoring (ITS#5369) Added slapo-deref overlay (ITS#5768) Documentation admin24 added olcLimits to example (ITS#5746) admin24 consolidated on whitespace (ITS#5759) slapd.conf,config(5) subordinate/olcSubordinate keyword (ITS#5788) slapd.conf(5) fixed disable keyword for limits (ITS#5821) slapo-dds(5) manageDIT to relax (ITS#5780) slapo-dds(5) rootdn requirement added (ITS#5811) slapo-syncprov(5) sessionlog clarification (ITS#5806) OpenLDAP 2.4.12 Release (2008/10/12) Fixed libldap ldap_utf8_strchar arguments (ITS#5720) Fixed libldap TLS_CRLFILE (ITS#5677) Fixed liblutil executables on Windows (ITS#5604) Fixed liblutil microsecond overflows on Windows (ITS#5668) Fixed librewrite memory handling (ITS#5691) Fixed slapd aci performance (ITS#5636) Fixed slapd aci's with sets (ITS#5627) Fixed slapd attribute leak (ITS#5683) Fixed slapd config backend with index greater than sibs (ITS#5684) Fixed slapd custom attribute inheritance (ITS#5642) Fixed slapd dynacl mask handling (ITS#5637) Fixed slapd firstComponentMatch normalization (ITS#5634) Added slapd caseIgnoreListMatch (ITS#5608) Fixed slapd connection events enabled twice (ITS#5725) Fixed slapd memory handling (ITS#5691) Fixed slapd objectClass canonicalization (ITS#5681) Fixed slapd objectClass termination (ITS#5682) Fixed slapd overlay control registration (ITS#5649) Fixed slapd runqueue checking (ITS#5726) Fixed slapd spurious text output (ITS#5688) Fixed slapd socket closing on Windows (ITS#5606) Fixed slapd sortvals comparison (ITS#5578) Added slapd substitute syntax support (ITS#5663) Fixed slapd syncrepl contextCSN detection (ITS#5675) Fixed slapd syncrepl error logging (ITS#5618) Fixed slapd syncrepl runqueue interval (ITS#5719) Fixed slapd-bdb entry return if attr not present (ITS#5650) Fixed slapd-bdb olcDbMode syntax (ITS#5713) Fixed slapd-bdb/hdb release search entries earlier (ITS#5728,ITS#5730) Fixed slapd-bdb/hdb subtree search with empty suffix (ITS#5729) Fixed slapd-dnssrv memory handling (ITS#5691) Fixed slapd-ldap,slapd-meta invalid filter behavior (ITS#5614) Fixed slapd-meta memory handling (ITS#5691) Fixed slapd-meta objectClass filtering (ITS#5647) Fixed slapd-meta quarantine behavior (ITS#5592) Added slapd-ndb experimental backend Fixed slapd-relay initialization (ITS#5643) Fixed slapd-sql freeing of connection (ITS#5607) Fixed slapd-sql fault on NULL fields (ITS#5653) Fixed slapo-accesslog entryCSN generation on purge (ITS#5694) Fixed slapo-constraint string termination (ITS#5609) Fixed slapo-dynlist expansion with mapped attributes (ITS#5717) Fixed slapo-memberof internal operations DN (ITS#5622) Fixed slapo-pcache attrset crash (ITS#5665) Fixed slapo-pcache caching with invalid schema (ITS#5680) Fixed slapo-ppolicy control return on password modify exop (ITS#5711) Fixed slapo-rwm callback cleanup (ITS#5601,ITS#5687) Fixed slapo-rwm attr mapping and merging (ITS#5624) Fixed slapo-rwm objectClass filtering (ITS#5647) Fixed slapo-translucent back-config support (ITS#5689) Fixed slapo-translucent filter usage on merged entries (ITS#5679) Fixed slapo-unique filter validation (ITS#5581) Fixed slapo-unique suffix testing (ITS#5641) Build Environment Fixed ODBC library detection (ITS#5602) Removed pre-BerkeleyDB 4.4 support Added BerkeleyDB 4.7 support (ITS#5523) Included patch for BerkeleyDB 4.7.25 (build/db.4.7.25.patch) Added slapo-collect overlay with enhancements(ITS#5659) Documentation Added slapd-ldap(5), slapd-meta(5) noundeffilter (ITS#5614) Fixed slapd-ldap(5), slapd-meta(5), slapo-pcache(5) schema requirements (ITS#5680) Added slapo-collect(5) man page (ITS#5706) Added slapo-pcache(5) proxycheckcacheability option (ITS#5680) Added slapo-retcode(5) retcode.conf location (ITS#5633) admin24 dontusecopy control update (ITS#5718) admin24 guide updates (ITS#5616) admin24 octetString fix (ITS#5670) OpenLDAP 2.4.11 Release (2008/07/16) Fixed liblber ber_get_next length decoding (ITS#5580) Added libldap assertion control (ITS#5560) Fixed libldap GnuTLS CRL result handling (ITS#5577) Fixed libldap GnuTLS SSF computation (ITS#5585) Fixed liblutil missing return code (ITS#5615) Fixed slapd cert serial number parsing (ITS#5588) Fixed slapd check for structural_class failures (ITS#5540) Fixed slapd config backend renumbering (ITS#5571) Fixed slapd configContext OID (ITS#5383) Fixed slapd crash with no listeners (ITS#5563) Fixed slapd equality rules for olcRootDN/olcSchemaDN (ITS#5540) Fixed slapd sets memory leak (ITS#5557) Fixed slapd sortvals binary search (ITS#5578) Fixed slapd syncrepl updates with multiple masters (ITS#5597) Fixed slapd syncrepl superior objectClass delete/add (ITS#5600) Fixed slapd syncrepl/slapo-syncprov contextCSN updates as internal ops (ITS#5596) Added slapd-ldap/slapd-meta option to filter out search references (ITS#5593) Fixed slapd-meta link to slapd-ldap (ITS#5355) Fixed slapd-sock, back-shell buffer count (ITS#5558) Fixed slapo-dynlist dg attrs lookup (ITS#5583) Fixed slapo-dynlist entry release (ITS#5135) Fixed slapo-memberof replace handling (ITS#5584) Added slapo-nssov contrib module Fixed slapo-pcache handling of negative search caches (ITS#5546) Fixed slapo-ppolicy DNs with whitespaces (ITS#5552) Fixed slapo-ppolicy modify with internal ops (ITS#5569) Fixed slapo-syncprov ACL evaluation (ITS#5548) Fixed slapo-syncprov crash with delcsn (ITS#5589) Fixed slapo-syncprov full reload (ITS#5564) Fixed slapo-syncprov missing olcSpReloadHint attr(ITS#5591) Fixed slapo-unique filter normalization (ITS#5581) Fixed contrib smbk5pwd terminator (ITS#5575) Build Environment Fixed test048 to skip if threads is not available (ITS#5529) Documentation Added slapo-pcache(5) sizelimit caching (ITS#5559) Added slapd-access(5) add and delete privs (ITS#5566) admin24 GnuTLS documentation (ITS#5554) OpenLDAP 2.4.10 Release (2008/06/08) Fixed libldap file descriptor leak with SELinux (ITS#5507) Fixed libldap ld_defconn cleanup if it was freed (ITS#5518, ITS#5525) Fixed libldap msgid handling (ITS#5318) Fixed libldap t61 infinite loop (ITS#5542) Fixed libldap_r missing stubs (ITS#5519) Fixed slapd initialization of sr_msgid, rs->sr_tag (ITS#5461) Fixed slapd missing termination of integerFilter keys (ITS#5503) Fixed slapd multiple attrs in URI (ITS#5516) Fixed slapd sasl_ssf retrieval (ITS#5403) Fixed slapd socket assert (ITS#5489) Fixed slapd syncrepl cookie (ITS#5536) Fixed slapd-bdb/hdb MAXPATHLEN (ITS#5531) Fixed slapd-bdb indexing in single ADD/MOD (ITS#5521) Fixed slapd-ldap entry_get() op-dependent behavior (ITS#5513) Fixed slapd-meta quarantine crasher (ITS#5522) Fixed slapo-refint to allow setting modifiers name (ITS#5505) Fixed slapo-syncprov contextCSN passing on syncprov consumers (ITS#5488) Fixed slapo-syncprov csn update with delta-syncrepl (ITS#5493) Fixed slapo-syncprov op2.o_extra reset (ITS#5501, #5506) Fixed slapo-syncprov searching wrong backend (ITS#5487) Fixed slapo-syncprov sending ops without queued CSNs (ITS#5465) Fixed slapo-syncprov max csn search on startup (ITS#5537) Fixed slapo-unique config structs (ITS#5526) Fixed slapo-unique filter terminator (ITS#5511) Documentation Add search privileges documentation (ITS#5512) admin24 security document updates (ITS#5524) OpenLDAP 2.4.9 Release (2008/05/07) Fixed libldap to use unsigned port (ITS#5436) Fixed libldap error message for missing close paren (ITS#5458) Fixed libldap_r tpool pause checks (ITS#5364, #5407) Fixed slapcat error checking (ITS#5387) Fixed slapd abstract objectClass inheritance check (ITS#5474) Fixed slapd add operations requiring naming attrs (ITS#5412) Fixed slapd connection handling (ITS#5469) Fixed slapd delta-syncrepl resync (ITS#5378) Fixed slapd frontendDB backend selection (ITS#5419) Fixed slapd pagedresults stale state (ITS#5409) Fixed slapd pointer dereference (ITS#5388) Fixed slapd null argument dereference (ITS#5435) Fixed slapd REP_ENTRY flags (ITS#5340) Fixed slapd sets attribute description parsing (ITS#5402) Fixed slapd syncrepl hang on back-config (ITS#5407) Fixed slapd syncrepl compare_csns crash (ITS#5413) Fixed slapd syncrepl contextCSN update clash (ITS#5426) Fixed slapd syncrepl/glue failure (ITS#5430) Fixed slapd syncrepl crash on empty CSN (ITS#5432) Fixed slapd syncrepl refreshAndPersist (ITS#5454) Fixed slapd syncrepl modrdn processing (ITS#5397) Fixed slapd syncrepl MMR partial refresh (ITS#5470) Fixed slapd value list termination (ITS#5450) Fixed slapd/slapo-accesslog rq mutex usage (ITS#5442) Fixed slapd-bdb ID_NOCACHE handling (ITS#5439) Fixed slapd-bdb entryinfo state if db_lock fails (ITS#5455) Fixed slapd-bdb referral rewrite (ITS#5339) Fixed slapd-config overlay stacking (ITS#5346) Fixed slapd-config attribute publishing (ITS#5383) Fixed slapd-ldap connection handler (ITS#5404) Fixed slapd-ldif file name handling & multi-suffix/dir catch (ITS#5408) Fixed slapd-meta connections on error (ITS#5440) Fixed slapd-meta crash on search (ITS#5481) Fixed slapo-accesslog null callback stack crash (ITS#5490) Fixed slapo-auditlog unnecessary syscall (ITS#5441) Added slapo-dynlist mapping to dynamic attrs generation (ITS#5466) Fixed slapo-refint dnSubtreeMatch (ITS#5427) Fixed slapo-refint global referential integrity (ITS#5428) Fixed slapo-syncprov psearch on closed connection (ITS#5401) Fixed slapo-syncprov psearch task delay (ITS#5405) Fixed slapo-syncprov psearch filter identity (ITS#5418, #5486) Fixed slapo-syncprov/glue contextCSN update (ITS#5433) Fixed slapo-syncprov/glue search ops (ITS#5434) Fixed slapo-syncprov null cookie (ITS#5437,#5444) Fixed slapo-syncprov double-free (ITS#5445) Fixed slapo-syncprov free syncop correctly (ITS#5484) Fixed slapo-syncprov glue deadlock (ITS#5451) Build Environment Fixed leave function naming for OSF1 (ITS#5411) Documentation Fixed slapd.access(5) authz-regexp documented behavior (ITS#5400) Fixed slapd.meta(5) idassert-* documentation (ITS#5406) admin24 delta-syncrepl documentation (ITS#5476) admin24 set documentation (ITS#5278,ITS#5279,ITS#5281) admin24 slapo-ppolicy documentation (ITS#5479) admin24 syncrepl directives update (ITS#5425) OpenLDAP 2.4.8 Release (2008/02/19) Fixed ldapmodify verbose logging (ITS#5247) Fixed ldapdelete with sizelimit (ITS#5294) Fixed ldapdelete with subentries control (ITS#5293) Fixed ldapsearch exit code init (ITS#5317) Fixed libldap extended decoding (ITS#5304) Fixed libldap filter abort (ITS#5300) Fixed libldap ldap_parse_sasl_bind_result (ITS#5263) Fixed libldap result codes for open (ITS#5338) Fixed libldap search timeout crash (ITS#5291) Fixed libldap paged results crash (ITS#5315) Fixed libldap cipher suite with GnuTLS (ITS#5341) Fixed slapd support for 2.1 CSN (ITS#5348) Fixed slapd include handling (ITS#5276) Fixed slapd modrdn check for valid new DN (ITS#5344) Fixed slapd multi-step SASL binds (ITS#5298) Fixed slapd non-atomic signal variables (ITS#5248) Fixed slapd overlay ordering when moving to slapd.d (ITS#5284) Fixed slapd NULL printf (ITS#5264) Fixed slapd NULL set values (ITS#5286) Fixed slapd SEGV with SASL/OTP (ITS#5259) Fixed slapd timestamp race condition (ITS#5370) Fixed slapd cn=config crash on delete (ITS#5343) Fixed slapd cn=config global acls (ITS#5352) Fixed slapd truncated cookie (ITS#5362) Fixed slapd sasl with CLEARTEXT (ITS#5368) Fixed slapd str2entry with no attrs (ITS#5308) Fixed slapd TLSVerifyClient default (ITS#5360) Fixed slapd HAVE_TLS dependency (ITS#5379) Fixed slapd delta-syncrepl refresh mode (ITS#5376) Fixed slapd ACL sets URI attrs (ITS#5384) Fixed slapd invalid entryUUID filter (ITS#5386) Fixed slapd-bdb idlcache on adds (ITS#5086) Fixed slapd-bdb crash with modrdn (ITS#5358) Fixed slapd-bdb SEGV with bdb4.6 (ITS#5322) Fixed slapd-bdb modrdn to same dn (ITS#5319) Fixed slapd-bdb MMR (ITS#5332) Added slapd-bdb/slapd-hdb DB encryption (ITS#5359) Fixed slapd-ldif delete (ITS#5265) Fixed slapd-meta link to slapd-ldap (ITS#5355) Fixed slapd-meta setting of sm_nvalues (ITS#5375) Fixed slapd-monitor crash (ITS#5311) Fixed slapd-relay compare (ITS#4937) Added slapd-sock (ITS#4094) Fixed slapo-accesslog cleanup on successful response (ITS#5374) Added slapo-autogroup contrib module (ITS#5145) Added slapo-constraint cross-attribute constraints (ITS#4987) Fixed slapo-memberof objectClass inheritance (ITS#5299) Added slapo-memberof global overlay support (ITS#5301) Fixed slapo-memberof leak (ITS#5302) Fixed slapo-ppolicy only password check with policy (ITS#5285) Fixed slapo-ppolicy del/replace password without new one (ITS#5373) Fixed slapo-syncprov hang on checkpoint (ITS#5261) Added slapo-translucent local searching (ITS#5283) Removed lint Build Environment Fixed libldap_r threaded library linking (ITS#4982) Fixed libldap use of %n (ITS#5324) Fixed test047 to skip if rwm is not available (ITS#5292) Documentation DB_CONFIG.example URL wrong in comments (ITS#5288) Add cn=config example for auditlog (ITS#5245) ldapmodify(1) clarification for RFC2849 (ITS#5312) OpenLDAP 2.4.7 Release (2007/12/14) Added slapd ordered indexing of integer attributes (ITS#5239) Fixed slapd paged results control handling (ITS#5191) Fixed slapd sasl-host parsing (ITS#5209) Fixed slapd filter normalization (ITS#5212) Fixed slapd multiple suffix checking (ITS#5186) Fixed slapd paged results handling when using rootdn (ITS#5230) Fixed slapd syncrepl presentlist handling (ITS#5231) Fixed slapd core schema 'c' definition for RFC4519 (ITS#5236) Fixed slapd 3-way Multi-Master Replication (ITS#5238) Fixed slapd hash collisions in index slots (ITS#5183) Fixed slapd replication of dSAOperation attributes (ITS#5268) Fixed slapadd contextCSN updating (ITS#5225) Fixed slapd-bdb/hdb to report and fail on internal errors (ITS#5232) Fixed slapd-bdb/hdb dn2entry lock bug (ITS#5257) Fixed slapd-bdb/hdb dn2id lock bug (ITS#5262) Fixed slapd-hdb caching on rename ops (ITS#5221) Fixed slapo-accesslog abandoned op cleanup (ITS#5161) Fixed slapo-dds deleting from nonexistent db (ITS#5267) Fixed slapo-memberOf deleted values saving (ITS#5258) Fixed slapo-pcache op->o_abandon handling (ITS#5187) Fixed slapo-ppolicy single password check on modify (ITS#5146) Fixed slapo-ppolicy internal search (ITS#5235) Fixed slapo-syncprov refresh and persist cookie sending (ITS#5210) Fixed slapo-syncprov ignore invalid cookies (ITS#5211) Fixed slapo-translucent interaction with slapo-rwm (ITS#4889) Updated contrib addpartial module (ITS#3593) Build Environment Fixed liblber socket library linking (ITS#5224) Fixed Windows slapd.def rules (ITS#5215) Documentation Fixed grammar errors (ITS#5223) Refint overlay doc contribution (ITS#5217) Dynamic Lists doc contribution to the admin guide (ITS#5216) Fixed ldappasswd(1) and ldapmodify(1) typos (ITS#5269) Fixed domain factor typos (ITS#5237) Fixed slapd.conf(5) maxderefdepth default value typo (ITS#5200) Clarified slapd.conf(5) limits issues in syncrepl (ITS#5243) Fixed slapd-config(5) maxderefdepth default value typo (ITS#5200) Patches for minor typos in man pages (ITS#5228) admin24/replication.sdf spelling (ITS#5270) OpenLDAP 2.4.6 Release (2007/10/31) Initial release for "general use". PK �M�\�ѥ� � & doc/alt-openldap11-2.4.46/ANNOUNCEMENTnu �[��� A N N O U N C E M E N T -- OpenLDAP 2.4 The OpenLDAP Project is pleased to announce the availability of OpenLDAP Software 2.4, a suite of the Lightweight Directory Access Protocol (v3) servers, clients, utilities, and development tools. This release contains the following major enhancements: * Slapd(8) enhancements - Syncrepl enhancements, including push-mode and Multi-Master support - Dynamic configuration enhancements, including online schema editing and full access control - Dynamic monitoring enhancements, including cache usage information * New overlays - Attribute value constraints - Dynamic Directory Services (RFC2589) - Reverse Group Membership maintenance (memberof) * Clients and tools - Full support of request/response controls - New ldapexop tool for arbitrary extend operations - Support of DNS SRV records for default server * Significant performance enhancements throughout the client and server code base * Multiple new features in libldap and liblber * Expanded documentation - Function-complete manual pages - Numerous new examples in the Admin Guide This release includes the following major components: * slapd - a stand-alone LDAP directory server * -lldap - a LDAP client library * -llber - a lightweight BER/DER encoding/decoding library * LDIF tools - data conversion tools for use with slapd * LDAP tools - A collection of command line LDAP utilities * Admin Guide, Manual Pages - associated documentation In addition, there are some contributed components: * LDAPC++ - a LDAP C++ SDK * Various slapd modules and slapi plugins ACKNOWLEDGEMENTS OpenLDAP Software is developed by the OpenLDAP Project. The Project consists of a team of volunteers who use the Internet to coordinate their activities. The Project is an organized activity of the OpenLDAP Foundation. OpenLDAP Software is derived from University of Michigan LDAP, release 3.3. AVAILABILITY This software is available under the OpenLDAP Public License, an non-restrictive, "free", open-source license. Download information is available at: http://www.OpenLDAP.org/software/download/ SUPPORT OpenLDAP Software is user supported: http://www.openldap.org/support/ The OpenLDAP Administrator's Guide, which includes quick start instructions, is available at: http://www.openldap.org/doc/admin/ The project maintains a FAQ which you may find useful: http://www.openldap.org/faq/ In addition, there are also a number of discussion lists related to OpenLDAP Software. A list of mailing lists is available at: http://www.OpenLDAP.org/lists/ To report bugs, please use project's Issue Tracking System: http://www.openldap.org/its/ The OpenLDAP home page containing lots of interesting information and online documentation is available at this URL: http://www.OpenLDAP.org/ SUPPORTED PLATFORMS This release has been ported to many UNIX (and UNIX-like) platforms including Darwin, FreeBSD, Linux, NetBSD, OpenBSD and most commercial UNIX systems. The release has also been ported (in part or in whole) to other platforms including Apple MacOS X, IBM zOS, and Microsoft Windows NT/2000/etc. --- OpenLDAP is a registered trademark of the OpenLDAP Foundation. Copyright 1999-2018 The OpenLDAP Foundation, Redwood City, California, USA. All Rights Reserved. Permission to copy and distribute verbatim copies of this document is granted. PK �M�\�1�L� � doc/alt-openldap11-2.4.46/READMEnu �[��� OpenLDAP 2.4 README For a description of what this distribution contains, see the ANNOUNCEMENT file in this directory. For a description of changes from previous releases, see the CHANGES file in this directory. This is 2.4 release, it includes significant changes from prior releases. REQUIRED SOFTWARE Building OpenLDAP Software requires a number of software packages to be preinstalled. Additional information regarding prerequisite software can be found in the OpenLDAP Administrator's Guide. Base system (libraries and tools): Standard C compiler (required) Cyrus SASL 2.1.21+ (recommended) OpenSSL 0.9.7+ (recommended) Reentrant POSIX REGEX software (required) SLAPD: BDB and HDB backends require Oracle Berkeley DB 4.4 - 4.8, or 5.0 - 5.1. It is highly recommended to apply the patches from Oracle for a given release. CLIENTS/CONTRIB ware: Depends on package. See per package README. MAKING AND INSTALLING THE DISTRIBUTION Please see the INSTALL file for basic instructions. More detailed instructions can be found in the OpenLDAP Admnistrator's Guide (see DOCUMENTATION section). DOCUMENTATION The OpenLDAP Administrator's Guide is available in the guide.html file in the doc/guide/admin directory. The guide and a number of other documents are available at <http://www.openldap.org/doc/admin/guide.html>. The distribution also includes manual pages for most programs and library APIs. See ldap(3) for details. The OpenLDAP website is available and contains the latest LDAP news, releases announcements, pointers to other LDAP resources, etc.. It is located at <http://www.OpenLDAP.org/>. The OpenLDAP Software FAQ is available at <http://www.openldap.org/faq/>. SUPPORT / FEEDBACK / PROBLEM REPORTS / DISCUSSIONS OpenLDAP Software is user supported. If you have problems, please review the OpenLDAP FAQ <http://www.openldap.org/faq/> and archives of the OpenLDAP-software and OpenLDAP-bugs mailing lists <http://www.openldap.org/lists/>. If you cannot find the answer, please enquire on the OpenLDAP-software list. Issues, such as bug reports, should be reported using our Issue Tracking System <http://www.OpenLDAP.org/its/>. Do not use this system for software enquiries. Please direct these to an appropriate mailing list. CONTRIBUTING See <http://www.openldap.org/devel/contributing.html> for information regarding how to contribute code or documentation to the OpenLDAP Project for inclusion in OpenLDAP Software. While you are encouraged to coordinate and discuss the development activities on the <openldap-devel@openldap.org> mailing list prior to submission, it is noted that contributions must be submitted using the Issue Tracking System <http://www.openldap.org/its/> to be considered. --- $OpenLDAP$ This work is part of OpenLDAP Software <http://www.openldap.org/>. Copyright 1998-2018 The OpenLDAP Foundation. All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted only as authorized by the OpenLDAP Public License. A copy of this license is available in the file LICENSE in the top-level directory of the distribution or, alternatively, at <http://www.OpenLDAP.org/license.html>. OpenLDAP is a registered trademark of the OpenLDAP Foundation. PK �f�\���: doc/alt-libssh2-1.8.0/ChangeLognu �[��� see NEWS PK �f�\���^ ^ doc/alt-libssh2-1.8.0/COPYINGnu �[��� /* Copyright (c) 2004-2007 Sara Golemon <sarag@libssh2.org> * Copyright (c) 2005,2006 Mikhail Gusarov <dottedmag@dottedmag.net> * Copyright (c) 2006-2007 The Written Word, Inc. * Copyright (c) 2007 Eli Fant <elifantu@mail.ru> * Copyright (c) 2009-2014 Daniel Stenberg * Copyright (C) 2008, 2009 Simon Josefsson * All rights reserved. * * Redistribution and use in source and binary forms, * with or without modification, are permitted provided * that the following conditions are met: * * Redistributions of source code must retain the above * copyright notice, this list of conditions and the * following disclaimer. * * Redistributions in binary form must reproduce the above * copyright notice, this list of conditions and the following * disclaimer in the documentation and/or other materials * provided with the distribution. * * Neither the name of the copyright holder nor the names * of any other contributors may be used to endorse or * promote products derived from this software without * specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND * CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE * USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY * OF SUCH DAMAGE. */ PK �f�\�Ee?� � doc/alt-libssh2-1.8.0/READMEnu �[��� libssh2 - SSH2 library ====================== libssh2 is a library implementing the SSH2 protocol, available under the revised BSD license. Web site: https://www.libssh2.org/ Mailing list: https://cool.haxx.se/mailman/listinfo/libssh2-devel License: see COPYING Source code: https://github.com/libssh2/libssh2 Web site source code: https://github.com/libssh2/www Installation instructions are in: - docs/INSTALL_CMAKE for CMake - docs/INSTALL_AUTOTOOLS for Autotools PK �f�\��G�N� N� doc/alt-libssh2-1.8.0/NEWSnu �[��� Changelog for the libssh2 project. Generated with git2news.pl Version 1.8.0 (25 Oct 2016) Daniel Stenberg (25 Oct 2016) - RELEASE-NOTES: adjusted for 1.8.0 Kamil Dudka (20 Oct 2016) - Revert "aes: the init function fails when OpenSSL has AES support" This partially reverts commit f4f2298ef3635acd031cc2ee0e71026cdcda5864 because it caused the compatibility code to call initialization routines redundantly, leading to memory leakage with OpenSSL 1.1 and broken curl test-suite in Fedora: 88 bytes in 1 blocks are definitely lost in loss record 5 of 8 at 0x4C2DB8D: malloc (vg_replace_malloc.c:299) by 0x72C607D: CRYPTO_zalloc (mem.c:100) by 0x72A2480: EVP_CIPHER_meth_new (cmeth_lib.c:18) by 0x4E5A550: make_ctr_evp.isra.0 (openssl.c:407) by 0x4E5A8E8: _libssh2_init_aes_ctr (openssl.c:471) by 0x4E5BB5A: libssh2_init (global.c:49) Daniel Stenberg (19 Oct 2016) - [Charles Collicutt brought this change] libssh2_wait_socket: Fix comparison with api_timeout to use milliseconds (#134) Fixes #74 - [Charles Collicutt brought this change] Set err_msg on _libssh2_wait_socket errors (#135) - Revert "travis: Test mbedtls too" This reverts commit 3e6de50a24815e72ec5597947f1831f6083b7da8. Travis doesn't seem to support the mbedtls-dev package - maketgz: support "only" to only update version number locally and fix the date output locale - configure: make the --with-* options override the OpenSSL default ... previously it would default to OpenSSL even with the --with-[crypto] options used unless you specificly disabled OpenSSL. Now, enabling another backend will automatically disable OpenSSL if the other one is found. - [Keno Fischer brought this change] docs: Add documentation on new cmake/configure options - [Keno Fischer brought this change] configure: Add support for building with mbedtls - [wildart brought this change] travis: Test mbedtls too - [wildart brought this change] crypto: add support for the mbedTLS backend Closes #132 - [wildart brought this change] cmake: Add CLEAR_MEMORY option, analogously to that for autoconf - README.md: fix link typo - README: markdown version to look nicer on github Viktor Szakats (5 Sep 2016) - [Taylor Holberton brought this change] openssl: add OpenSSL 1.1.0 compatibility Daniel Stenberg (4 Sep 2016) - [Antenore Gatta brought this change] tests: HAVE_NETINET_IN_H was not defined correctly (#127) Fixes #125 - SECURITY: fix web site typo - SECURITY: security process GitHub (14 Aug 2016) - [Alexander Lamaison brought this change] Basic dockerised test suite. This introduces a test suite for libssh2. It runs OpenSSH in a Docker container because that works well on Windows (via docker-machine) as well as Linux. Presumably it works on Mac too with docker-machine, but I've not tested that. Because the test suite is docker-machine aware, you can also run it against a cloud provider, for more realistic network testing, by setting your cloud provider as your active docker machine. The Appveyor CI setup in this commit does that because Appveyor doesn't support docker locally. Kamil Dudka (3 Aug 2016) - [Viktor Szakats brought this change] misc.c: Delete unused static variables Closes #114 Daniel Stenberg (9 Apr 2016) - [Will Cosgrove brought this change] Merge pull request #103 from willco007/patch-2 Fix for security issue CVE-2016-0787 Alexander Lamaison (2 Apr 2016) - [Zenju brought this change] Fix MSVC 14 compilation errors For _MSC_VER == 1900 these macros are not needed and create problems: 1>C:\Program Files (x86)\Windows Kits\10\Include\10.0.10240.0\ucrt\stdio.h(1925): warning C4005: 'snprintf': macro redefinition (compiling source file libssh2-files\src\mac.c) 1> \win32\libssh2_config.h(27): note: see previous definition of 'snprintf' (compiling source file libssh2-files\src\mac.c) 1>C:\Program Files (x86)\Windows Kits\10\Include\10.0.10240.0\ucrt\stdio.h(1927): fatal error C1189: #error: Macro definition of snprintf conflicts with Standard Library function declaration (compiling source file libssh2-files\src\mac.c) Daniel Stenberg (26 Mar 2016) - [Brad Harder brought this change] _libssh2_channel_open: speeling error fixed in channel error message Alexander Lamaison (15 Mar 2016) - Link with crypt32.lib on Windows. Makes linking with static OpenSSL work again. Although it's not required for dynamic OpenSSL, it does no harm. Fixes #98. - [Craig A. Berry brought this change] Tweak VMS help file building. Primarily this is handling cases where top-level files moved into the docs/ directory. I also corrected a typo and removed the claim that libssh2 is public domain. - [Craig A. Berry brought this change] Build with standard stat structure on VMS. This gets us large file support, is available on any VMS release in the last decade and more, and gives stat other modern features such as 64-bit ino_t. - [Craig A. Berry brought this change] Update vms/libssh2_config.h. VMS does have stdlib.h, gettimeofday(), and OpenSSL. The latter is appropriate to hard-wire in the configuration because it's installed by default as part of the base operating system and there is currently no libgcrypt port. - [Craig A. Berry brought this change] VMS can't use %zd for off_t format. %z is a C99-ism that VMS doesn't currently have; even though the compiler is C99-compliant, the library isn't quite. The off_t used for the st_size element of the stat can be 32-bit or 64-bit, so detect what we've got and pick a format accordingly. - [Craig A. Berry brought this change] Normalize line endings in libssh2_sftp_get_channel.3. Somehow it got Windows-style CRLF endings so convert to just LF, for consistency as well as not to confuse tools that will regard the \r as content (e.g. the OpenVMS help librarian). Dan Fandrich (29 Feb 2016) - libgcrypt: Fixed a NULL pointer dereference on OOM Daniel Stenberg (24 Feb 2016) - [Viktor Szakats brought this change] url updates, HTTP => HTTPS Closes #87 Dan Fandrich (23 Feb 2016) - RELEASE-NOTES: removed some duplicated names Version 1.7.0 (23 Feb 2016) Daniel Stenberg (23 Feb 2016) - web: the site is now HTTPS - RELEASE-NOTES: 1.7.0 release - diffie_hellman_sha256: convert bytes to bits As otherwise we get far too small numbers. Reported-by: Andreas Schneider CVE-2016-0787 Alexander Lamaison (18 Feb 2016) - Allow CI failures with VS 2008 x64. Appveyor doesn't support this combination. Daniel Stenberg (16 Feb 2016) - [Viktor Szakats brought this change] GNUmakefile: list system libs after user libs Otherwise some referenced WinSock functions will fail to resolve when linking against LibreSSL 2.3.x static libraries with mingw. Closes #80 - [Viktor Szakats brought this change] openssl: apply new HAVE_OPAQUE_STRUCTS macro Closes #81 - [Viktor Szakats brought this change] openssl: fix LibreSSL support after OpenSSL 1.1.0-pre1/2 support Alexander Lamaison (14 Feb 2016) - sftp.h: Fix non-C90 type. uint64_t does not exist in C90. Use libssh2_uint64_t instead. - Exclude sshd tests from AppVeyor. They fail complaining that sshd wasn't invoked with an absolute path. - Test on more versions of Visual Studio. - Fix Appveyor builds. Daniel Stenberg (14 Feb 2016) - [Viktor Szakats brought this change] openssl: add OpenSSL 1.1.0-pre3-dev compatibility by using API instead of accessing an internal structure. Closes #83 - RELEASE-NOTES: synced with 996b04ececdf - include/libssh2.h: next version is 1.7.0 - configure: build "silent" if possible - sftp: re-indented some minor stuff - [Jakob Egger brought this change] sftp.c: ensure minimum read packet size For optimum performance we need to ensure we don't request tiny packets. - [Jakob Egger brought this change] sftp.c: Explicit return values & sanity checks - [Jakob Egger brought this change] sftp.c: Check Read Packet File Offset This commit adds a simple check to see if the offset of the read request matches the expected file offset. We could try to recover, from this condition at some point in the future. Right now it is better to return an error instead of corrupted data. - [Jakob Egger brought this change] sftp.c: Don't return EAGAIN if data was written to buffer - [Jakob Egger brought this change] sftp.c: Send at least one read request before reading This commit ensures that we have sent at least one read request before we try to read data in sftp_read(). Otherwise sftp_read() would return 0 bytes (indicating EOF) if the socket is not ready for writing. - [Jakob Egger brought this change] sftp.c: stop reading when buffer is full Since we can only store data from a single chunk in filep, we have to stop receiving data as soon as the buffer is full. This adresses the following bug report: https://github.com/libssh2/libssh2/issues/50 Salvador Fandiño (21 Jan 2016) - agent_disconnect_unix: unset the agent fd after closing it "agent_disconnect_unix", called by "libssh2_agent_disconnect", was leaving the file descriptor in the agent structure unchanged. Later, "libssh2_agent_free" would call again "libssh2_agent_disconnect" under the hood and it would try to close again the same file descriptor. In most cases that resulted in just a harmless error, but it is also possible that the file descriptor had been reused between the two calls resulting in the closing of an unrelated file descriptor. This patch sets agent->fd to LIBSSH2_INVALID_SOCKET avoiding that issue. Signed-off-by: Salvador Fandiño <sfandino@yahoo.com> Daniel Stenberg (18 Jan 2016) - [Patrick Monnerat brought this change] os400qc3: support encrypted private keys PKCS#8 EncryptedPrivateKeyinfo structures are recognized and decoded to get values accepted by the Qc3 crypto library. - [Patrick Monnerat brought this change] os400qc3: New PKCS#5 decoder The Qc3 library is not able to handle PKCS#8 EncryptedPrivateKeyInfo structures by itself. It is only capable of decrypting the (encrypted) PrivateKeyInfo part, providing a key encryption key and an encryption algorithm are given. Since the encryption key and algorithm description part in a PKCS#8 EncryptedPrivateKeyInfo is a PKCS#5 structure, such a decoder is needed to get the derived key method and hash, as well as encryption algorith and initialisation vector. - [Patrick Monnerat brought this change] os400qc3: force continuous update on non-final hash/hmac computation - [Patrick Monnerat brought this change] os400qc3: Be sure hmac keys have a minimum length The Qc3 library requires a minimum key length depending on the target hash algorithm. Append binary zeroes to the given key if not long enough. This matches RFC 2104 specifications. - [Patrick Monnerat brought this change] os400qc3: Slave descriptor for key encryption key The Qc3 library requires the key encryption key to exist as long as the encrypted key is used. Its descriptor token is then kept as an "encrypted key slave" for recursive release. - [Patrick Monnerat brought this change] os400qc3.c: comment PEM/DER decoding - [Patrick Monnerat brought this change] os400qc3.c: improve ASN.1 header byte checks - [Patrick Monnerat brought this change] os400qc3.c: improve OID matching - [Patrick Monnerat brought this change] os400: os400qc3.c: replace malloc by LIBSSH2_ALLOC or alloca where possible - [Patrick Monnerat brought this change] os400: asn1_new_from_bytes(): use data from a single element only - [Patrick Monnerat brought this change] os400: fix an ILE/RPG prototype - [Patrick Monnerat brought this change] os400: implement character encoding conversion support - [Patrick Monnerat brought this change] os400: do not miss some external prototypes Build procedure extproto() did not strip braces from header files, thus possibly prepended them to true prototypes. This prevented the prototype to be recognized as such. The solution implemented here is to map braces to semicolons, effectively considering them as potential prototype delimiters. - [Patrick Monnerat brought this change] os400: Really add specific README - [Patrick Monnerat brought this change] os400: Add specific README and include new files in dist tarball - [Patrick Monnerat brought this change] os400: add compilation scripts - [Patrick Monnerat brought this change] os400: include files for ILE/RPG In addition, file os400/macros.h declares all procedures originally defined as macros. It must not be used for real inclusion and is only intended to be used as a `database' for macro wrapping procedures generation. - [Patrick Monnerat brought this change] os400: add supplementary header files/wrappers. Define configuration. - [Patrick Monnerat brought this change] Protect callback function calls from macro substitution Some structure fields holding callback addresses have the same name as the underlying system function (connect, send, recv). Set parentheses around their reference to suppress a possible macro substitution. Use a macro for connect() on OS/400 to resolve a const/nonconst parameter problem. - [Patrick Monnerat brought this change] Add interface for OS/400 crypto library QC3 - [Patrick Monnerat brought this change] misc: include stdarg.h for debug code - [Patrick Monnerat brought this change] Document crypto library interface - [Patrick Monnerat brought this change] Feature an optional crypto-specific macro to rsa sign a data fragment vector OS/400 crypto library is unable to sign a precomputed SHA1 hash: however it does support a procedure that hashes data fragments and rsa signs. If defined, the new macro _libssh2_rsa_sha1_signv() implements this function and disables use of _libssh2_rsa_sha1_sign(). The function described above requires that the struct iovec unused slacks are cleared: for this reason, macro libssh2_prepare_iovec() has been introduced. It should be defined as empty for crypto backends that are not sensitive to struct iovec unused slack values. - [Patrick Monnerat brought this change] Fold long lines in include files - [Viktor Szakats brought this change] kex.c: fix indentation Closes #71 - [Viktor Szakats brought this change] add OpenSSL-1.1.0-pre2 compatibility Closes #70 - [Viktor Szakats brought this change] add OpenSSL 1.1.0-pre1 compatibility * close https://github.com/libssh2/libssh2/issues/69 * sync a declaration with the rest of similar ones * handle EVP_MD_CTX_new() returning NULL with OpenSSL 1.1.0 * fix potential memory leak with OpenSSL 1.1.0 in _libssh2_*_init() functions, when EVP_MD_CTX_new() succeeds, but EVP_DigestInit() fails. Marc Hoersken (22 Dec 2015) - wincng.c: fixed _libssh2_wincng_hash_final return value _libssh2_wincng_hash_final was returning the internal BCRYPT status code instead of a valid libssh2 return value (0 or -1). This also means that _libssh2_wincng_hash never returned 0. - wincng.c: fixed possible memory leak in _libssh2_wincng_hash If _libssh2_wincng_hash_update failed _libssh2_wincng_hash_final would never have been called before. Reported by Zenju. Kamil Dudka (15 Dec 2015) - [Paul Howarth brought this change] libssh2.pc.in: fix the output of pkg-config --libs ... such that it does not include LDFLAGS used to build libssh2 itself. There was a similar fix in the curl project long time ago: https://github.com/bagder/curl/commit/curl-7_19_7-56-g4c8adc8 Bug: https://bugzilla.redhat.com/1279966 Signed-off-by: Kamil Dudka <kdudka@redhat.com> Marc Hoersken (6 Dec 2015) - hostkey.c: align code path of ssh_rsa_init to ssh_dss_init - hostkey.c: fix invalid memory access if libssh2_dsa_new fails Reported by dimmaq, fixes #66 Daniel Stenberg (3 Nov 2015) - [Will Cosgrove brought this change] gcrypt: define libssh2_sha256_ctx Looks like it didn't make it into the latest commit for whatever reason. Closes #58 - [Salvador Fandino brought this change] libssh2_session_set_last_error: Add function Net::SSH2, the Perl wrapping module for libssh2 implements several features* on top of libssh2 that can fail and so need some mechanism to report the error condition to the user. Until now, besides the error state maintained internally by libssh2, another error state was maintained at the Perl level for every session object and then additional logic was used to merge both error states. That is a maintenance nighmare, and actually there is no way to do it correctly and consistently. In order to allow the high level language to add new features to the library but still rely in its error reporting features the new function libssh2_session_set_last_error (that just exposses _libssh2_error_flags) is introduced. *) For instance, connecting to a remote SSH service giving the hostname and port. Signed-off-by: Salvador Fandino <sfandino@yahoo.com> Signed-off-by: Salvador Fandiño <sfandino@yahoo.com> - [Salvador Fandino brought this change] _libssh2_error: Support allocating the error message Before this patch "_libssh2_error" required the error message to be a static string. This patch adds a new function "_libssh2_error_flags" accepting an additional "flags" argument and specifically the flag "LIBSSH2_ERR_FLAG_DUP" indicating that the passed string must be duplicated into the heap. Then, the method "_libssh2_error" has been rewritten to use that new function under the hood. Signed-off-by: Salvador Fandino <sfandino@yahoo.com> Signed-off-by: Salvador Fandiño <sfandino@yahoo.com> - [Will Cosgrove brought this change] added engine.h include to fix warning - [sune brought this change] kex.c: removed dupe entry from libssh2_kex_methods[] Closes #51 - [Salvador Fandiño brought this change] userauth: Fix off by one error when reading public key file After reading the public key from file the size was incorrectly decremented by one. This was usually a harmless error as the last character on the public key file is an unimportant EOL. But if due to some error the public key file is empty, the public key size becomes (uint)(0 - 1), resulting in an unrecoverable out of memory error later. Signed-off-by: Salvador Fandi??o <sfandino-/E1597aS9LQAvxtiuMwx3w@public.gmane.org> - [Salvador Fandino brought this change] channel: Detect bad usage of libssh2_channel_process_startup A common novice programmer error (at least among those using the wrapping Perl module Net::SSH2), is to try to reuse channels. This patchs detects that incorrect usage and fails with a LIBSSH2_ERROR_BAD_USE error instead of hanging. Signed-off-by: Salvador Fandino <sfandino-/E1597aS9LQAvxtiuMwx3w@public.gmane.org> - [Will Cosgrove brought this change] kex: Added diffie-hellman-group-exchange-sha256 support ... and fixed HMAC_Init depricated usage Closes #48 Alexander Lamaison (21 Sep 2015) - Prefixed new #defines to prevent collisions. Other libraries might have their own USE_WIN32_*FILES. - [keith-daigle brought this change] Update examples/scp.c to fix bug where large files on win32 would cause got to wrap and go negative - [David Byron brought this change] add libssh2_scp_recv2 to support large (> 2GB) files on windows Daniel Stenberg (17 Sep 2015) - [sune brought this change] WinCNG: support for SHA256/512 HMAC Closes #47 - [brian m. carlson brought this change] Add support for HMAC-SHA-256 and HMAC-SHA-512. Implement support for these algorithms and wire them up to the libgcrypt and OpenSSL backends. Increase the maximum MAC buffer size to 64 bytes to prevent buffer overflows. Prefer HMAC-SHA-256 over HMAC-SHA-512, and that over HMAC-SHA-1, as OpenSSH does. Closes #40 - [Zenju brought this change] kex: free server host key before allocating it (again) Fixes a memory leak when Synology server requests key exchange Closes #43 - [Viktor Szakats brought this change] GNUmakefile: up OpenSSL version closes #23 - [Viktor Szakats brought this change] GNUmakefile: add -m64 CFLAGS when targeting mingw64, add -m32/-m64 to LDFLAGS libssh2 equivalent of curl patch https://github.com/bagder/curl/commit/d21b66835f2af781a3c2a685abc92ef9f0cd86be This allows to build for the non-default target when using a multi-target mingw distro. Also bump default OpenSSL dependency path to 1.0.2c. - [Viktor Szakats brought this change] GNUmakefile: add support for LIBSSH2_LDFLAG_EXTRAS It is similar to existing LIBSSH2_CFLAG_EXTRAS, but for extra linker options. Also delete some line/file ending whitespace. closes #27 - [nasacj brought this change] hostkey.c: Fix compiling error when OPENSSL_NO_MD5 is defined Closes #32 - [Mizunashi Mana brought this change] openssl.h: adjust the rsa/dsa includes ... to work when built without DSA support. Closes #36 Alexander Lamaison (26 Jul 2015) - Let CMake build work as a subproject. Patch contributed by JasonHaslam. - Fix builds with Visual Studio 2015. VS2015 moved stdio functions to the header files as inline function. That means check_function_exists can't detect them because it doesn't use header files - just does a link check. Instead we need to use check_symbol_exists with the correct headers. Kamil Dudka (2 Jul 2015) - cmake: include CMake files in the release tarballs Despite we announced the CMake support in libssh2-1.6.0 release notes, the files required by the CMake build system were not included in the release tarballs. Hence, the only way to use CMake for build was the upstream git repository. This commit makes CMake actually supported in the release tarballs. - tests/mansyntax.sh: fix 'make distcheck' with recent autotools Do not create symbolic links off the build directory. Recent autotools verify that out-of-source build works even if the source directory tree is not writable. - openssl: fix memleak in _libssh2_dsa_sha1_verify() Daniel Stenberg (12 Jun 2015) - openssl: make libssh2_sha1 return error code - use the internal prefix _libssh2_ for non-exported functions - removed libssh2_md5() since it wasn't used Reported-by: Kamil Dudka - [LarsNordin-LNdata brought this change] SFTP: Increase speed and datasize in SFTP read The function sftp_read never return more then 2000 bytes (as it should when I asked Daniel). I increased the MAX_SFTP_READ_SIZE to 30000 but didn't get the same speed as a sftp read in SecureSSH. I analyzed the code and found that a return always was dona when a chunk has been read. I changed it to a sliding buffer and worked on all available chunks. I got an increase in speed and non of the test I have done has failed (both local net and over Internet). Please review and test. I think 30000 is still not the optimal MAX_SFTP_READ_SIZE, my next goal is to make an API to enable changing this value (The SecureSSH sftp_read has more complete filled packages when comparing the network traffic) - bump: start working on 1.6.1 Version 1.6.0 (5 Jun 2015) Daniel Stenberg (5 Jun 2015) - RELEASE-NOTES: synced with 858930cae5c6a Marc Hoersken (19 May 2015) - wincng.c: fixed indentation - [sbredahl brought this change] wincng.c: fixed memleak in (block) cipher destructor Alexander Lamaison (6 May 2015) - [Jakob Egger brought this change] libssh2_channel_open: more detailed error message The error message returned by libssh2_channel_open in case of a server side channel open failure is now more detailed and includes the four standard error conditions in RFC 4254. - [Hannes Domani brought this change] kex: fix libgcrypt memory leaks of bignum Fixes #168. Marc Hoersken (3 Apr 2015) - configure.ac: check for SecureZeroMemory for clear memory feature - Revert "wincng.c: fix clear memory feature compilation with mingw" This reverts commit 2d2744efdd0497b72b3e1ff6e732aa4c0037fc43. Autobuilds show that this did not solve the issue. And it seems like RtlFillMemory is defined to memset, which would be optimized out by some compilers. - wincng.c: fix clear memory feature compilation with mingw Alexander Lamaison (1 Apr 2015) - [LarsNordin-LNdata brought this change] Enable use of OpenSSL that doesn't have DSA. Added #if LIBSSH2_DSA for all DSA functions. - [LarsNordin-LNdata brought this change] Use correct no-blowfish #define with OpenSSL. The OpenSSL define is OPENSSL_NO_BF, not OPENSSL_NO_BLOWFISH. Marc Hoersken (25 Mar 2015) - configure: error if explicitly enabled clear-memory is not supported This takes 22bd8d81d8fab956085e2079bf8c29872455ce59 and b8289b625e291bbb785ed4add31f4759241067f3 into account, but still makes it enabled by default if it is supported and error out in case it is unsupported and was requested. Daniel Stenberg (25 Mar 2015) - configure: make clear-memory default but only WARN if backend unsupported ... instead of previous ERROR. Marc Hoersken (24 Mar 2015) - wincng.h: fix warning about computed return value not being used - nonblocking examples: fix warning about unused tvdiff on Mac OS X Daniel Stenberg (24 Mar 2015) - openssl: fix compiler warnings - cofigure: fix --disable-clear-memory check Marc Hoersken (23 Mar 2015) - scp.c: improved command length calculation Reduced number of calls to strlen, because shell_quotearg already returns the length of the resulting string (e.q. quoted path) which we can add to the existing and known cmd_len. Removed obsolete call to memset again, because we can put a final NULL-byte at the end of the string using the calculated length. - scp.c: improved and streamlined formatting - scp.c: fix that scp_recv may transmit not initialised memory - scp.c: fix that scp_send may transmit not initialised memory Fixes ticket 244. Thanks Torsten. - kex: do not ignore failure of libssh2_sha1_init() Based upon 43b730ce56f010e9d33573fcb020df49798c1ed8. Fixes ticket 290. Thanks for the suggestion, mstrsn. - wincng.h: fix return code of libssh2_md5_init() - openssl.c: fix possible segfault in case EVP_DigestInit fails - wincng.c: fix possible use of uninitialized variables - wincng.c: fix unused argument warning if clear memory is not enabled - wincng: Added explicit clear memory feature to WinCNG backend This re-introduces the original feature proposed during the development of the WinCNG crypto backend. It still needs to be added to libssh2 itself and probably other backends. Memory is cleared using the function SecureZeroMemory which is available on Windows systems, just like the WinCNG backend. - wincng.c: fixed mixed line-endings - wincng.c: fixed use of invalid parameter types in a8d14c5dcf - wincng.c: only try to load keys corresponding to the algorithm - wincng.c: moved PEM headers into definitions - wincng.h: fixed invalid parameter name - wincng: fixed mismatch with declarations in crypto.h - userauth.c: fixed warning C6001: using uninitialized sig and sig_len - pem.c: fixed warning C6269: possible incorrect order of operations - wincng: add support for authentication keys to be passed in memory Based upon 18cfec8336e and daa2dfa2db. - pem.c: add _libssh2_pem_parse_memory to parse PEM from memory Requirement to implement 18cfec8336e for Libgcrypt and WinCNG. - pem.c: fix copy and paste mistake from 55d030089b8 - userauth.c: fix another possible dereference of a null pointer - userauth.c: fix possible dereference of a null pointer - pem.c: reduce number of calls to strlen in readline Alexander Lamaison (17 Mar 2015) - [Will Cosgrove brought this change] Initialise HMAC_CTX in more places. Missed a couple more places we init ctx to avoid openssl threading crash. - Build build breakage in WinCNG backend caused when adding libssh2_userauth_publickey_frommemory. The new feature isn't implemented for the WinCNG backend currently, but the WinCNG backend didn't contain any implementation of the required backend functions - even ones that returns an error. That caused link errors. This change fixes the problem by providing an implementation of the backend functions that returns an error. - Fix breakage in WinCNG backend caused by introducing libssh2_hmac_ctx_init. The macro was defined to nothing for the libgcrypt backend, but not for WinCNG. This brings the latter into line with the former. Daniel Stenberg (15 Mar 2015) - userauth_publickey_frommemory.3: add AVAILABILITY ... it will be added in 1.6.0 - libssh2: next version will be called 1.6.0 ... since we just added a new function. - docs: add libssh2_userauth_publickey_frommemory.3 to dist The function and man page were added in commit 18cfec8336e - [Jakob Egger brought this change] direct_tcpip: Fixed channel write There were 3 bugs in this loop: 1) Started from beginning after partial writes 2) Aborted when 0 bytes were sent 3) Ignored LIBSSH2_ERROR_EAGAIN See also: https://trac.libssh2.org/ticket/281 https://trac.libssh2.org/ticket/293 Alexander Lamaison (15 Mar 2015) - [Will Cosgrove brought this change] Must init HMAC_CTX before using it. Must init ctx before using it or openssl will reuse the hmac which is not thread safe and causes a crash. Added libssh2_hmac_ctx_init macro. - Add continuous integration configurations. Linux-based CI is done by Travis CI. Windows-based CI is done by Appveyor. - [David Calavera brought this change] Allow authentication keys to be passed in memory. All credits go to Joe Turpin, I'm just reaplying and cleaning his patch: http://www.libssh2.org/mail/libssh2-devel-archive-2012-01/0015.shtml * Use an unimplemented error for extracting keys from memory with libgcrypt. Daniel Stenberg (14 Mar 2015) - docs: include the renamed INSTALL* files in dist Alexander Lamaison (13 Mar 2015) - Prevent collisions between CMake and Autotools in examples/ and tests/. - Avoid clash between CMake build and Autotools. Autotools expects a configuration template file at src/libssh2_config.h.in, which buildconf generates. But the CMake build system has its CMake-specific version of the file at this path. This means that, if you don't run buildconf, the Autotools build will fail because it configured the wrong header template. See https://github.com/libssh2/libssh2/pull/8. - Merge pull request #8 from alamaison/cmake CMake build system. - CMake build system. Tested: - Windows: - Visual C++ 2005/2008/2010/2012/2013/MinGW-w64 - static/shared - 32/64-bit - OpenSSL/WinCNG - Without zlib - Linux: - GCC 4.6.3/Clang 3.4 - static/shared - 32/64-bit - OpenSSL/Libgcrypt - With/Without zlib - MacOS X - AppleClang 6.0.0 - static - 64-bit - OpenSSL - Without zlib Conflicts: README - Man man syntax tests fail gracefully if man version is not suitable. - Return valid code from test fixture on failure. The sshd test fixture was returning -1 if an error occurred, but negative error codes aren't technically valid (google it). Bash on Windows converted them to 0 which made setup failure look as though all tests were passing. - Let mansyntax.sh work regardless of where it is called from. Daniel Stenberg (12 Mar 2015) - [Viktor Szakáts brought this change] mingw build: allow to pass custom CFLAGS Allow to pass custom `CFLAGS` options via environment variable `LIBSSH2_CFLAG_EXTRAS`. Default and automatically added options of `GNUmakefile` have preference over custom ones. This addition is useful for passing f.e. custom CPU tuning or LTO optimization (`-flto -ffat-lto-objects`) options. The only current way to do this is to edit `GNUmakefile`. This patch makes it unnecessary. This is a mirror of similar libcurl patch: https://github.com/bagder/curl/pull/136 - [Will Cosgrove brought this change] userauth: Fixed prompt text no longer being copied to the prompts struct Regression from 031566f9c - README: update the git repo locations - wait_socket: wrong use of difftime() With reversed arguments it would always return a negative value... Bug: https://github.com/bagder/libssh2/issues/1 - bump: start working toward 1.5.1 now Version 1.5.0 (11 Mar 2015) Daniel Stenberg (11 Mar 2015) - RELEASE-NOTES: 1.5.0 release - [Mariusz Ziulek brought this change] kex: bail out on rubbish in the incoming packet CVE-2015-1782 Bug: http://www.libssh2.org/adv_20150311.html - docs: move INSTALL, AUTHORS, HACKING and TODO to docs/ And with this, cleanup README to be shorter and mention the new source code home. - .gitignore: don't ignore INSTALL Dan Fandrich (4 Mar 2015) - examples/x11.c: include sys/select.h for improved portability Daniel Stenberg (4 Mar 2015) - RELEASE-NOTES: synced with a8473c819bc068 In preparation for the upcoming 1.5.0 release. Guenter Knauf (8 Jan 2015) - NetWare build: added some missing exports. Marc Hoersken (29 Dec 2014) - knownhost.c: fix use of uninitialized argument variable wrote Detected by clang scan in line 1195, column 18. - examples/x11.c: fix result of operation is garbage or undefined Fix use of uninitialized structure w_size_bck. Detected by clang scan in line 386, column 28. - examples/x11.c: remove dead assigments of some return values Detected by clang scan in line 212, column 9. Detected by clang scan in line 222, column 13. Detected by clang scan in line 410, column 13. - examples/x11.c: fix possible memory leak if read fails Detected by clang scan in line 224, column 21. - examples/x11.c: fix invalid removal of first list element Fix use of memory after it was being freed. Detected by clang scan in line 56, column 12. - userauth.c: make sure that sp_len is positive and avoid overflows ... if the pointer subtraction of sp1 - pubkey - 1 resulted in a negative or larger value than pubkey_len, memchr would fail. Reported by Coverity CID 89846. - channel.c: remove logically dead code, host cannot be NULL here ... host cannot be NULL in line 525, because it is always valid (e.g. at least set to "0.0.0.0") after lines 430 and 431. Reported by Coverity CID 89807. - session.c: check return value of session_nonblock during startup Reported by Coverity CID 89803. - session.c: check return value of session_nonblock in debug mode Reported by Coverity CID 89805. - pem.c: fix mixed line-endings introduced with 8670f5da24 - pem.c: make sure there's a trailing zero and b64data is not NULL ... if there is no base64 data between PEM header and footer. Reported by Coverity CID 89823. - kex.c: make sure mlist is not set to NULL ... if the currently unsupported LANG methods are called. Reported by Coverity CID 89834. - packet.c: i < 256 was always true and i would overflow to 0 Visualize that the 0-termination is intentional, because the array is later passed to strlen within _libssh2_packet_askv. - silence multiple data conversion warnings Daniel Stenberg (23 Dec 2014) - agent_connect_unix: make sure there's a trailing zero ... if the path name was too long. Reported by Coverity CID 89801. Marc Hoersken (22 Dec 2014) - examples on Windows: use native SOCKET-type instead of int And check return values accordingly. - userauth.c: improve readability and clarity of for-loops Daniel Stenberg (22 Dec 2014) - calloc: introduce LIBSSH2_CALLOC() A simple function using LIBSSH2_ALLOC + memset, since this pattern was used in multiple places and this simplies code in general. Marc Hoersken (15 Dec 2014) - libssh2_priv.h: Ignore session, context and format parameters - x11 example: check return value of socket function - examples: fixed mixed line-endings introduced with aedfba25b8 - wincng.c: explicitly ignore BCrypt*AlgorithmProvider return codes Fixes VS2012 code analysis warning C6031: return value ignored: <function> could return unexpected value - wincng.c: fix possible invalid memory write access Fixes VS2012 code analysis warning C6386: buffer overrun: accessing 'pbOutput', the writable size is 'cbOutput' bytes, but '3' bytes may be written: libssh2 wincng.c 610 - tests on Windows: check for WSAStartup return code Fixes VS2012 code analysis warning C6031: return value ignored: <function> could return unexpected value - wincng.c: fix possible NULL pointer de-reference of bignum Fixes VS2012 code analysis warning C6011: dereferencing NULL pointer 'bignum'. libssh2 wincng.c 1567 - wincng.c: fix possible use of uninitialized memory Fixes VS2012 code analysis warning C6001: using uninitialized memory 'cbDecoded'. libssh2 wincng.c 553 - packet.c: fix possible NULL pointer de-reference within listen_state Fixes VS2012 code analysis warning C6011: dereferencing NULL pointer 'listen_state->channel'. libssh2 packet.c 221 - kex.c: fix possible NULL pointer de-reference with session->kex Fixes VS2012 code analysis warning C6011: dereferencing NULL pointer 'session->kex'. libssh2 kex.c 1761 - agent.c: check return code of MapViewOfFile Fixes VS2012 code analysis warning C6387: 'p+4' may be '0': this does not adhere to the specification for the function 'memcpy': libssh2 agent.c 330 Fixes VS2012 code analysis warning C6387: 'p' may be '0': this does not adhere to the specification for the function 'UnmapViewOfFile': libssh2 agent.c 333 - examples on Windows: check for socket return code Fixes VS2012 code analysis warning C28193: The variable holds a value that must be examined - examples on Windows: check for WSAStartup return code Fixes VS2012 code analysis warning C6031: return value ignored: <function> could return unexpected value Guenter Knauf (11 Dec 2014) - wincng.c: silent some more gcc compiler warnings. - wincng.c: silent gcc compiler warnings. - Watcom build: added support for WinCNG build. - build: updated dependencies in makefiles. Daniel Stenberg (4 Dec 2014) - configure: change LIBS not LDFLAGS when checking for libs Closes #289 Patch-by: maurerpe Guenter Knauf (3 Dec 2014) - MinGW build: some more GNUMakefile tweaks. test/GNUmakefile: added architecture autodetection; added switches to CFLAGS and RCFLAGS to make sure that the right architecture is used. Added support to build with WinCNG. - sftpdir.c: added authentication method detection. Stuff copied over from ssh2.c to make testing a bit easier. - NMake build: fixed LIBS settings. - NMake build: added support for WinCNG build. - MinGW build: some GNUMakefile tweaks. Added architecture autodetection; added switches to CFLAGS and RCFLAGS to make sure that the right architecture is used. Added support to build with WinCNG. - MinGW build: Fixed redefine warnings. - Updated copyright year. Daniel Stenberg (31 Aug 2014) - COPYING: bump the copyright year Dan Fandrich (28 Jul 2014) - docs: fixed a bunch of typos - docs: added missing libssh2_session_handshake.3 file Marc Hoersken (19 May 2014) - wincng.c: specify the required libraries for dependencies using MSVC Initially reported by Bob Kast as "for MS VS builds, specify the libraries that are required so they don't need to go into all project files that may use this library". Thanks a lot. - [Bob Kast brought this change] windows build: do not export externals from static library If you are building a DLL, then you need to explicitly export each entry point. When building a static library, you should not. libssh2 was exporting the entry points whether it was building a DLL or a static library. To elaborate further, if libssh2 was used as a static library, which was being linked into a DLL, the libssh2 API would be exported from that separate DLL. Daniel Stenberg (19 May 2014) - [Mikhail Gusarov brought this change] Fix typos in manpages Marc Hoersken (18 May 2014) - wincng.c: Fixed memory leak in case of an error during ASN.1 decoding - configure: Display individual crypto backends on separate lines This avoids line-wrapping in between parameters and makes the error message look like the following: configure: error: No crypto library found! Try --with-libssl-prefix=PATH or --with-libgcrypt-prefix=PATH or --with-wincng on Windows - [Bob Kast brought this change] libssh2_priv.h: a 1 bit bit-field should be unsigned some compilers may not like this - knownhost.c: Fixed warning that pointer targets differ in signedness - wincng.c: Fixed warning about pointer targets differing in signedness - tcpip-forward.c: Fixed warning that pointer targets differ in signedness libssh2_channel_forward_listen_ex uses ints instead of unsigned ints. - misc.c: Fixed warning about mixed declarations and code - libgcrypt.h: Fixed warning about pointer targets differing in signedness - wincng.h: Fixed warning about pointer targets differing in signedness - misc.c: Fixed warning about unused parameter abstract - tcpip-forward.c: Removed unused variables shost, sport and sockopt - wincng.h: Added forward declarations for all WinCNG functions Initially reported by Bob Kast as "Wincng - define function prototypes for wincng routines". Thanks a lot. Also replaced structure definitions with type definitions. - [Bob Kast brought this change] libssh2.h: on Windows, a socket is of type SOCKET, not int - win32: Added WinCNG targets to generated Visual Studio project Inspired by Bob Kast's reports, this commit enables the compilation of libssh2 with WinCNG using the generated Visual Studio project files. This commit adds WinCNG support to parts of the existing Win32 build infrastructure, until new build systems, like pre-defined VS project files or CMake files may be added. This commit and b20bfeb3e519119a48509a1099c06d65aa7da1d7 raise one question: How to handle build systems, like VS project files, that need to include all source files regardless of the desired target, including all supported crypto backends? For now the mentioned commit added a check for LIBSSH2_OPENSSL to openssl.c and with this commit the supported crypto backends are hardcoded within Makefile.am. - libssh2_priv msvc: Removed redundant definition of inline keyword Initially reported by Bob Kast as "Remove redundant 'inline' define". Thanks a lot. - wincng: Made data parameter to hash update function constant Initially reported by Bob Kast as "formal parameter must be const since it is used in contexts where the actual parameter may be const". Thanks a lot. - wincng: fix cross-compilation against the w64 mingw-runtime package - openssl: Check for LIBSSH2_OPENSSL in order to compile with openssl - wincng: Fixed use of possible uninitialized variable pPaddingInfo Reported by Bob Kast, thanks a lot. - wincng: Added cast for double to unsigned long conversion - wincng: Cleaned up includes and check NTSTATUS using macro Removed header file combination that is not supported on a real Windows platform and can only be compiled using MinGW. Replaced custom NTSTATUS return code checks with BCRYPT_SUCCESS macro. Daniel Stenberg (16 Mar 2014) - userauth_hostbased_fromfile: zero assign to avoid uninitialized use Detected by clang-analyze - channel_receive_window_adjust: store windows size always Avoid it sometimes returning without storing it, leaving calling functions with unknown content! Detected by clang-analyzer - publickey_packet_receive: avoid junk in returned pointers clang-analyzer found this risk it would return a non-initialized pointer in a success case Peter Stuge (16 Mar 2014) - [Marc Hoersken brought this change] Added Windows Cryptography API: Next Generation based backend - [Marc Hoersken brought this change] knownhost.c: fixed that 'key_type_len' may be used uninitialized ../src/knownhost.c: In function 'libssh2_knownhost_readline': ../src/knownhost.c:651:16: warning: 'key_type_len' may be used uninitialized in this function [-Wmaybe-uninitialized] rc = knownhost_add(hosts, hostbuf, NULL, ^ ../src/knownhost.c:745:12: note: 'key_type_len' was declared here size_t key_type_len; ^ - [Marc Hoersken brought this change] pem.c: always compile pem.c independently of crypto backend - Fix non-autotools builds: Always define the LIBSSH2_OPENSSL CPP macro Commit d512b25f69a1b6778881f6b4b5ff9cfc6023be42 introduced a crypto library abstraction in the autotools build system, to allow us to more easily support new crypto libraries. In that process it was found that all other build system which we support are hard-coded to build with OpenSSL. Commit f5c1a0d98bd51aeb24aca3d49c7c81dcf8bd858d fixes automake introduced into non-autotools build systems but still overlooked the CPP macro saying that we are using OpenSSL. Thanks to Marc Hörsken for identifying this issue and proposing a fix for win32/{GNUmakefile,config.mk}. This commit uses a slightly different approach but the end result is the same. Dan Fandrich (15 Mar 2014) - channel_close: Close the channel even in the case of errors - sftp_close_handle: ensure the handle is always closed Errors are reported on return, but otherwise the close path is completed as much as possible and the handle is freed on exit. Alexander Lamaison (6 Mar 2014) - knownhost: Restore behaviour of `libssh2_knownhost_writeline` with short buffer. Commit 85c6627c changed the behaviour of `libssh2_knownhost_writeline` so that it stopped returning the number of bytes needed when the given buffer was too small. Also, the function changed such that is might write to part of the buffer before realising it is too small. This commit restores the original behaviour, whilst keeping the unknown-key-type functionality that 85c6627c. Instead of writing to the buffer piecemeal, the length of the various parts is calculated up front and the buffer written only if there is enough space. The calculated necessary size is output in `outlen` regardless of whether the buffer was written to. The main use-case for the original behaviour that this commit restores is to allow passing in a NULL buffer to get the actual buffer size needed, before calling the function again with the buffer allocated to the exact size required. - knownhost: Fix DSS keys being detected as unknown. I missing `else` meant ssh-dss format keys were being re-detected as unknown format. Dan Fandrich (6 Mar 2014) - knownhosts: Abort if the hosts buffer is too small This could otherwise cause a match on the wrong host - agent_list_identities: Fixed memory leak on OOM - Fixed a few typos - userauth: Fixed an attempt to free from stack on error - Fixed a few memory leaks in error paths - Fixed two potential use-after-frees of the payload buffer The first might occur if _libssh2_packet_add returns an error, as fullpacket_state wasn't reset to idle so if it were possible for fullpacket to be called again, it would return to the same state handler and re-use the freed p->packet buffer. The second could occur if decrypt returned an error, as it freed the packet buffer but did not clear total_num, meaning that freed buffer could be written into again later. Alexander Lamaison (28 Nov 2013) - Fix missing `_libssh2_error` in `_libssh2_channel_write`. In one case, the error code from `_libssh2_transport_read` was being returned from `_libssh2_channel_write` without setting it as the last error by calling `_libssh2_error`. This commit fixes that. Found when using a session whose socket had been inadvertently destroyed. The calling code got confused because via `libssh2_session_last_error` it appeared no error had occurred, despite one being returned from the previous function. Kamil Dudka (21 Nov 2013) - [Mark McPherson brought this change] openssl: initialise the digest context before calling EVP_DigestInit() When using the OpenSSL libraries in FIPS mode, the function call EVP_DigestInit() is actually #defined to FIPS_digestinit(). Unfortunately wheres EVP_DigestInit() initialises the context and then calls EVP_DigestInit_ex(), this function assumes that the context has been pre-initialised and crashes when it isn't. Bug: https://trac.libssh2.org/ticket/279 Fixes #279 - [Marc Hörsken brought this change] .gitignore: Ignore files like src/libssh2_config.h.in~ Peter Stuge (13 Nov 2013) - Move automake conditionals added by commit d512b25f out of Makefile.inc Commit d512b25f69a1b6778881f6b4b5ff9cfc6023be42 added automake conditionals to Makefile.inc but since Makefile.inc is included from Makefile for all other build systems that does not work. This commit instead adds Makefile.OpenSSL.inc and Makefile.libgcrypt.inc and moves the automake conditional to its proper place, src/Makefile.am. The automake conditional includes the correct Makefile.$name.inc per the crypto library selection/detection done by configure. All non-autotools build system files in libssh2 are hardcoded to use OpenSSL and do not get a conditional but at least there is some reuse because they can all include the new Makefile.OpenSSL.inc. Daniel Stenberg (27 Oct 2013) - [Salvador Fandino brought this change] Set default window size to 2MB The default channel window size used until now was 256KB. This value is too small and results on a bottleneck on real-life networks where round-trip delays can easily reach 300ms. The issue was not visible because the configured channel window size was being ignored and a hard-coded value of ~22MB being used instead, but that was fixed on a previous commit. This patch just changes the default window size (LIBSSH2_CHANNEL_WINDOW_DEFAULT) to 2MB. It is the same value used by OpenSSH and in our opinion represents a good compromise between memory used and transfer speed. Performance tests were run to determine the optimum value. The details and related discussion are available from the following thread on the libssh2 mailing-list: http://www.libssh2.org/mail/libssh2-devel-archive-2013-10/0018.shtml http://article.gmane.org/gmane.network.ssh.libssh2.devel/6543 An excerpt follows: "I have been running some transfer test and measuring their speed. My setup was composed of a quad-core Linux machine running Ubuntu 13.10 x86_64 with a LXC container inside. The data transfers were performed from the container to the host (never crossing through a physical network device). Network delays were simulated using the tc tool. And ping was used to verify that they worked as intended during the tests. The operation performed was the equivalent to the following ssh command: $ ssh container "dd bs=16K count=8K if=/dev/zero" >/dev/null Though, establishment and closing of the SSH connection was excluded from the timings. I run the tests several times transferring files of sizes up to 128MB and the results were consistent between runs. The results corresponding to the 128MB transfer are available here: https://docs.google.com/spreadsheet/ccc?key=0Ao1yRmX6PQQzdG5wSFlrZl9HRWNET3ZyN0hnaGo5ZFE&usp=sharing It clearly shows that 256KB is too small as the default window size. Moving to a 512MB generates a great improvement and after the 1MB mark the returns rapidly diminish. Other factors (TCP window size, probably) become more limiting than the channel window size For comparison I also performed the same transfers using OpenSSH. Its speed is usually on par with that of libssh2 using a window size of 1MB (even if it uses a 2MB window, maybe it is less aggressive sending the window adjust msgs)." Signed-off-by: Salvador Fandino <sfandino@yahoo.com> - [Salvador brought this change] _libssh2_channel_read: Honour window_size_initial _libssh2_channel_read was using an arbitrary hard-coded limit to trigger the window adjusting code. The adjustment used was also hard-coded and arbitrary, 15MB actually, which would limit the usability of libssh2 on systems with little RAM. This patch, uses the window_size parameter passed to libssh2_channel_open_ex (stored as remote.window_size_initial) plus the buflen as the base for the trigger and the adjustment calculation. The memory usage when using the default window size is reduced from 22MB to 256KB per channel (actually, if compression is used, these numbers should be incremented by ~50% to account for the errors between the decompressed packet sizes and the predicted sizes). My tests indicate that this change does not impact the performance of transfers across localhost or a LAN, being it on par with that of OpenSSH. On the other hand, it will probably slow down transfers on networks with high bandwidth*delay when the default window size (LIBSSH2_CHANNEL_WINDOW_DEFAULT=256KB) is used. Signed-off-by: Salvador Fandino <sfandino@yahoo.com> - [Salvador Fandino brought this change] knownhosts: handle unknown key types Store but don't use keys of unsupported types on the known_hosts file. Currently, when libssh2 parses a known_host file containing keys of some type it doesn't natively support, it stops reading the file and returns an error. That means, that the known_host file can not be safely shared with other software supporting other key types (i.e. OpenSSH). This patch adds support for handling keys of unknown type. It can read and write them, even if they are never going to be matched. At the source level the patch does the following things: - add a new unknown key type LIBSSH2_KNOWNHOST_KEY_UNKNOWN - add a new slot (key_type_name) on the known_host struct that is used to store the key type in ascii form when it is not supported - parse correctly known_hosts entries with unknown key types and populate the key_type_name slot - print correctly known_hosts entries of unknown type - when checking a host key ignore keys that do not match the key Fixes #276 - windows build: fix build errors Fixes various link errors with VS2010 Reported-by: "kdekker" Fixes #272 - man page: add missing function argument for libssh2_userauth_publickey_fromfile_ex() Reported-by: "pastey" Fixes #262 - [Salvador brought this change] Fix zlib deflate usage Deflate may return Z_OK even when not all data has been compressed if the output buffer becomes full. In practice this is very unlikely to happen because the output buffer size is always some KBs larger than the size of the data passed for compression from the upper layers and I think that zlib never expands the data so much, even on the worst cases. Anyway, this patch plays on the safe side checking that the output buffer is not exhausted. Signed-off-by: Salvador <sfandino@yahoo.com> - [Salvador brought this change] comp_method_zlib_decomp: Improve buffer growing algorithm The old algorithm was O(N^2), causing lots and lots of reallocations when highly compressed data was transferred. This patch implements a simpler one that just doubles the buffer size everytime it is exhausted. It results in O(N) complexity. Also a smaller inflate ratio is used to calculate the initial size (x4). Signed-off-by: Salvador <sfandino@yahoo.com> - [Salvador brought this change] Fix zlib usage Data may remain in zlib internal buffers when inflate() returns Z_OK and avail_out == 0. In that case, inflate has to be called again. Also, once all the data has been inflated, it returns Z_BUF_ERROR to signal that the input buffer has been exhausted. Until now, the way to detect that a packet payload had been completely decompressed was to check that no data remained on the input buffer but that didn't account for the case where data remained on the internal zlib buffers. That resulted in packets not being completely decompressed and the missing data reappearing on the next packet, though the bug was masked by the buffer allocation algorithm most of the time and only manifested when transferring highly compressible data. This patch fixes the zlib usage. Signed-off-by: Salvador <sfandino@yahoo.com> - [Salvador brought this change] _libssh2_channel_read: fix data drop when out of window After filling the read buffer with data from the read queue, when the window size was too small, "libssh2_channel_receive_window_adjust" was called to increase it. In non-blocking mode that function could return EAGAIN and, in that case, the EAGAIN was propagated upwards and the data already read on the buffer lost. The function was also moving between the two read states "libssh2_NB_state_idle" and "libssh2_NB_state_created" both of which behave in the same way (excepting a debug statment). This commit modifies "_libssh2_channel_read" so that the "libssh2_channel_receive_window_adjust" call is performed first (when required) and if everything goes well, then it reads the data from the queued packets into the read buffer. It also removes the useless "libssh2_NB_state_created" read state. Some rotted comments have also been updated. Signed-off-by: Salvador <sfandino@yahoo.com> - [Salvador Fandino brought this change] window_size: redid window handling for flow control reasons Until now, the window size (channel->remote.window_size) was being updated just after receiving the packet from the transport layer. That behaviour is wrong because the channel queue may grow uncontrolled when data arrives from the network faster that the upper layer consumes it. This patch adds a new counter, read_avail, which keeps a count of the bytes available from the packet queue for reading. Also, now the window size is adjusted when the data is actually read by an upper layer. That way, if the upper layer stops reading data, the window will eventually fill and the remote host will stop sending data. When the upper layers reads enough data, a window adjust packet is delivered and the transfer resumes. The read_avail counter is used to detect the situation when the remote server tries to send data surpassing the window size. In that case, the extra data is discarded. Signed-off-by: Salvador <sfandino@yahoo.com> Peter Stuge (15 Sep 2013) - configure.ac: Call zlib zlib and not libz in text but keep option names - configure.ac: Reorder --with-* options in --help output - configure.ac: Rework crypto library detection This further simplifies adding new crypto libraries. - Clean up crypto library abstraction in build system and source code libssh2 used to explicitly check for libgcrypt and default to OpenSSL. Now all possible crypto libraries are checked for explicitly, making the addition of further crypto libraries both simpler and cleaner. - configure.ac: Add zlib to Requires.private in libssh2.pc if using zlib - Revert "Added Windows Cryptography API: Next Generation based backend" This reverts commit d385230e15715e67796f16f3e65fd899f21a638b. Daniel Stenberg (7 Sep 2013) - [Leif Salomonsson brought this change] sftp_statvfs: fix for servers not supporting statfvs extension Fixes issue arising when server does not support statfvs and or fstatvfs extensions. sftp_statvfs() and sftp_fstatvfs() after this patch will handle the case when SSH_FXP_STATUS is returned from server. - [Marc Hoersken brought this change] Added Windows Cryptography API: Next Generation based backend - [Kamil Dudka brought this change] partially revert "window_size: explicit adjustments only" This partially reverts commit 03ca9020756a4e16f0294e5b35e9826ee6af2364 in order to fix extreme slowdown when uploading to localhost via SFTP. I was able to repeat the issue on RHEL-7 on localhost only. It did not occur when uploading via network and it did not occur on a RHEL-6 box with the same version of libssh2. The problem was that sftp_read() used a read-ahead logic to figure out the window_size, but sftp_packet_read() called indirectly from sftp_write() did not use any read-ahead logic. - _libssh2_channel_write: client spins on write when window full When there's no window to "write to", there's no point in waiting for the socket to become writable since it most likely just will continue to be. Patch-by: ncm Fixes #258 - _libssh2_channel_forward_cancel: avoid memory leaks on error Fixes #257 - _libssh2_packet_add: avoid using uninitialized memory In _libssh2_packet_add, called by _libssh2_packet_read, a call to _libssh2_packet_send that is supposed to send a one-byte message SSH_MSG_REQUEST_FAILURE would send an uninitialized byte upon re-entry if its call to _send returns _EAGAIN. Fixes #259 - _libssh2_channel_forward_cancel: accessed struct after free ... and the assignment was pointless anyway since the struct was about to be freed. Bug introduced in dde2b094. Fixes #268 Peter Stuge (2 Jun 2013) - [Marc Hoersken brought this change] Fixed compilation using mingw-w64 - [Marc Hoersken brought this change] knownhost.c: use LIBSSH2_FREE macro instead of free Use LIBSSH2_FREE instead of free since _libssh2_base64_encode uses LIBSSH2_ALLOC Daniel Stenberg (18 May 2013) - [Matthias Kerestesch brought this change] libssh2_agent_init: init ->fd to LIBSSH2_INVALID_SOCKET ... previously it was left at 0 which is a valid file descriptor! Bug: https://trac.libssh2.org/ticket/265 Fixes #265 - userauth_password: pass on the underlying error code _libssh2_packet_requirev() may return different errors and we pass that to the parent instead of rewriting it. Bug: http://libssh2.org/mail/libssh2-devel-archive-2013-04/0029.shtml Reported by: Cosmin Peter Stuge (9 May 2013) - [Marc Hoersken brought this change] libcrypt.c: Fix typo in _libssh2_rsa_sha1_sign() parameter type Kamil Dudka (4 May 2013) - configure.ac: replace AM_CONFIG_HEADER with AC_CONFIG_HEADERS Reported by: Quintus Bug: https://trac.libssh2.org/ticket/261 Guenter Knauf (12 Apr 2013) - Fixed copyright string for NetWare build. Daniel Stenberg (9 Apr 2013) - [Richard W.M. Jones brought this change] sftp: Add support for fsync (OpenSSH extension). The new libssh2_sftp_fsync API causes data and metadata in the currently open file to be committed to disk at the server. This is an OpenSSH extension to the SFTP protocol. See: https://bugzilla.mindrot.org/show_bug.cgi?id=1798 - [Richard W.M. Jones brought this change] sftp: statvfs: Along error path, reset the correct 'state' variable. - [Richard W.M. Jones brought this change] sftp: seek: Don't flush buffers on same offset Signed-off-by: Richard W.M. Jones <rjones@redhat.com> Guenter Knauf (9 Feb 2013) - Updated dependency libs. - Fixed tool macro names. Daniel Stenberg (29 Nov 2012) - [Seth Willits brought this change] compiler warnings: typecast strlen in macros ... in macro parameters to avoid compiler warnings about lost precision. Several macros in libssh2.h call strlen and pass the result directly to unsigned int parameters of other functions, which warns about precision loss because strlen returns size_t which is unsigned long on at least some platforms (such as OS X). The fix is to simply typecast the strlen() result to unsigned int. - libssh2.h: bump version to 1.4.4-DEV Version 1.4.3 (27 Nov 2012) Daniel Stenberg (27 Nov 2012) - RELEASE-NOTES: fixed for 1.4.3 - sftp_read: return error if a too large package arrives Peter Stuge (13 Nov 2012) - Only define _libssh2_dsa_*() functions when building with DSA support Guenter Knauf (8 Nov 2012) - Added .def file to output. Kamil Dudka (1 Nov 2012) - libssh2_hostkey_hash.3: update the description of return value The function returns NULL also if the hash algorithm is not available. Guenter Knauf (24 Oct 2012) - Fixed mode acciedently committed. - Ignore generated file. - Added hack to make use of Makefile.inc. This should avoid further maintainance of the objects list. - Fixed MSVC NMakefile. Added missing source files; added resource for DLL. Kamil Dudka (22 Oct 2012) - examples: use stderr for messages, stdout for data Reported by: Karel Srot Bug: https://bugzilla.redhat.com/867462 - openssl: do not leak memory when handling errors ,.. in aes_ctr_init(). Detected by Coverity. - channel: fix possible NULL dereference ... in libssh2_channel_get_exit_signal(). Detected by Coverity. - Revert "aes: the init function fails when OpenSSL has AES support" This partially reverts commit f4f2298ef3635acd031cc2ee0e71026cdcda5864. We need to use the EVP_aes_???_ctr() functions in FIPS mode. - crypt: use hard-wired cipher block sizes consistently - openssl: do not ignore failure of EVP_CipherInit() - kex: do not ignore failure of libssh2_md5_init() The MD5 algorithm is disabled when running in FIPS mode. Daniel Stenberg (21 Aug 2012) - [Peter Krempa brought this change] known_hosts: Fail when parsing unknown keys in known_hosts file. libssh2_knownhost_readfile() silently ignored problems when reading keys in unsupported formats from the known hosts file. When the file is written again from the internal structures of libssh2 it gets truntcated to the point where the first unknown key was located. * src/knownhost.c:libssh2_knownhost_readfile() - return error if key parsing fails - AUTHORS: synced with 42fec44c8a4 31 recent authors added - [Dave Hayden brought this change] compression: add support for zlib@openssh.com Add a "use_in_auth" flag to the LIBSSH2_COMP_METHOD struct and a separate "zlib@openssh.com" method, along with checking session->state for LIBSSH2_STATE_AUTHENTICATED. Appears to work on the OpenSSH servers I've tried against, and it should work as before with normal zlib compression. - [Dmitry Smirnov brought this change] configure: gcrypt doesn't come with pkg-config support ... so use plain old -lgcrypt to the linker to link with it. Fixes #225 - sftp_read: Value stored to 'next' is never read Detected by clang-analyzer - publickey_init: errors are negative, fix check Detected by clang-analyzer. - [Maxime Larocque brought this change] session_free: wrong variable used for keeping state If libssh2_session_free is called without the channel being freed previously by libssh2_channel_free a memory leak could occur. A mismatch of states variables in session_free() prevent the call to libssh2_channel_free function. session->state member is used instead of session->free_state. It causes a leak of around 600 bytes on every connection on my systems (Linux, x64 and PPC). (Debugging done under contract for Accedian Networks) Fixes #246 Guenter Knauf (29 Jun 2012) - Small NetWare makefile tweak. - Some small Win32 makefile fixes. Daniel Stenberg (19 Jun 2012) - libssh2_userauth_publickey_fromfile_ex.3: mention publickey == NULL - comp_method_zlib_decomp: handle Z_BUF_ERROR when inflating When using libssh2 to perform an SFTP file transfer from the "JSCAPE MFT Server" (http://www.jscape.com) the transfer failed. The default JSCAPE configuration is to enforce zlib compression on SSH2 sessions so the session was compressed. The relevant part of the debug trace contained: [libssh2] 1.052750 Transport: unhandled zlib error -5 [libssh2] 1.052750 Failure Event: -29 - decompression failure The trace comes from comp_method_zlib_decomp() in comp.c. The "unhandled zlib error -5" is the status returned from the zlib function inflate(). The -5 status corresponds to "Z_BUF_ERROR". The inflate() function takes a pointer to a z_stream structure and "inflates" (decompresses) as much as it can. The relevant fields of the z_stream structure are: next_in - pointer to the input buffer containing compressed data avail_in - the number of bytes available at next_in next_out - pointer to the output buffer to be filled with uncompressed data avail_out - how much space available at next_out To decompress data you set up a z_stream struct with the relevant fields filled in and pass it to inflate(). On return the fields will have been updated so next_in and avail_in show how much compressed data is yet to be processed and next_out and avail_out show how much space is left in the output buffer. If the supplied output buffer is too small then on return there will be compressed data yet to be processed (avail_in != 0) and inflate() will return Z_OK. In this case the output buffer must be grown, avail_out updated and inflate() called again. If the supplied output buffer was big enough then on return the compressed data will have been exhausted (avail_in == 0) and inflate() will return Z_OK, so the data has all been uncompressed. There is a corner case where inflate() makes no progress. That is, there may be unprocessed compressed data and space available in the output buffer and yet the function does nothing. In this case inflate() will return Z_BUF_ERROR. From the zlib documentation and the source code it is not clear under what circumstances this happens. It could be that it needs to write multiple bytes (all in one go) from its internal state to the output buffer before processing the next chunk of input but but can't because there is not enough space (though my guesses as to the cause are not really relevant). Recovery from Z_BUF_ERROR is pretty simple - just grow the output buffer, update avail_out and call inflate() again. The comp_method_zlib_decomp() function does not handle the case when inflate() returns Z_BUF_ERROR. It treats it as a non-recoverable error and basically aborts the session. Fixes #240 Guenter Knauf (12 Jun 2012) - MinGW makefile tweaks. Use GNU tools when compiling on Linux. Fixed dist and dev targets. - NetWare makefile tweaks. Changed to use Windows commandline tools instead of GNU tools when compiling on Windows. Fixed dist and dev targets. Enabled nlmconv error for unresolved symbols. Daniel Stenberg (11 Jun 2012) - Revert "config.rpath: generated file, no need to keep in git" This reverts commit 1ac7bd09cc685755577fb2c8829adcd081e7ab3c. This file still used by lib/*m4 functions so we need to keep the file around. - BINDINGS: added PySsh2, a Python-ctypes binding Guenter Knauf (8 Jun 2012) - Fixed MinGW debug build. Daniel Stenberg (5 Jun 2012) - BINDINGS: Added the Cocoa/Objective-C one ... and sorted the bindings after the languages, alphabetically Reported by: Mike Abdullah - BINDINGS: document the bindings we know of Guenter Knauf (4 Jun 2012) - Fixed LIBSSH2_INT64_T_FORMAT macro. Usually a format macro should hold the whole format, otherwise it should be named a prefix. Also fixed usage of this macro in scp.c for a signed var where it was used as prefix for unsigned. - Removed obsolete define from makefiles. - Renamed NetWare makefiles. - Renamed NetWare makefiles. - Synced MinGW makefiles with 56c64a6..39e438f. Also synced MinGW test makefile with b092696..f8cb874. Peter Stuge (30 May 2012) - Revert "sftp: Don't send attrs.permissions on read-only SSH_FXP_OPEN" This reverts commit 04e79e0c798674a0796be8a55f63dd92e6877790. - sftp: Don't send attrs.permissions on read-only SSH_FXP_OPEN This works around a protocol violation in the ProFTPD 1.3.4 mod_sftp server, as reported by Will Cosgrove in: http://libssh2.org/mail/libssh2-devel-archive-2012-05/0079.shtml Based on a suggested fix by TJ Saunders in: http://libssh2.org/mail/libssh2-devel-archive-2012-05/0104.shtml Guenter Knauf (28 May 2012) - Try to detect OpenSSL build type automatically. Also fixed recently added libgdi32 linkage which is only required when OpenSSL libs are linked statically. Daniel Stenberg (25 May 2012) - config.rpath: generated file, no need to keep in git Guenter Knauf (22 May 2012) - Updated dependency libary versions. Daniel Stenberg (18 May 2012) - 1.4.3: towards the future Version 1.4.2 (18 May 2012) Daniel Stenberg (18 May 2012) - RELEASE-NOTES: synced with 92a9f952794 Alexander Lamaison (15 May 2012) - win32/libssh2_config.h: Remove hardcoded #define LIBSSH2_HAVE_ZLIB. Rationale: Everything else in this file states a fact about the win32 platform that is unconditional for that platform. There is nothing unconditional about the presence of zlib. It is neither included with Windows nor with the platform SDK. Therefore, this is not an appropriate place to assert its presence. Especially as, once asserted, it cannot be overridden using a compiler flag. In contrast, if it is omitted, then it can easily be reasserted by adding a compiler flag defining LIBSSH2_HAVE_ZLIB. Daniel Stenberg (14 May 2012) - RELEASE-NOTES: synced with 69a3354467c - _libssh2_packet_add: SSH_MSG_CHANNEL_REQUEST default to want_reply RFC4254 says the default 'want_reply' is TRUE but the code defaulted to FALSE. Now changed. Fixes #233 - gettimeofday: no need for a replacement under cygwin Fixes #224 Alexander Lamaison (13 May 2012) - Prevent sftp_packet_read accessing freed memory. sftp_packet_add takes ownership of the packet passed to it and (now that we handle zombies) might free the packet. sftp_packet_read uses the packet type byte as its return code but by this point sftp_packet_add might have freed it. This change fixes the problem by caching the packet type before calling sftp_packet_add. I don't understand why sftp_packet_read uses the packet type as its return code. A future change might get rid of this entirely. Daniel Stenberg (12 May 2012) - sftp_packet_flush: flush zombies too As this function is called when the SFTP session is closed, it needs to also kill all zombies left in the SFTP session to avoid leaking memory just in case some zombie would still be in there. - sftp_packetlist_flush: zombies must not have responses already When flushing the packetlist, we must only add the request as a zombie if no response has already been received. Otherwise we could wrongly make it a zombie even though the response was already received and then we'd get a zombie stuck there "forever"... - sftp_read: on EOF remove packet before flush Since the sftp_packetlist_flush() function will move all the existing FXP_READ requests in this handle to the zombie list we must first remove this just received packet as it is clearly not a zombie. - sftp_packet_require: sftp_packet_read() returning 0 is not an error Exactly as the comment in the code said, checking the return code from sftp_packet_read() with <= was wrong and it should be < 0. With the new filtering on incoming packets that are "zombies" we can now see this getting zero returned. - sftp_packetlist_flush: only make it zombie if it was sent The list of outgoing packets may also contain packets that never were sent off and we better not make them zombies too. - [Alexander Lamaison brought this change] Mark outstanding read requests after EOF as zombies. In order to be fast, sftp_read sends many read requests at once. With a small file, this can mean that when EOF is received back, many of these requests are still outstanding. Responses arriving after we close the file and abandon the file handle are queued in the SFTP packet queue and never collected. This causes transfer speed to drop as a progressively longer queue must be searched for every packet. This change introduces a zombie request-ID list in the SFTP session that is used to recognise these outstanding requests and prevent them being added to the queue. Peter Stuge (23 Apr 2012) - [Rafael Kitover brought this change] Update win32/GNUmakefile to use OpenSSL 1.0.1a libcrypto on win32 now depends on gdi32.dll, so move the OpenSSL LDLIBS block to before the compiler definitions, so that libcrypto gets added first, and then add -lgdi32 into the following common LDLIBS for gcc. Guenter Knauf (23 Apr 2012) - Changed 'Requires' to 'Requires.private'. Only static builds need to link against the crypto libs. - Fixed 'Requires:' names. The 'Requires:' line lists the names of the .pc files. - Added 'Requires:' line to libssh2.pc. This is necessary so that other libs which lookup libssh2 info via pkg-config can add the right crypto lib dependencies. - Updated dependency lib versions. Peter Stuge (18 Apr 2012) - configure.ac: Add option to disable build of the example applications Examples are built by default. Any of the following options on the configure command line will skip building them: --disable-examples-build --enable-examples-build=no --enable-examples-build=false - userauth.c: fread() from public key file to correctly detect any errors If the filename parameter for file_read_publickey() was the name of a directory instead of a file then libssh2 would spin trying to fgetc() from the FILE * for the opened directory when trying to determine the length of the encoded public key, since fgetc() can't report errors. Use fread() instead to correctly detect this error condition along with many others. This fixes the problem reported in http://www.libssh2.org/mail/libssh2-devel-archive-2012-04/0021.shtml Reported-by: Oleksiy Zagorskyi <zalex_ua@i.ua> - Return LIBSSH2_ERROR_SOCKET_DISCONNECT on EOF when reading banner Guenter Knauf (17 Apr 2012) - Fixed copyright year. - Updated dependency lib versions in static makefiles. Daniel Stenberg (6 Apr 2012) - version: bump to 1.4.2 We're on the 1.4.2 track now (at least) Version 1.4.1 (4 Apr 2012) Daniel Stenberg (4 Apr 2012) - RELEASE-NOTES: updated for 1.4.1 release - always do "forced" window updates When calling _libssh2_channel_receive_window_adjust() internally, we now always use the 'force' option to prevent libssh2 to avoid sending the update if the update isn't big enough. It isn't fully analyzed but we have seen corner cases which made a necessary window update not get send due to this and then the other side doesn't send data our side then sits waiting for forever. - channel_read: force window adjusts! if there's not enough room to receive the data that's being requested, the window adjustment needs to be sent to the remote and thus the force option has to be used. _libssh2_channel_receive_window_adjust() would otherwise "queue" small window adjustments for a later packet but that is really terribly for the small buffer read that for example is the final little piece of a very large file as then there is no logical next packet! Reported by: Armen Babakhanian Bug: http://www.libssh2.org/mail/libssh2-devel-archive-2012-03/0130.shtml - [Paul Howarth brought this change] aes: the init function fails when OpenSSL has AES support The internal init function only worked fine when the configure script didn't detect the OpenSSL AES_CTR function! Bug: http://www.libssh2.org/mail/libssh2-devel-archive-2012-03/0111.shtml Reported by: Paul Howarth - [Matthew Booth brought this change] transport_send: Finish in-progress key exchange before sending data _libssh2_channel_write() first reads outstanding packets before writing new data. If it reads a key exchange request, it will immediately start key re-exchange, which will require sending a response. If the output socket is full, this will result in a return from _libssh2_transport_read() of LIBSSH2_ERROR_EAGAIN. In order not to block a write because there is no data to read, this error is explicitly ignored and the code continues marshalling a packet for sending. When it is sent, the remote end immediately drops the connection because it was expecting a continuation of the key exchange, but got a data packet. This change adds the same check for key exchange to _libssh2_transport_send() that is in _libssh2_transport_read(). This ensures that key exchange is completed before any data packet is sent. - channel_write: acknowledge transport errors When draining data off the socket with _libssh2_transport_read() (which in turn has to be done so that we can be sure to have read any possible window-increasing packets), this code previously ignored errors which could lead to nasty loops. Now all error codes except EAGAIN will cause the error to be returned at once. Bug: http://www.libssh2.org/mail/libssh2-devel-archive-2012-03/0068.shtml Reported by: Matthew Booth - [Steven Dake brought this change] In examples/x11.c, Make sure sizeof passed to read operation is correct sizeof(buf) expands to 8 or 4 (since its a pointer). This variable may have been static in the past, leading to this error. Signed-off-by: Steven Dake <sdake@redhat.com> - [Steven Dake brought this change] Fix suspicious sizeof usage in examples/x11.c In the x11 example, sizeof(buf) = 8UL (on x86_64), when this should probably represent the buffer size available. I am not sure how to test that this change is actually correct, however. Signed-off-by: Steven Dake <sdake@redhat.com> - sftp_packet_read: follow-up fix for EAGAIN/window adjust The commit in 7194a9bd7ba45 wasn't complete. This change makes sure variables are initialized properly before used in the EAGAIN and window adjust cases. - sftp_packet_add: use named error code instead of number - sftp_packet_add: verify the packet before accepting it In order to bail out as quickly as possible when things are wrong and out of sync, make sure the SFTP message is one we understand. - SFTP: preserve the original error code more Lots of places in the code translated the original error into the more generic LIBSSH2_ERROR_SOCKET_TIMEOUT but this turns out to distort the original error reason a lot and makes tracking down the real origin of a problem really hard. This change makes the original error code be preserved to a larger extent when return up to the parent function. - sftp_packet_read: adjust window size as necessary Commit 03ca9020756 tried to simplify the window sizing logic but broke SFTP readdir as there was no window sizing code left there so large directory listings no longer worked. This change introduces window sizing logic to the sftp_packet_read() function so that it now tells the remote about the local size having a window size that suffice when it is about to ask for directory data. Bug: http://www.libssh2.org/mail/libssh2-devel-archive-2012-03/0069.shtml Reported by: Eric - [Steven Dake brought this change] Tell C compiler we don't care about return code of libssh2_init The call of libssh2_init returns a return code, but nothing could be done within the _libssh2_init_if_needed execution path. Signed-off-by: Steven Dake <sdake@redhat.com> - [Steven Dake brought this change] Add comment indicating a resource leak is not really a resource leak While possibly obvious to those investigating the code, coverity complains about this out of scope leak. Signed-off-by: Steven Dake <sdake@redhat.com> - [Steven Dake brought this change] Use safer snprintf rather then sprintf in scp_send() Signed-off-by: Steven Dake <sdake@redhat.com> - [Steven Dake brought this change] Use safer snprintf rather then sprintf in scp_recv() While the buffer is indeed allocated to a safe length, better safe then sorry. Signed-off-by: Steven Dake <sdake@redhat.com> - [Steven Dake brought this change] use snprintf in knownhost_writeline() rather then sprintf Although the function checks the length, if the code was in error, there could potentially be a buffer overrun with the use of sprintf. Instead replace with snprintf. Signed-off-by: Steven Dake <sdake@redhat.com> - [Steven Dake brought this change] Add tracing to print packets left on session at libssh2_session_free Signed-off-by: Steven Dake <sdake@redhat.com> Peter Stuge (2 Mar 2012) - Define and use LIBSSH2_INVALID_SOCKET instead of INVALID_SOCKET INVALID_SOCKET is a special value in Windows representing a non-valid socket identifier. We were #defining this to -1 on non-Windows platforms, causing unneccessary namespace pollution. Let's have our own identifier instead. Thanks to Matt Lawson for pointing this out. - nw/Makefile.netware: Fix project name typo to avoid needless confusion - example/x11: Set raw terminal mode manually instead of with cfmakeraw() OpenSolaris has no cfmakeraw() so to make the example more portable we simply do the equivalent operations on struct termios ourselves. Thanks to Tom Weber for reporting this problem, and finding a solution. Daniel Stenberg (17 Feb 2012) - sftp_write: cannot return acked data *and* EAGAIN Whenever we have acked data and is about to call a function that *MAY* return EAGAIN we must return the number now and wait to get called again. Our API only allows data *or* EAGAIN and we must never try to get both. Peter Stuge (13 Feb 2012) - example/x11: Build only when sys/un.h is found by configure The example can't be built on systems without AF_UNIX sockets. Daniel Stenberg (10 Feb 2012) - [Alexander Lamaison brought this change] Simplified sftp_read. Removed the total_read variable that originally must have tracked how much data had been written to the buffer. With non-blocking reads, we must return straight away once we have read data into the buffer so this variable served not purpose. I think it was still hanging around in case the initial processing of 'leftover' data meant we wrote to the buffer but this case, like the others, must return immediately. Now that it does, the last remaining need for the variable is gone. - [Alexander Lamaison brought this change] Cleaned up sftp_read and added more explanation. Replaced the gotos which were implementing the state machine with a switch statement which makes the states more explicit. - sftp_read: avoid data *and* EAGAIN Whenever we have data and is about to call a function that *MAY* return EAGAIN we must return the data now and wait to get called again. Our API only allows data *or* EAGAIN and we must never try to get both. Peter Stuge (2 Feb 2012) - Add a tcpip-forward example which demonstrates remote port forwarding - libssh2.h: Add missing prototype for libssh2_session_banner_set() - example/subsystem_netconf.c: Return error when read buffer is too small Also remove a little redundancy in the read loop condition. - example/subsystem_netconf.c: Add a missing newline in an error message - Fix undefined reference to _libssh_error in libgcrypt backend Commit 209de22299b4b58e582891dfba70f57e1e0492db introduced a function call to a non-existing function, and since then the libgcrypt backend has not been buildable. Version 1.4.0 (31 Jan 2012) Daniel Stenberg (31 Jan 2012) - RELEASE-NOTES: synced with 6bd584d29 for 1.4.0 - s/1.3.1/1.4.0 We're bumping the minor number - [Jernej Kovacic brought this change] libssh2_session_supported_algs: fix compiler warning - [Jernej Kovacic brought this change] session_supported_algs docs: added an example - [Gellule Xg brought this change] sftp-seek: clear EOF flag Set the EOF flag to False when calling seek64 to be able to get some data back on a following read - [Peter Krempa brought this change] userauth: Provide more informations if ssh pub key extraction fails If the function that extracts/computes the public key from a private key fails the errors it reports were masked by the function calling it. This patch modifies the key extraction function to return errors using _libssh_error() function. The error messages are tweaked to contain reference to the failed operaton in addition to the reason. * AUTHORS: - add my name * libgcrypt.c: _libssh2_pub_priv_keyfile(): - return a more verbose error using _libssh2_error() func. * openssl.c: - modify call graph of _libssh2_pub_priv_keyfile() to use _libssh2_error for error reporting(); * userauth.c: - tweak functions calling _libssh2_pub_priv_keyfile() not to shadow error messages - TODO: remove issues we (sort of) did already - ssh2_exec: skip error outputs for EAGAIN Since the example uses non-blocking mode, it will just flood the output with this "nonsense" error. Guenter Knauf (30 Nov 2011) - Some NetWare makefile tweaks. Daniel Stenberg (18 Nov 2011) - LIBSSH2_SFTP_PACKET_MAXLEN: increase to 80000 Some SFTP servers send SFTP packets larger than 40000. Since the limit is only present to avoid insane sizes anyway, we can easily bump it. The define was formerly in the public header libssh2_sftp.h but served no external purpose and was moved into the source dir. Bug: http://www.libssh2.org/mail/libssh2-devel-archive-2011-11/0004.shtml Reported by: Michael Harris Alexander Lamaison (18 Nov 2011) - [Peter Krempa brought this change] knownhost_check(): Don't dereference ext if NULL is passed Documentation for libssh2_knownhost_checkp() and related functions states that the last argument is filled with data if non-NULL. "knownhost if set to non-NULL, it must be a pointer to a 'struct libssh2_knownhost' pointer that gets filled in to point to info about a known host that matches or partially matches." In this function ext is dereferenced even if set to NULL, causing segfault in applications not needing the extra data. Daniel Stenberg (11 Nov 2011) - [Peter Krempa brought this change] knownhost_add: Avoid dereferencing uninitialized memory on error path. In function knownhost_add, memory is alocated for a new entry. If normal alocation is used, memory is not initialized to 0 right after, but a check is done to verify if correct key type is passed. This test is done BEFORE setting the memory to null, and on the error path function free_host() is called, that tries to dereference unititialized memory, resulting into a glibc abort(). * knownhost.c - knownhost_add(): - move typemask check before alloc - windows build: add define to avoid compiler warning A recent mingw compiler has started to complain on "#warning Please include winsock2.h before windows.h" unless the magic define is set first. Reported by: Vincent Torri Bug: http://www.libssh2.org/mail/libssh2-devel-archive-2011-10/0064.shtml Henrik Nordstrom (31 Oct 2011) - [Vincent Torri brought this change] Correct Windows include file name case, simplifying cross-compilation When cross compiling to Windows, libssh2.h include Windows header files with upper case filenames : BaseTsd.h and WinSock2.h. These files have lowercase names with mingw-w64 (iirc, it's the same with mingw). And as on Windows, being lowercase or uppercase does not matter. Daniel Stenberg (25 Oct 2011) - [Jernej Kovacic brought this change] libssh2_session_supported_algs: added - [Kamil Dudka brought this change] example/sftp_RW_nonblock: do not ignore LIBSSH2_ERROR_EAGAIN Bug: https://bugzilla.redhat.com/745420 Peter Stuge (5 Oct 2011) - example/ssh2_agent: Print host key fingerprint before authentication Also moves the comment about not being authenticated to before the agent authentication takes place, so that it better matches the code. Daniel Stenberg (29 Sep 2011) - OpenSSL EVP: fix threaded use of structs Make sure we don't clear or reset static structs after first init so that they work fine even when used from multiple threads. Init the structs in the global init. Help and assistance by: John Engstrom Fixes #229 (again) - openssl: don't init static structs differently make_ctr_evp() is changed to take a struct pointer, and then each _libssh2_EVP_aes_[keylen]_ctr function is made to pass in their own static struct Reported by: John Engstrom Fixes #229 Guenter Knauf (27 Sep 2011) - Removed obsolete include path. Daniel Stenberg (21 Sep 2011) - read_state: clear the state variable better Set read_state back to idle before trying to send anything so that if the state somehow is wrongly set. Also, avoid such a case of confusion by resetting the read_state when an sftp handle is closed. - sftp_read: remove leftover fprintf Reported by: Alexander Lamaison - sftp.h: fix the #ifdef to prevent multiple inclusions - sftp_read: use a state variable to avoid bad writes When a channel_write call has gotten an EAGAIN back, we try harder to continue the same write in the subsequent invoke. - window_size: explicit adjustments only Removed the automatic window_size adjustments from _libssh2_channel_read() and instead all channel readers must now make sure to enlarge the window sizes properly themselves. libssh2_channel_read_ex() - the public function, now grows the window size according to the requested buffer size. Applications can still opt to grow the window more on demand. Larger windows tend to give higher performance. sftp_read() now uses the read-ahead logic to figure out a window_size. - libssh2.h: bump the default window size to 256K - libssh2_userauth_keyboard_interactive.3: fix man warning It seemed to occur due to the excessive line length - [Mikhail Gusarov brought this change] Add missing .gitignore entries - [Mikhail Gusarov brought this change] Add manpage syntax checker to 'check' target In virtually every libssh2 release Debian's lintian catches syntax errors in manpages. Prevent it by checking manpages as a part of testsuite. - libssh2_banner_set.3: fix nroff syntax mistake Guenter Knauf (10 Sep 2011) - Use predefined resource compiler macro. - Added casts to silent compiler warnings. - Fixed uint64_t printf. - Fixed macro function signatures. - NetWare makefile tweaks. - Removed unused var. - Added 2 samples not mentioned. - Dont build x11 sample with MinGW. - Fixed executable file description. - Removed unused var. - Kill stupid gcc 3.x uninitialized warning. - Build all examples. - More MinGW makefile tweaks. Renamed *.mingw makefiles to GNUmakefile since GNU make picks these up automatically, and therefore win32/Makefile removed. - Removed forgotten WINSOCK_VERSION defines. Daniel Stenberg (9 Sep 2011) - libssh2_session_startup(3) => libssh2_session_handshake(3) Propagate for the current function in docs and examples. libssh2_session_startup() is deprecated. - libssh2_banner_set => libssh2_session_banner_get Marked the old function as deprecated. Added the new name in the correct name space with the same arguments and functionality. - new function: libssh2_session_banner_get Returns the banner from the server handshake Fixes #226 - libssh2.h: bump version to 1.4.0 for new function(s) - remove embedded CVS/svn tags - [liuzl brought this change] API add:libssh2_sftp_get_channel Return the channel of sftp, then caller can control the channel's behavior. Signed-off-by: liuzl <xieepp@gmail.com> - _libssh2_channel_read: react on errors from receive_window_adjust Previously the function would ignore all errors except for EAGAIN. - sftp_read: extend and clarify the documentation - sftp_read: cap the read ahead maximum amount Now we only go up to LIBSSH2_CHANNEL_WINDOW_DEFAULT*30 bytes SFTP read ahead, which currently equals 64K*30 == 1966080 bytes. - _libssh2_channel_read: fix non-blocking window adjusting If EAGAIN is returned when adjusting the receive window, we must not read from the transport directly until we've finished the adjusting. Guenter Knauf (8 Sep 2011) - Fix for systems which need sys/select.h. - The files were not gone but renamed ... Daniel Stenberg (6 Sep 2011) - sftp_read: added documenting comment Taken from some recent email conversations I added some descriptions of the logic in sftp_read() to aid readers. - 1.3.1: start the work Version 1.3.0 (6 Sep 2011) Daniel Stenberg (6 Sep 2011) - Makefile.am: the Makefile.win32 files are gone - RELEASE-NOTES: updated for 1.3.0 - sftp_read: a short read is not end of file A returned READ packet that is short will now only reduce the offset. This is a temporary fix as it is slightly better than the previous approach but still not very good. - [liuzl brought this change] _libssh2_packet_add: adjust window size when truncating When receiving more data than what the window size allows on a particular channel, make sure that the window size is adjusted in that case too. Previously it would only adjust the window in the non-error case. Guenter Knauf (29 Aug 2011) - Silent compiler warning with MinGW64. - Fixed link to native Win32 awk tool. - Renamed MinGW makefiles. - Some MinGW makefile tweaks. Enable build without GNU tools and with MinGW64 compiler. - Fixed aes_ctr_do_cipher() signature. Daniel Stenberg (26 Aug 2011) - [liuzl brought this change] libssh2_sftp_seek64: flush packetlist and buffered data When seeking to a new position, flush the packetlist and buffered data to prevent already received or pending data to wrongly get used when sftp-reading from the new offset within the file. - sftp_read: advance offset correctly for buffered copies In the case where a read packet has been received from the server, but the entire contents couldn't be copied to the user-buffer, the data is instead buffered and copied to the user's buffer in the next invocation of sftp_read(). When that "extra" copy is made, the 'offset' pointer was not advanced accordingly. The biggest impact of this flaw was that the 'already' variable at the top of the function that figures out how much data "ahead" that has already been asked for would slowly go more and more out of sync, which could lead to the file not being read all the way to the end. This problem was most noticable in cases where the application would only try to read the exact file size amount, like curl does. In the examples libssh2 provides the sftp read function is most often called with a fixed size large buffer and then the bug would not appear as easily. This bug was introduced in the SFTP rewrite in 1.2.8. Bug: http://curl.haxx.se/mail/lib-2011-08/0305.html http://www.libssh2.org/mail/libssh2-devel-archive-2011-08/0085.shtml - wrap some long lines < 80 columns - LIBSSH2_RECV: fix typo, use the RECV_FD macro - subsystem_netconf.c: fix compiler warnings - [Henrik Nordstrom brought this change] Custom callbacks for performing low level socket I/O - version bump: start working towards 1.3.0 Version 1.2.9 (16 Aug 2011) Daniel Stenberg (16 Aug 2011) - RELEASE-NOTES: synced with 95d69d3a81261 - [Henrik Nordstrom brought this change] Document prototypes for macro defined functions - [Henrik Nordstrom brought this change] Avoid reuse after free when closing X11 channels - _libssh2_channel_write: handle window_size == 0 better When about to send data on the channel and the window size is 0, we must not just return 0 if the transport_read() function returned EAGAIN as it then causes a busy-loop. Bug: http://libssh2.org/mail/libssh2-devel-archive-2011-08/0011.shtml - gettimeofday: fix name space pollution For systems without its own gettimeofday() implementation, we still must not provide one outside our namespace. Reported by: Bill Segall Dan Fandrich (5 Aug 2011) - libssh2.pc.in: Fixed spelling in pkgconfig file Peter Stuge (17 Jul 2011) - example/subsystem_netconf.c: Add missing #include <string.h> - example/subsystem_netconf.c: Discard ]]>]]> and return only XML response - example/subsystem_netconf.c: Fix uninitialized variable bug - example: Add subsystem_netconf.c This example demonstrates how to use libssh2 to send a request to the NETCONF subsystem available e.g. in JunOS. See also http://tools.ietf.org/html/draft-ietf-netconf-ssh-06 Daniel Stenberg (16 Jul 2011) - man page cleanups: non-existing functions need no man pages - libssh2_new_host_entry.3: removed This is just junk leftovers. - userauth_keyboard_interactive: fix buffer overflow Partly reverse 566894494b4972ae12 which was simplifying the code far too much and ended up overflowing a buffer within the LIBSSH2_SESSION struct. Back to allocating the buffer properly like it used to do. Bug: http://www.libssh2.org/mail/libssh2-devel-archive-2011-06/0032.shtml Reported by: Alfred Gebert - keyboard-interactive man page: cleaned up - [Alfred Gebert brought this change] _libssh2_recv(): handle ENOENT error as EAGAIN A sftp session failed with error "failure establishing ssh session" on Solaris and HP-UX. Sometimes the first recv() function call sets errno to ENOENT. In the man pages for recv of Solaris and HP-UX the error ENOENT is not documented. I tested Solaris SPARC and x86, HP-UX i64, AIX, Windows and Linux. - agent_list_identities: fix out of scope access An auto variable out of scope was being referenced and used. fixes #220 - _libssh2_wait_socket: fix timeouts for poll() uses - windows: inclusion fix include winsock2.h for all windows compilers - keyb-interactive: add the fixed buffer Belongs to commit 5668944 - code cleanup: don't use C99/c++ comments We aim for C89 compliance - keyb-interactive: allow zero length fields Allow zero length fields so they don't cause malloc(0) calls Avoid free()ing NULL pointers Avoid a malloc of a fixed 5 byte buffer. - libssh2_channel_process_startup.3: clean up Remove the references to the macro-fied shortcuts as they have their own individual man pages. Made the prototype different and more readable. - man page: fix .BR lines We don't use \fI etc on .BR lines - userauth_keyboard_interactive: skip code on zero length auth - libssh2_channel_forward_accept.3: mention how to get error Since this returns a pointer, libssh2_session_last_errno() must be used to get the actual error code and it wasn't that clear before. - timeout docs: mention they're added in 1.2.9 - sftp_write_sliding.c: indent fix Use the standard indenting and removed CVS leftover comment - [zl liu brought this change] sftp_write_sliding: send the complete file When reaching the end of file there can still be data left not sent. - [Douglas Masterson brought this change] session_startup: init state properly libssh2_session_startup() didn't set the state correctly so it could get confused. Fixes #218 - timeout: added man pages - BLOCK_ADJUST_ERRNO: move rc to right level We can't declare the variable within the block and use it in the final do-while() expression to be properly portable C89. - [Matt Lilley brought this change] adds a timeout to blocking calls Fixes bug #160 as per Daniel's suggestion Adds libssh2_session_set_timeout() and libssh2_session_get_timeout() - SCP: fix incorrect error code After an error occurs in libssh2_scp_recv() or libssh2_scp_send(), the function libssh2_session_last_error() would return LIBSSH2_ERROR_SOCKET_NONE on error. Bug: http://trac.libssh2.org/ticket/216 Patch by: "littlesavage" Fixes #216 Guenter Knauf (19 Apr 2011) - Updated default (recommended) dependency versions. Daniel Stenberg (17 Apr 2011) - libssh2_session_block_directions: fix mistake The last LIBSSH2_SESSION_BLOCK_INBOUND should be LIBSSH2_SESSION_BLOCK_OUTBOUND And I shortened the short description Reported by: "drswinghead" - msvcproj: added libs and debug stuff Added libraries needed to link whether using openssl dynamically or statically Added LIBSSH2DEBUG define to debug versions to enable tracing URL: http://trac.libssh2.org/ticket/215 Patch by: Mark Smith - sftp_write: clean offsets on error When an error has occurred on FXP_WRITE, we must make sure that the offset, sent offset and acked counter are reset properly. - example/.gitignore: ignore built binaries - sftp_write: flush the packetlist on error When an error occurs during write, flush the entire list of pending outgoing SFTP packets. - keepalive: add first basic man pages Someone on IRC pointed out that we don't have these documented so I wrote up a first set based on the information in the wiki: http://trac.libssh2.org/wiki/KeepAlive - scp_write_nonblock.c: remove pointless check libssh2_channel_write() cannot return a value that is larger than the input length value Mikhail Gusarov (9 Apr 2011) - s/\.NF/.nf/ to fix wrong macro name caught by man --warnings Daniel Stenberg (6 Apr 2011) - version: bump to 1.2.9_dev Also update the copyright year range to include 2011 - configure: fix $VERSION Stop using the $VERSION variable as it seems to be magically used by autoconfig itself and thus gets set to the value set in AC_INIT() without us wanting that. $LIBSSH2VER is now the libssh2 version as detected. Reported by: Paul Howarth Bug: http://www.libssh2.org/mail/libssh2-devel-archive-2011-04/0008.shtml - maketgz: use git2news.pl by the correct name Version 1.2.8 (4 Apr 2011) Daniel Stenberg (4 Apr 2011) - RELEASE-NOTES: synced with fabf1a45ee - NEWS: auto-generated from git Starting now, the NEWS file is generated from git using the git2news.pl script. This makes it always accurate and up-to-date, even for daily snapshots etc. - sftp_write: handle FXP_WRITE errors When an sftp server returns an error back on write, make sure the function bails out and returns the proper error. - configure: stop using the deprecated AM_INIT_AUTOMAKE syntax Alexander Lamaison (13 Mar 2011) - Support unlimited number of host names in a single line of the known_hosts file. Previously the code assumed either a single host name or a hostname,ip-address pair. However, according to the spec [1], there can be any number of comma separated host names or IP addresses. [1] http://www.openbsd.org/cgi-bin/man.cgi?query=sshd&sektion=8 Daniel Stenberg (26 Feb 2011) - libssh2_knownhost_readfile.3: clarify return value This function returns the number of parsed hosts on success, not just zero as previously documented. Peter Stuge (26 Feb 2011) - Don't save allocated packet size until it has actually been allocated The allocated packet size is internal state which needs to match reality in order to avoid problems. This commit fixes #211. Daniel Stenberg (21 Feb 2011) - [Alfred Gebert brought this change] session_startup: manage server data before server identification Fix the bug that libssh2 could not connect if the sftp server sends data before sending the version string. http://tools.ietf.org/html/rfc4253#section-4.2 "The server MAY send other lines of data before sending the version string. Each line SHOULD be terminated by a Carriage Return and Line Feed. Such lines MUST NOT begin with "SSH-", and SHOULD be encoded in ISO-10646 UTF-8 [RFC3629] (language is not specified). Clients MUST be able to process such lines." - [Alfred Gebert brought this change] fullpacket: decompression only after init The buffer for the decompression (remote.comp_abstract) is initialised in time when it is needed. With this fix decompression is disabled when the buffer (remote.comp_abstract) is not initialised. Bug: http://trac.libssh2.org/ticket/200 - _libssh2_channel_read: store last error When the transport layer returns EAGAIN this function didn't call _libssh2_error() which made the last_error not get set. - sftp_write: clarified the comment header - sftp_read: avoid wrapping counter to insanity As pointed out in bug #206, if a second invoke of libssh2_sftp_read() would shrink the buffer size, libssh2 would go nuts and send out read requests like crazy. This was due to an unsigned variable turning "negative" by some wrong math, and that value would be the amount of data attempt to pre-buffer! Bug: http://trac.libssh2.org/ticket/206 - sftp_packet_read: use 32bit variables for 32bit data - libssh2_sftp_stat_ex.3: cleaned up, extended Removed the macros from it as they have their own man pages. Added the LIBSSH2_SFTP_ATTRIBUTES struct in here for easier reference. - sftp_readdir: return error if buffer is too small If asked to read data into a buffer and the buffer is too small to hold the data, this function now returns an error instead of as previously just copy as much as fits. - sftp_symlink: return error if receive buffer too small and clean up some variable type mismatches Discussion: http://www.libssh2.org/mail/libssh2-devel-archive-2011-01/0001.shtml - docs: clarify what happens with a too small buffer This flaw is subject to change, but I figured it might be valuable to users of existing code to know how it works. - channel_request_pty_size: fix reqPTY_state The state variable isn't properly set so every other call to the function fails! Bug: http://libssh2.org/mail/libssh2-devel-archive-2010-12/0096.shtml Reported by: Steve Legg - data size: cleanup Fix 64bit warnings by using (s)size_t and dedicated uint32_t types more. - [Pierre Joye brought this change] ssize_t: proper typedef with MSVC compilers As discussed on the mailing list, it was wrong for win64 and using the VC-provided type is the safest approach instead of second- guessing which one it should be. Guenter Knauf (22 Dec 2010) - Updated OpenSSL version. - Expanded tabs to spaces. Peter Stuge (21 Dec 2010) - [Joey Degges brought this change] _libssh2_ntohu64: fix conversion from network bytes to uint64 Cast individual bytes to uint64 to avoid overflow in arithmetic. Daniel Stenberg (20 Dec 2010) - libssh2_userauth_list: language fix "faily" is not a good English word, and I also cleaned up some other minor mistakes - crypto: unify the generic functions Added crypto.h that is the unified header to include when using crypto functionality. It should be the only header that needs to adapt to the underlying crypto library in use. It provides the set of prototypes that are library agnostic. - [Mark Smith brought this change] userauth: derive publickey from private Pass a NULL pointer for the publickey parameter of libssh2_userauth_publickey_fromfile and libssh2_userauth_hostbased_fromfile functions. In this case, the functions recompute the public key from the private key file data. This is work done by Jean-Louis CHARTON <Jean-Louis.CHARTON@oikialog.com>, then adapted by Mark Smith and slightly edited further by me Daniel. WARNING: this does leave the feature NOT WORKING when libssh2 is built to use libgcrypt instead of OpenSSL simply due to lack of implementation. - ssh2_echo: Value stored to 'exitcode' is never read - _libssh2_packet_add: fix SSH_MSG_DEBUG weirdness I believe I may have caused this weird typo style error when I cleaned up this function a while ago. Corrected now. - uint32: more longs converted to proper types I also moved the MAC struct over to the mac.h header file and made sure that the users of that struct include that file. - SFTP: more types to uint32_t The 'num_names' field in the SSH_FXP_NAME response is an unsigned 32bit value so we make sure to treat it like that. - SFTP: request_ids are uint32_t I went over the code and made sure we use uint32_t all over for the request_id data. It is an unsigned 32bit value on the wire. - SFTP: store request_id separately in packets By using a new separate struct for incoming SFTP packets and not sharing the generic packet struct, we can get rid of an unused field and add a new one dedicated for holding the request_id for the incoming package. As sftp_packet_ask() is called fairly often, a "mere" integer comparison is MUCH faster than the previous memcmp() of (typically) 5 bytes. - libssh2_sftp_open_ex: man page extended and cleaned up I added the missing documentation for the 'flags' argument. - SFTP: unify the READ/WRITE chunk structs - SFTP: fix memory leaks Make sure that we cleanup remainders when the handle is closed and when the subsystem is shutdown. Existing flaw: if a single handle sends packets that haven't been replied to yet at the time when the handle is closed, those packets will arrive later and end up in the generic packet brigade queue and they will remain in there until flushed. They will use unnecessary memory, make things slower and they will ruin the SFTP handling if the request_id counter ever wraps (highly unlikely to every happen). - sftp_close_handle: packet list is generic Fix comment, simplify the loop logic - sftp_read: pipeline reads The SFTP read function now does transfers the same way the SFTP write function was made to recently: it creates a list of many outgoing FXP_READ packets that each asks for a small data chunk. The code then tries to keep sending read request while collecting the acks for the previous requests and returns the received data. - sftp_write: removed unused variable - _libssh2_channel_close: don't call transport read if disconnected The loop that waits for remote.close to get set may end up looping forever since session->socket_state gets set to LIBSSH2_SOCKET_DISCONNECTED by the packet_add() function called from the transport_read() function and after having been set to LIBSSH2_SOCKET_DISCONNECTED, the transport_read() function will only return 0. Bug: http://trac.libssh2.org/ticket/198 - libssh2_sftp_seek64: new man page Split off libssh2_sftp_seek64 from the libssh2_sftp_seek man page, and mentioned that we consider the latter deprecated. Also added a mention about the dangers of doing seek during writing or reading. - sftp_seek: fix The new SFTP write code caused a regression as the seek function no longer worked as it didn't set the write position properly. It should be noted that seeking is STRONGLY PROHIBITED during upload, as the upload magic uses two different offset positions and the multiple outstanding packets etc make them sensitive to change in the midst of operations. This functionality was just verified with the new example code sftp_append. This bug was filed as bug #202: Bug: http://trac.libssh2.org/ticket/202 - sftp_append: new example doing SFTP append - MAX_SFTP_OUTGOING_SIZE: 30000 I ran SFTP upload tests against localhost. It showed that to make the app reach really good speeds, I needed to do a little code tweak and change MAX_SFTP_OUTGOING_SIZE from 4000 to 30000. The tests I did before with the high latency tests didn't show any real difference whatever I had that size set to. This number is the size in bytes that libssh2 cuts off the large input buffer and sends off as an individual sftp packet. - sftp_write_sliding.c: new example This is an example that is very similar to sftp_write_nonblock.c, with the exception that this uses 1 - a larger upload buffer 2 - a sliding buffer mechnism to allow the app to keep sending lots of data to libssh2 without having to first drain the buffer. These are two key issues to make libssh2 SFTP uploads really perform well at this point in time. - cpp: s/#elsif/#elif This looks like a typo as #elsif is not really C... - _libssh2_channel_write: revert channel_write() use The attempts made to have _libssh2_channel_write() accept larger pieces of data and split up the data by itself into 32700 byte chunks and pass them on to channel_write() in a loop as a way to do faster operations on larger data blocks was a failed attempt. The reason why it is difficult: The API only allows EAGAIN or a length to be returned. When looping over multiple blocks to get sent, one block can get sent and the next might not. And yet: when transport_send() has returned EAGAIN we must not call it again with new data until it has returned OK on the existing data it is still working on. This makes it a mess and we do get a much easier job by simply returning the bytes or EAGAIN at once, as in the EAGAIN case we can assume that we will be called with the same arguments again and transport_send() will be happy. Unfortunately, I think we take a small performance hit by not being able to do this. - ssh2_echo: new example This is a new example snippet. The code is largely based on ssh2_exec, and is written by Tommy Lindgren. I edited it into C90 compliance and to conform to libssh2 indent style and some more. - send_existing: return after send_existing When a piece of data is sent from the send_existing() function we must make the parent function return afterwards. Otherwise we risk that the parent function tries to send more data and ends up getting an EGAIN for that more data and since it can only return one return code it doesn't return info for the successfully sent data. As this change is a regression I now added a larger comment explaining why it has to work like this. - _libssh2_channel_write: count resent data as written In the logic that resends data that was kept for that purpose due to a previous EAGAIN, the data was not counted as sent causing badness. Peter Stuge (13 Nov 2010) - Use fprintf(stderr, ) instead of write(2, ) for debugging - session/transport: Correctly handle when _libssh2_send() returns -EAGAIN - src/agent.c: Simplify _libssh2_send() error checking ever so slightly Daniel Stenberg (12 Nov 2010) - send/recv: use _libssh2_recv and _libssh2_send now Starting now, we unconditionally use the internal replacement functions for send() and recv() - creatively named _libssh2_recv() and _libssh2_send(). On errors, these functions return the negative 'errno' value instead of the traditional -1. This design allows systems that have no "natural" errno support to not have to invent it. It also means that no code outside of these two transfer functions should use the errno variable. - channel_write: move some logic to _libssh2_channel_write Some checks are better done in _libssh2_channel_write just once per write instead of in channel_write() since the looping will call the latter function multiple times per _libssh2_channel_write() invoke. - sftp_write: handle "left over" acked data The SFTP handle struct now buffers number of acked bytes that haven't yet been returned. The way this is used is as following: 1. sftp_write() gets called with a buffer of let say size 32000. We split 32000 into 8 smaller packets and send them off one by one. One of them gets acked before the function returns so 4000 is returned. 2. sftp_write() gets called again a short while after the previous one, now with a much smaller size passed in to the function. Lets say 8000. In the mean-time, all of the remaining packets from the previous call have been acked (7*4000 = 28000). This function then returns 8000 as all data passed in are already sent and it can't return any more than what it got passed in. But we have 28000 bytes acked. We now store the remaining 20000 in the handle->u.file.acked struct field to add up in the next call. 3. sftp_write() gets called again, and now there's a backlogged 20000 bytes to return as fine and that will get skipped from the beginning of the buffer that is passed in. - sftp_write: polished and simplified Removed unnecessary struct fields and state changes within the function. Made the loop that checks for ACKs only check chunks that were fully sent. - SCP: on failure, show the numerical error reason By calling libssh2_session_last_errno() - SFTP: provide the numerical error reason on failure - SCP: clean up failure treatment When SCP send or recv fails, it gets a special message from the server with a warning or error message included. We have no current API to expose that message but the foundation is there. Removed unnecessary use of session struct fields. - sftp_write: enlarge buffer to perform better - packets: code cleanup I added size checks in several places. I fixed the code flow to be easier to read in some places. I removed unnecessary zeroing of structs. I removed unused struct fields. - LIBSSH2_CALLBACK_MACERROR: clarify return code use - _libssh2_userauth_publickey: avoid shadowing - packet: avoid shadowing global symbols - sftp_readdir: avoid shadowing - shadowing: don't shadow the global compress - _libssh2_packet_add: turn ifs into a single switch - _libssh2_packet_add: check SSH_MSG_GLOBAL_REQUEST packet - _libssh2_packet_add: SSH_MSG_DEBUG length checks Verify lengths before using them. Read always_display from the correct index. Don't copy stuff around just to provide zero-termination of the strings. - _libssh2_packet_add: SSH_MSG_IGNORE skip memmove There's no promise of a zero termination of the data in the callback so no longer perform ugly operation in order to provide it. - _libssh2_packet_add: SSH_MSG_DISCONNECT length checks Verify lengths before trying to read data. - indent: break lines at 80 columns - SSH_MSG_CHANNEL_OPEN_FAILURE: used defined values We don't like magic numbers in the code. Now the acceptable failure codes sent in the SSH_MSG_CHANNEL_OPEN_FAILURE message are added as defined values in the private header file. - sftp_write: don't return EAGAIN if no EAGAIN was received This function now only returns EAGAIN if a lower layer actually returned EAGAIN to it. If nothing was acked and no EAGAIN was received, it will now instead return 0. - _libssh2_wait_socket: detect nothing-to-wait-for If _libssh2_wait_socket() gets called but there's no direction set to wait for, this causes a "hang". This code now detects this situation, set a 1 second timeout instead and outputs a debug output about it. - decomp: remove the free_dest argument Since the decompress function ALWAYS returns allocated memory we get a lot simpler code by removing the ability to return data unallocated. - decomp: cleaned off old compression stuff I cleared off legacy code from when the compression and decompression functions were a single unified function. Makes the code easier to read too. - [TJ Saunders brought this change] decomp: increase decompression buffer sizes - [TJ Saunders brought this change] zlib: Add debug tracing of zlib errors - sftp_packet_read: handle partial reads of the length field SFTP packets come as [32 bit length][payload] and the code didn't previously handle that the initial 32 bit field was read only partially when it was read. - [Jasmeet Bagga brought this change] kex_agree_hostkey: fix NULL pointer derefence While setting up the session, ssh tries to determine the type of encryption method it can use for the session. This requires looking at the keys offered by the remote host and comparing these with the methods supported by libssh2 (rsa & dss). To do this there is an iteration over the array containing the methods supported by libssh2. If there is no agreement on the type of encryption we come to the 3rd entry of the hostkeyp array. Here hostkeyp is valid but *hostkep is NULL. Thus when we dereference that in (*hostkeyp)->name there is a crash - _libssh2_transport_send: remove dead assignment 'data' isn't accessed beyond this point so there's no need to assign it. - scp_recv: remove dead assignment Instead of assigning a variable we won't read, we now use the more explicit (void) prefix. - sftp_write: removed superfluous assignment - bugfix: avoid use of uninitialized value - sftp_packet_require: propagate error codes better There were some chances that they would cause -1 to get returned by public functions and as we're hunting down all such occurances and since the underlying functions do return valuable information the code now passes back proper return codes better. - [Alfred Gebert brought this change] fix memory leaks (two times cipher_data) for each sftp session - libssh2_userauth_authenticated: make it work as documented The man page clearly says it returns 1 for "already authenticated" but the code said non-zero. I changed the code to use 1 now, as that is also non-zero but it gets the benefit that it now matches the documentation. Using 1 instead of non-zero is better for two reasons: 1. We have the opportunity to introduce other return codes in the future for things like error and what not. 2. We don't expose the internal bitmask variable value. - userauth_keyboard_interactive: fix indent - [Alfred Gebert brought this change] fix memory leak in userauth_keyboard_interactive() First I wanted to free the memory in session_free() but then I had still memory leaks because in my test case the function userauth_keyboard_interactive() is called twice. It is called twice perhaps because the server has this authentication methods available: publickey,gssapi-with-mic,keyboard-interactive The keyboard-interactive method is successful. - dist: include sftp.h in dist archives Simon Josefsson (27 Oct 2010) - Update header to match new function prototype, see c48840ba88. Daniel Stenberg (26 Oct 2010) - bugfixes: the transport rearrange left some subtle flaws now gone - libssh2_userauth_publickey_fromfile_ex.3: cleaned up looks - libssh2_userauth_publickey: add man page I found an undocumented public function and we can't have it like that. The description here is incomplete, but should serve as a template to allow filling in... - libssh2_sftp_write.3: added blurb about the "write ahead" Documented the new SFTP write concept - sftp_close_handle: free any trailing write chunks - _libssh2_channel_write: fix warnings - SFTP: bufgix, move more sftp stuff to sftp.h The sftp_write function shouldn't assume that the buffer pointer will be the same in subsequent calls, even if it assumes that the data already passed in before haven't changed. The sftp structs are now moved to sftp.h (which I forgot to add before) - SFTP: use multiple outgoing packets when writing sftp_write was rewritten to split up outgoing data into multiple packets and deal with the acks in a more asynchronous manner. This is meant to help overcome latency and round-trip problems with the SFTP protocol. - TODO: implemented a lot of the ideas now - _libssh2_channel_write: removed 32500 size limit Neither _libssh2_channel_write nor sftp_write now have the 32500 size limit anymore and instead the channel writing function now has its own logic to send data in multiple calls until everything is sent. - send_existing: don't tell parent to return when drained That will just cause unnecessary code execution. - _libssh2_channel_write: general code cleanup simplified the function and removed some unused struct fields - _libssh2_transport_send: replaces _libssh2_transport_write The new function takes two data areas, combines them and sends them as a single SSH packet. This allows several functions to allocate and copy less data. I also found and fixed a mixed up use of the compression function arguments that I introduced in my rewrite in a recent commit. - scp_write_nonblock: use select() instead of busyloop Make this example nicer by not busylooping. - send_existing: clear olen when the data is sent off - _libssh2_transport_write: allow 256 extra bytes around the packet - _libssh2_transport_write: remade to send without malloc - compress: compression disabled by default We now allow libssh2_session_flag() to enable compression with a new flag and I added documentation for the previous LIBSSH2_FLAG_SIGPIPE flag which I wasn't really aware of! - comp: split the compress function It is now made into two separate compress and decompress functions. In preparation for upcoming further modficications. Dan Fandrich (20 Oct 2010) - Added header file to allow compiling in older environments Daniel Stenberg (20 Oct 2010) - TODO: add a possible new API for SFTP transfers - TODO: "New Transport API" added - TODO: add buffering plans Simon Josefsson (13 Oct 2010) - Mention libssh2_channel_get_exit_signal and give kudos. - [Tommy Lindgren brought this change] Add libssh2_channel_get_exit_signal man page. Signed-off-by: Simon Josefsson <simon@josefsson.org> - [Tommy Lindgren brought this change] Add libssh2_channel_get_exit_signal. Signed-off-by: Simon Josefsson <simon@josefsson.org> - Add libssh2_free man page and fix typo. - Add libssh2_free. Daniel Stenberg (11 Oct 2010) - scp_recv: improved treatment of channel_read() returning zero As a zero return code from channel_read() is not an error we must make sure that the SCP functions deal with that properly. channel_read() always returns 0 if the channel is EOFed already so we check for EOF after 0-reads to be able to return error properly. - libssh2_session_methods.3: detail what can be asked for - compression: send zlib before none As the list of algorithms in a preferred order we should send zlib before none to increase the chances that the server will let us do compression. - compress: faster check, better return codes In the transport functions we avoid a strcmp() now and just check a boolean instead. The compress/decompress function's return code is now acknowledged and used as actual return code in case of failures. - libssh2_session_handshake: replaces libssh2_session_startup() The function libssh2_session_startup() is now considered deprecated due to the portability issue with the socket argument. libssh2_session_handshake() is the name of the replacement. - libssh2_socket_t: now externally visible In preparation for upcominig changes, the libssh2_socket_t type is now typedef'ed in the public header. - _libssh2_transport_drain: removed This function proved not to be used nor useful. - _libssh2_channel_write: don't iterate over transport writes When a call to _libssh2_transport_write() succeeds, we must return from _libssh2_channel_write() to allow the caller to provide the next chunk of data. We cannot move on to send the next piece of data that may already have been provided in this same function call, as we risk getting EAGAIN for that and we can't return information both about sent data as well as EAGAIN. So, by returning short now, the caller will call this function again with new data to send. - _libssh2_transport_write: updated documentation blurb - _libssh2_transport_write: remove fprintf remainder Mistake from previous debugging - session: improved errors Replaced -1/SOCKET_NONE errors with appropriate error defines instead. Made the verbose trace output during banner receiving less annoying for non-blocking sessions. - crypt_init: use correct error define - _libssh2_error: hide EAGAIN for non-blocking sessions In an attempt to make the trace output less cluttered for non-blocking sessions the error function now avoids calling the debug function if the error is the EAGAIN and the session is non-blocking. - agent: use better error defines - comp_method_zlib_init: use correct error defines - transport: better error codes LIBSSH2_SOCKET_NONE (-1) should no longer be used as error code as it is (too) generic and we should instead use specific and dedicated error codes to better describe the error. - channel: return code and _libssh2_error cleanup Made sure that all transport_write() call failures get _libssh2_error called. - _libssh2_channel_write: limit to 32700 bytes The well known and used ssh server Dropbear has a maximum SSH packet length at 32768 by default. Since the libssh2 design current have a fixed one-to-one mapping from channel_write() to the packet size created by transport_write() the previous limit of 32768 in the channel layer caused the transport layer to create larger packets than 32768 at times which Dropbear rejected forcibly (by closing the connection). The long term fix is of course to remove the hard relation between the outgoing SSH packet size and what the input length argument is in the transport_write() function call. - libssh.h: add more dedicated error codes - SCP: allow file names with bytes > 126 When parsing the SCP protocol and verifying that the data looks like a valid file name, byte values over 126 must not be consider illegal since UTF-8 file names will use such codes. Reported by: Uli Zappe Bug: http://www.libssh2.org/mail/libssh2-devel-archive-2010-08/0112.shtml Dan Fandrich (25 Aug 2010) - Document the three sftp stat constants Guenter Knauf (18 Aug 2010) - Fixed Win32 makefile which was now broken at resource build. - It is sufficient to pipe stderr to NUL to get rid of the nasty messages. - [Author: Guenter Knauf brought this change] Removed Win32 ifdef completely for sys/uio.h. No idea why we had this ifdef at all but MSVC, MingW32, Watcom and Borland all have no sys/uio.h header; so if there's another Win32 compiler which needs it then it should be added explicitely instead of this negative list. - New files should also be added to Makefile.am. Otherwise they will never be included with release and snapshot tarballs ... Daniel Stenberg (18 Aug 2010) - version: bump to 1.2.8_DEV Version 1.2.7 (17 Aug 2010) Daniel Stenberg (17 Aug 2010) - release: updated to hold 1.2.7 info Guenter Knauf (17 Aug 2010) - Use the new libssh2.rc file. - Added resource file for libssh2.dll (shamelessly stolen from libcurl). - Updated Win32 MSVC dependencies versions. - Added include for sys/select.h to get fd.set on some platforms. - Added Watcom makefile borrowed from libcurl. This makefile compiles already all files fine for static lib, but needs final touch when I have OpenSSL fully working with shared libs and Watcom. - Added copyright define to libssh2.h and use it for binary builds. - Moved version defines up in order to include from .rc file. Blocked rest of header with ifndef so its possible to let the rc compiler only use the version defines. - Some minor makefile tweaks. Daniel Stenberg (2 Aug 2010) - example: treat the libssh2_channel_read() return code properly A short read is not an error. Only negative values are errors! - libssh2_wait_socket: reset error code to "leak" EAGAIN less Since libssh2 often sets LIBSSH2_ERROR_EAGAIN internally before _libssh2_wait_socket is called, we can decrease some amount of confusion in user programs by resetting the error code in this function to reduce the risk of EAGAIN being stored as error when a blocking function returns. - _libssh2_wait_socket: poll needs milliseconds As reported on the mailing list, the code path using poll() should multiple seconds with 1000 to get milliseconds, not divide! Reported by: Jan Van Boghout - typedef: make ssize_t get typedef without LIBSSH2_WIN32 The condition around the ssize_t typedef depended on both LIBSSH2_WIN32 *and* _MSC_VER being defined when it should be enough to depend on _MSC_VER only. It also makes it nicer so libssh2-using code builds fine without having custom defines. - [John Little brought this change] session_free: free more data to avoid memory leaks - channel_free: ignore problems with channel_close() As was pointed out in bug #182, we must not return failure from _libssh2_channel_free() when _libssh2_channel_close() returns an error that isn't EAGAIN. It can effectively cause the function to never go through, like it did now in the case where the socket was actually closed but socket_state still said LIBSSH2_SOCKET_CONNECTED. I consider this fix the right thing as it now also survives other errors, even if making sure socket_state isn't lying is also a good idea. - publickey_list_free: no return value from a void function Fixed a compiler warning I introduced previously when checking input arguments more. I also added a check for the other pointer to avoid NULL pointer dereferences. - [Lars Nordin brought this change] openssl: make use of the EVP interface Make use of the EVP interface for the AES-funktion. Using this method supports the use of different ENGINES in OpenSSL for the AES function (and the direct call to the AES_encrypt should not be used according to openssl.org) Peter Stuge (23 Jun 2010) - [Tor Arntsen brought this change] Don't overflow MD5 server hostkey Use SHA_DIGEST_LENGTH and MD5_DIGEST_LENGTH in memcpy instead of hardcoded values. An incorrect value was used for MD5. - Fix message length bugs in libssh2_debug() There was a buffer overflow waiting to happen when a debug message was longer than 1536 bytes. Thanks to Daniel who spotted that there was a problem with the message length passed to a trace handler also after commit 0f0652a3093111fc7dac0205fdcf8d02bf16e89f. - Make libssh2_debug() create a correctly terminated string Also use FILE *stderr rather than fd 2, which can very well be something completely different. Daniel Stenberg (23 Jun 2010) - [TJ Saunders brought this change] handshake: Compression enabled at the wrong time In KEXINIT messages, the client and server agree on, among other things, whether to use compression. This method agreement occurs in src/kex.c's kex_agree_methods() function. However, if compression is enabled (either client->server, server->client, or both), then the compression layer is initialized in kex_agree_methods() -- before NEWKEYS has been received. Instead, the initialization of the compression layer should happen after NEWKEYS has been received. This looks to occur insrc/kex.c's diffie_hellman_sha1(), which even has the comment: /* The first key exchange has been performed, switch to active crypt/comp/mac mode */ There, after NEWKEYS is received, the cipher and mac algorithms are initialized, and that is where the compression should be initialized as well. The current implementation fails if server->client compression is enabled because most server implementations follow OpenSSH's lead, where compression is initialized after NEWKEYS. Since the server initializes compression after NEWKEYS, but libssh2 initializes compression after KEXINIT (i.e. before NEWKEYS), they are out of sync. Reported in bug report #180 - [TJ Saunders brought this change] userauth_hostbased_fromfile: packet length too short The packet length calculated in src/userauth.c's userauth_hostbased_fromfile() function is too short by 4 bytes; it forgets to add four bytes for the length of the hostname. This causes hostbased authentication to fail, since the server will read junk data. verified against proftpd's mod_sftp module - _libssh2_userauth_publickey: reject method names longer than the data This functions get the method length by looking at the first 32 bit of data, and I now made it not accept method lengths that are longer than the whole data set is, as given in the dedicated function argument. This was detected when the function was given bogus public key data as an ascii string, which caused the first 32bits to create a HUGE number. - NULL resistance: make more public functions survive NULL pointer input Sending in NULL as the primary pointer is now dealt with by more public functions. I also narrowed the userauth.c code somewhat to stay within 80 columns better. - agent: make libssh2_agent_userauth() work blocking properly previously it would always work in a non-blocking manner Peter Stuge (17 Jun 2010) - Fix underscore typo for 64-bit printf format specifiers on Windows Commit 49ddf447ff4bd80285f926eac0115f4e595f9425 was missing underscores. Daniel Stenberg (16 Jun 2010) - libssh2_session_callback_set: extended the man page - [John brought this change] LIBSSH2_DEBUG: macro uses incorrect function variable The LIBSSH2_DEBUG macro, defined in libssh2_priv.h, incorrectly uses the function variable ssh_msg_disconnect when it should use ssh_msg_debug. This shows that the LIBSSH2_CALLBACK_DEBUG callback never has worked... - warning: fix a compiler warning 'pointer differs in signedness' As reported in bug #177 - portability: introduce LIBSSH2_INT64_T_FORMAT for 64bit printf()s As pointed out in bug #177, some of the Windows compilers use %I64 to output 64 bit variables with the printf family. - debug: avoid sending NULL to sprintf %s Via the _libssh2_debug() macro/function. Pointed out by john in bug report - sftp docs: show macro on macro page, only function on function page The individual man pages for macros now show the full convenience macro as defined, and then the man page for the actual function only shows the function. - code police: make the code use less than 80 columns - libssh2_channel_write_ex: remove macros, added wording on buffer size - libssh2_sftp_write: document buffer size and changed some ordering - libssh2_channel_write_stderr: show how the macro is defined - libssh2_channel_write: show how the macro is defined - SFTP: limit write() to not produce overly large packets sftp_write() now limits how much data it gets at a time even more than before. Since this function creates a complete outgoing packet based on what gets passed to it, it is crucial that it doesn't create too large packets. With this method, there's also no longer any problem to use very large buffers in your application and feed that to libssh2. I've done numerous tests now with uploading data over SFTP using 100K buffers and I've had no problems with that. - scp_write_nonblock: add transfer time info Using the same timing logic and output format as sftp_write_nonblock allows us to very easily run benchmarks on SCP vs SFTP uploads using libssh2. - sftp_write_nonblock: select() on socket, use *BIG* buffer, time transfer The select() is just to make it nicer so that it doesn't crazy-loop on EAGAIN. The buffer size thing is mostly to verify that this really work as supposed. Transfer timing is just a minor thing, but it can just as well be there and help us time and work on performance easier using out of the box examples. - agent: use _libssh2_error() when returning errors As pointed out in bug report #173, this module basically never used _libssh2_error() which made it work inconstently with other parts of the libssh2 code base. This is my first take at making this code more in line with the rest. - inputchecks: make lots of API functions check for NULL pointers If an application accidentally provides a NULL handle pointer to the channel or sftp public functions, they now return an error instead of segfaulting. - libssh2_channel_eof: clarify that it returns negative on errors - SFTP: keep the sftp error code as 32 bit 'last_errno' holds to the error code from the SFTP protocol and since that is 32 bits on the wire there's no point in using a long for this internally which is larger on some platforms. - agent: make the code better deal with unexpected code flows agent->ops gets initialized by the libssh2_agent_connect() call but we need to make sure that we don't segfault even if a bad sequence of function calls is used. Alexander Lamaison (10 Jun 2010) - Better handling of invalid key files. Passing an invalid public key to libssh2_userauth_publickey_fromfile_ex triggered an assertion. Replaced this with a runtime check that rejects obviously invalid key data. Daniel Stenberg (10 Jun 2010) - version: we start working on 1.2.7 now Version 1.2.6 (10 Jun 2010) Daniel Stenberg (10 Jun 2010) - NEWS: add the 1.2.6 release details - RELEASE-NOTES: 1.2.6 details added Guenter Knauf (10 Jun 2010) - fixed libssh2.dsw to use the generated libssh2.dsp; removed old *.dsp files. - moved MSVC strdup define to libssh2_config.h which we include already. - added missing source files to src/NMakefile. Daniel Stenberg (8 Jun 2010) - libssh2_poll: refer to poll(3) and select(3) instead - example: fix strdup() for MSVC compiles MSVC has a _strdup() that we better use. This was reported in bug - SFTP: fail init SFTP if session isn't authenticated Alexander Lamaison filed bug #172 (http://trac.libssh2.org/ticket/172), and pointed out that SFTP init would do bad if the session isn't yet authenticated at the time of the call, so we now check for this situation and returns an error if detected. Calling sftp_init() at this point is bad usage to start with. - direct_tcpip: bring back inclusion of libssh2_config.h In order to increase portability of this example, I'm bringing the inclusion of libssh2_config.h back, and I also added an require that header for this example to compile. I also made all code lines fit within 80 columns. Guenter Knauf (3 Jun 2010) - cast away a warning. - moved CRT_SECURE_NO_DEPRECATE define up so its defined before the winsock headers are included. - fixed platform detection for MingW32 test makefile. - MingW32 has gettimeofday() implemented, so proper ifdef this function here. - removed MSVC ifdef since seems we can use __int64 still with latest headers. - changed copyright notice for MinW32 and NetWare binaries. - cleaned up MSVC ifdefs which where spreaded over 3 places. - added uint8_t typedef for NetWare CLIB platform. - if the function declaration gets changed the header should be changed too. - this is MSVC specific and doesnt apply for all Win32 compilers; the uint8_t typedef clashes with MingW32 headers. - updated MingW32 makefiles for latest dependency lib versions. - updated NetWare makefiles for latest dependency lib versions. Dan Fandrich (30 May 2010) - Fixed compiling with libgcrypt A change of parameter types from unsigned long to size_t was missed in the prototype in libgcrypt.h Daniel Stenberg (28 May 2010) - statvfs: use libssh2_sftp_statvfs only, no "_ex" As the long-term goal is to get rid of the extensive set of macros from the API we can just as well start small by not adding new macros when we add new functions. Therefore we let the function be libssh2_sftp_statvfs() plainly without using an _ex suffix. I also made it use size_t instead of unsigned int for the string length as that too is a long-term goal for the API. - [Grubsky Grigory brought this change] DSP: output lib name typo - [Grubsky Grigory brought this change] win32: provide a uint8_t typedef for better building on windows - agent: win32: fix bad _libssh2_store_str call As pointed out by Grubsky Grigory <g.grubsky@securitycode.ru>, I made a mistake when I added the _libssh2_store_str() call before and I made a slightly different patch than what he suggested. Based purely on taste. Peter Stuge (24 May 2010) - [Joey Degges brought this change] Add libssh2_sftp_statvfs() and libssh2_sftp_fstatvfs() These can be used to get file system statistics from servers that support the statvfs@openssh.com and fstatvfs@openssh.com extensions. Alexander Lamaison (22 May 2010) - [Jose Baars brought this change] VMS specific: make sure final release can be installed over daily build - [Jose Baars brought this change] VMS: small improvement to the man2help utilities Peter Stuge (22 May 2010) - [Joey Degges brought this change] libssh2_exit and libssh2_sftp_readdir man page fixes Daniel Stenberg (21 May 2010) - spelling: s/sue/use Alexander Lamaison (21 May 2010) - Change magic port number for generic knownhost check. libssh2_knownhost_checkp took 0 as a magic port number that indicated a 'generic' check should be performed. However, 0 is a valid port number in its own right so this commit changes the magic value to any negative int. Mikhail Gusarov (5 May 2010) - Add re-discovered copyright holders to COPYING - Restoring copyright statements from pre-git era Eli Fant has contributed fragmenting SFTP requests - Restoring my copyright statements from pre-git era keyboard_interactive, 'exit-status' information packet, non-atomic read/write under FreeBSD, multi-channel operation bugfixes. Daniel Stenberg (3 May 2010) - pedantic: make the code C90 clean Peter Stuge (3 May 2010) - Do proper keyboard-interactive user dialog in the sftp.c example Daniel Stenberg (3 May 2010) - added to tarball: libssh2_knownhost_checkp.3 - knownhost: support [host]:port in knownhost file OpenSSH has ways to add hosts to the knownhosts file that include a specific port number which makes the key associated with only that specific host+port pair. libssh2 previously did not support this, and I was forced to add a new function to the API to properly expose this ability to applications: libssh2_knownhost_checkp() To *add* such hosts to the knownhosts file, you make sure to pass on the host name in that manner to the libssh2_knownhost_addc() function. - init/exit: mention these were added in 1.2.5 - libssh2_knownhost_check docs: correct the prototype - examples: avoid use of uninitialized variable 'sock' - KEX: stop pretending we negotiate language There was some stub-like parts of an implementation for implementing kex language negotiation that caused clang-analyzer to warn and as it did nothing I've now removed the dead code. - Uninitialized argument - sftpdir: removed dead assignment - Makefile.am: include the VMS-specific config header as well - [Jose Baars brought this change] Add VMS specific libssh2_config.h - fix Value stored to 's' is never read warning and moved variable declaration of s to be more local - kexinit: simplify the code and avoid scan-build warning Previously it would say "Value stored to 's' is never read" due fourth increment of 's'. Alexander Lamaison (28 Apr 2010) - Removed unecessary brackets. - Changed sftp_attrsize macro to a static function. Daniel Stenberg (28 Apr 2010) - release: include the VMS-specific files - sftp_attrsize: protect the macro argument with proper parentheses - ssh2_agent: avoid using 'session' uninitialized on failures - examples: remove assignments of variable rc that's never used - publickey_init: remove useless variable increment - hostkey_method_ssh_rsa_init: remove useless variable increment - packet_x11_open: removed useless variable increment and made the declaration of a variable more local - packet_queue_listener: removed useless variable increment and made the declaration of a variable more local - sftp_read: move a read_responses array to where its used I find that this increases readability since the array is used only in the function call just immediately below and nowhere else. - sftp_readdir: turn a small array static const and move it - sftp_attrsize: converted function to a macro This way, the macro can evaluate a static number at compile time for two out of four uses, and it probably runs faster for the other two cases too. - sftp_open: deal with short channel_write calls This was an old TODO that just wasn't done before. If channel_write returns short, that is not an error. - sftp_open: clean up, better check of input data The clang-analyzer report made it look into this function and I've went through it to remove a potential use of an uninitialized variable and I also added some validation of input data received from the server. In general, lots of more code in this file need to validate the input before assuming it is correct: there are servers out there that have bugs or just have another idea of how to do the SFTP protocol. - bugfix: avoid using the socket if it failed to create one - bugfix: potential use of NULL pointer - libssh2_userauth_password_ex: clarify errors somewhat The errors mentioned in this man page are possible return codes but not necessarily the only return codes that this can return. Also reformatted the typ prototypes somewhat. - examples: fixed and made them more similar The channel read/write functions can return 0 in legitimate cases without it being an error, and we need to loop properly if they return short. - [Jose Baars brought this change] VMS port of libssh2; changes in the libssh2 common code - Makefile: added the two news headers userauth.h and session.h - cleanup: prefer the internal functions To get the blocking vs non-blocking to work as smooth as possible and behave better internally, we avoid using the external interfaces when calling functions internally. Renamed a few internal functions to use _libssh2 prefix when not being private within a file, and removed the libssh2_ for one that was private within the file. - session_free: remove dead code - libssh2_publickey_init: fixed to work better non-blocking This was triggered by a clang-analyzer complaint that turned out to be valid, and it made me dig deeper and fix some generic non- blocking problems I disovered in the code. While cleaning this up, I moved session-specific stuff over to a new session.h header from the libssh2_priv.h header. - channel: reduce duplicated free and returns Simplified the code by trying to free data and return on a single spot. - channel: make variables more local By making 'data' and 'data_len' more local in several places in this file it will be easier to spot how they are used and we'll get less risks to accidentally do bad things with them. Mikhail Gusarov (24 Apr 2010) - Fix typos in manpages, catched by Lintian Daniel Stenberg (24 Apr 2010) - channel_request_pty: simplify the code clang-analyzer pointed out how 'data' could be accessed as a NULL pointer if the wrong state was set, and while I don't see that happen in real-life the code flow is easier to read and follow by moving the LIBSSH2_FREE() call into the block that is supposed to deal with the data pointer anyway. - libssh2_channel_process_startup: simplify the code clang-analyzer pointed out how 'data' could be accessed as a NULL pointer if the wrong state was set, and while I don't see that happen in real-life the code flow is easier to read and follow by moving the LIBSSH2_FREE() call into the block that is supposed to deal with the data pointer anyway. - sftp_close_handle: add precation to not access NULL pointer clang-analyzer pointed this out as a "Pass-by-value argument in function call is undefined" but while I can't see exactly how this can ever happen in reality I think a little check for safety isn't such a bad thing here. - scp_write_nonblock: Value stored to 'nread' is never read - scp_write: Value stored to 'ptr' is never read - scp_write_nonblock: Value stored to 'ptr' is never read - sftp_mkdir: less silly output but show failures - [Jose Baars brought this change] VMS port of libssh2 including VMS specific build procedures - two variable types changes, made lines less than 80 columns The two variable type changes are only to match type variable fields actually read from the binary protocol. - remove check for negative padding_length It was silly, since it is read as an unsigned char... - hostkey_method_ssh_dss_init: Value stored to 's' is never read - libssh2_banner_set: avoid unnecessary increment and explain code - agent_transact_unix: remove unused variable - remove two unnecessary increments - more code converted to use _libssh2_store_*() - libssh2_publickey_list_fetch: removed unused variables - libssh2_publickey_init: remove unused variables - libssh2_scp_send64: added to API to provide large file transfers The previously existing libssh2_scp_send_ex() function has no way to send files that are larger than 'size_t' which on 32bit systems mean 4GB. This new API uses a libssh2_int64_t type and should thus on most modern systems be able to send enormous files. - sftp_init: remove unused variables and assignments - libssh2_knownhost_check: Value stored to 'keylen' is never read - hostkey: fix compiler warning - remove unused variable - data types: convert more to use size_t and uint32_t - channel: variable type cleanups - cleanups: better binary packet gen, size_t fixes and PACKET_* removal I'll introduce a new internal function set named _libssh2_store_u32 _libssh2_store_u64 _libssh2_store_str That can be used all through the library to build binary outgoing packets. Using these instead of the current approach removes hundreds of lines from the library while at the same time greatly enhances readability. I've not yet fully converted everything to use these functions. I've converted LOTS of 'unsigned long' to 'size_t' where data/string lengths are dealt with internally. This is The Right Thing and it will help us make the transition to our size_t-polished API later on as well. I'm removing the PACKET_* error codes. They were originally introduced as a set of separate error codes from the transport layer, but having its own set of errors turned out to be very awkward and they were then converted into a set of #defines that simply maps them to the global libssh2 error codes instead. Now, I'l take the next logical step and simply replace the PACKET_* defines with the actual LIBSSH2_ERROR_* defines. It will increase readability and decrease confusion. I also separated packet stuff into its own packet.h header file. - clarified the return code - rename libssh2_error to the correct _libssh2_error We reserve ^libssh2_ for public symbols and we use _libssh2 as prefix for internal ones. I fixed the intendation of all these edits with emacs afterwards, which then changed it slightly more than just _libssh2_error() expressions but I didn't see any obvious problems. - data type cleanup: made lots of code use size_t etc A lot of code used 'unsigned long' and the likes when it should rather just use plain 'int' or use size_t for data lengths. - wait_socket: make c89 compliant and use two fd_sets for select() - sftp_readdir: always zero terminate, detail the return code I also added a description for the 'longentry' field which was previously undocumented! - sftp_readdir: simplified and bugfixed This function no longer has any special purpose code for the single entry case, as it was pointless. The previous code would overflow the buffers with an off-by-one in case the file name or longentry data fields received from the server were exactly as long as the buffer provided to libssh2_sftp_readdir_ex. We now make sure that libssh2_sftp_readdir_ex() ALWAYS zero terminate the buffers it fills in. The function no longer calls the libssh2_* function again, but properly uses the internal sftp_* instead. - channel/transport: we now drain the outgoing send buffer when we ignore EAGAIN When we ignore the EAGAIN from the transport layer within channel_write, we now drain the outgoing transport layer buffer so that remainders in that won't cause any problems in the next invoke of _libssh2_transport_write() - channel_write: if data has been sent, don't return EAGAIN When sending data in a loop, we must not return EAGAIN if we managed to send data in an earlier round. This was reported in bug #126 => http://libssh2.stuge.se/ticket/126 Simon Josefsson (14 Apr 2010) - Fix OpenSSL AES-128-CTR detection. Patch from Paul Howarth <paul@city-fan.org>. Daniel Stenberg (13 Apr 2010) - version in header file now says 1.2.6-DEV - 1.2.6: clean the RELEASE-NOTES for next release round - NEWS: add the stuff from the version 1.2.5 RELEASE-NOTES Version 1.2.5 (13 Apr 2010) Daniel Stenberg (13 Apr 2010) - channel_close: no longer wait for the SSH_MSG_CHANNEL_CLOSE message As the packet may simply not arrive we cannot have the close function wait for it unconditionally. - less code duplication in the poll vs select code flows libssh2_keepalive_send and libssh2_session_block_directions are now used outside of the #ifdef blocks. - make it C90 compliant - updated with all changes and bugs since 1.2.4 - Added LIBSSH2_SFTP_S_IS***() macros and updated docs libssh2_sftp_fstat_ex.3 is now extended quite a lot to describe a lot of the struct and the bits it uses and how to test for them. - sftp_init() deal with _libssh2_channel_write() returns short When _libssh2_channel_write() is asked to send off 9 bytes, the code needs to deal with the situation where less than 9 bytes were sent off and prepare to send the remaining piece at a later time. - handle a NULL password as if it was "" libssh2_userauth_publickey_fromfile_ex() takes a "passphrase" but didn't deal with it being set to NULL. - Reduce used window sizes by factor 10 As reported in bug report #166 http://libssh2.stuge.se/ticket/166 by 'ptjm', the maximum window size must be less crazy for libssh2 to do better with more server implementations. I did not do any testing to see how this changes raw SCP performance, but the maximum window size is still almost 4MB. This also has the upside that libssh2 will use less memory. Peter Stuge (28 Mar 2010) - Correctly clear blocking flag after sending multipart packet commit 7317edab61d2179febc38a2c2c4da0b951d74cbc cleared the outbound blocking bit when send_existing() returned PACKET_NONE and *ret=0, as opposed to before even calling send_existing(), but because *ret=1 when sending parts 2..n of an existing packet, the bit would only be cleared when calling libssh2_transport_write() for a new packet. Clear the direction flag after the final part of a packet has been sent. Daniel Stenberg (24 Mar 2010) - Added man page for libssh2_knownhost_addc() Added mention in libssh2_knownhost_add() docs that libssh2_knownhost_addc() is the preferred function now. - at next soname bump remove libssh2_knownhost_add() - ignore TAGS ("make tags" makes them) - fix memory leak we must not assign the pointer a NULL since it keeps allocated data and at least parts of an error string - fixed the pattern for avoiding the poll check added some comments about known problems with poll on darwin - avoid checking for poll on some systems darwin and interix are known to have broken poll implementations so we skip the check on those and thus have them use select unconditionally - ignore libssh2.dsp Simon Josefsson (23 Mar 2010) - Fix logic in "on-the-fly" crypto init. - Make sure keepalive is working even when poll is used. - [Paul Querna brought this change] Use poll when available on blocking API. Signed-off-by: Simon Josefsson <simon@josefsson.org> Peter Stuge (20 Mar 2010) - Fix speling Daniel Stenberg (19 Mar 2010) - fix NULL dereference when window adjusting a non-existing channel Suyog Jadhav pointed out that when receiving a window adjust to a channel not found, the code would reference a NULL pointer. Now it will instead output a message about that fact. Simon Josefsson (19 Mar 2010) - Fix build problem. - Eat our own dog food, call libssh2_init and libssh2_exit in the examples. - Fix init/exit logic. Add self-test of it. Daniel Stenberg (19 Mar 2010) - fix typo Simon Josefsson (19 Mar 2010) - Add man page for libssh2_init and libssh2_exit. Fix libssh2_exit prototype. - Shorten constant a bit. More documentation. - Fix namespace pollution. - Add global init/exit points, to do crypto initialization in one place. By Lars Nordin. Daniel Stenberg (14 Mar 2010) - libssh2 is released under the Modifed BSD license, not GPL Alexander Lamaison (14 Mar 2010) - Add libssh2_knownhost_addc to handle comments. Comments in known_hosts file were not handle properly. They were parsed as part of the key causing key matching to return a mismatch if the entry had a comment. This adds a new API function that takes an optional comment and changes libssh2_knownhost_readline to parse the comment as pass it to the new function. Fixes #164. - Fix gettimeofday to compile with Visual C++ 6. Reported by Steven Van Ingelgem. Simon Josefsson (10 Mar 2010) - Add. - keepalive.c: Fix libssh2_error usage. - Fix typo in last commit. - Tidy up build option notice. - Add entry about keep alive stuff. - Add keep-alive support. Alexander Lamaison (7 Mar 2010) - Untabify. - Fix memory leak in libssh2_knownhost_add. Daniel Stenberg (6 Mar 2010) - change 'int' to 'libssh2_socket_t' in the public API for sockets - reduce code duplication and return underlying error better - acknowledge when _libssh2_packet_requirev() returns error when _libssh2_packet_requirev() returns an error when waiting for SSH_MSG_USERAUTH_SUCCESS or SSH_MSG_USERAUTH_FAILURE, it is an error and it should be treated as such - wrap long lines - polished the phrasing in two error strings - silence picky compiler warnings - silence picky compiler warnings - removed libssh2_error()'s forth argument libssh2_error() no longer allocates a string and only accepts a const error string. I also made a lot of functions use the construct of return libssh2_error(...) instead of having one call to libssh2_error() and then a separate return call. In several of those cases I then also changed the former -1 return code to a more detailed one - something that I think will not change behaviors anywhere but it's worth keeping an eye open for any such. - repaired --enable-debug Simon Josefsson (1 Mar 2010) - Make ./configure output a summary of build options. Daniel Stenberg (1 Mar 2010) - let the err_msg in the session struct be const too Simon Josefsson (1 Mar 2010) - Revert #ifdef change that pulled in AES-CTR code when explicitly disabled. Daniel Stenberg (1 Mar 2010) - fix #ifdefs - make function match the new proto Simon Josefsson (1 Mar 2010) - Improve AES-CTR check. Daniel Stenberg (1 Mar 2010) - use const to silence a bazillion warnings Simon Josefsson (1 Mar 2010) - Use AES-CTR from OpenSSL when available. Reported by Lars Nordin <Lars.Nordin@SDlabs.se>. - Make it possible to disable DSA. Patch from Lars Nordin <Lars.Nordin@SDlabs.se>. Peter Stuge (1 Mar 2010) - Send and receive channel EOF before sending SSH_MSG_CHANNEL_CLOSE Sending SSH_MSG_CHANNEL_CLOSE without channel EOF is explicitly allowed in RFC 4254, but some non-conforming servers will hang or time out when the channel is closed before EOF. Other common clients send and receive EOF before closing, there are no drawbacks, and some servers need it to work correctly. Alexander Lamaison (26 Feb 2010) - Style improvements to knownhost error handling. Made improvements as suggested by Peter Stuge: http://www.libssh2.org/mail/libssh2-devel-archive-2010-02/0161.shtml. - Call libssh2_error for every knownhost API failure. The libssh2 API calls should set the last error code and a message when returning a failure by calling libssh2_error. This changeset adds these calls to the libssh2_knownhost_* API as well as libssh2_base64_decode. This change also makes libssh2_error into a function rather than a macro. Its implementation is moved to misc.c. This function returns the error code passed to it allowing callers to return the error value directly without duplicating the error code. - Fix LIBSSH2_ALLOC checks. These appear to be cut-and paste errors where the wrong variable is checked for NULLness after calling LIBSSH2_ALLOC. Simon Josefsson (23 Feb 2010) - Silence compiler warning. - Make it portable; test uses = for string comparison (not ==). Indent. Alexander Lamaison (22 Feb 2010) - libssh2_knownhost_del: fix write to freed memory. When removing a known host, libssh2_knownhost_del would remove the node from the linked list, free its memory and then overwrite the struct parameter (which indicated which node to remove) with 0. However, this struct is actually allocated within the just-freed node meaning we're writing to freed memory. This made Windows very upset. The fix is simply to overwrite the struct first before freeing the memory. Daniel Stenberg (21 Feb 2010) - show more verbose error when SCP send fails - libssh2_socket_t is done, a library-free function is needed - clarify that this frees all data associated with a session - improved error handling - add missing libssh2_error() calls To make sure the public API is functional and that the BLOCK_ADJUST_ERRNO() macro works correctly we MUST make sure to call libssh2_error() when we return errors. - fix memory leak in userauth_keyboard_interactive() Mr anonymous in bug #125 pointed out that the userauth_keyboard_interactive() function does in fact assign the same pointer a second time to a new allocated buffer without properly freeing the previous one, which caused a memory leak. - added missing error codes To allow the libssh2_session_last_error() function to work as documented, userauth_password() now better makes sure to call libssh2_error() everywhere before it returns error. Pointed out by mr anonymous in bug #128 Peter Stuge (16 Feb 2010) - Fix resource and memory leaks in examples as reported by cppcheck Thanks to Ettl Martin for the report and patch. This fixes #132 Daniel Stenberg (15 Feb 2010) - mention the new man pages for macros - added man pages for API macros all #defined macros in the public headers are considered to be part of the API and I've generated individual man pages for each of them to A) make it easier to figure out what each function/macro actually is for so that automated lookups work better and for B) make sure we have all public functions document (both macros and functions) to make it easier for us to work away from all the macros in a future release. - Committed the patch by Yoichi Iwaki in bug #2929647 Committed the patch by Yoichi Iwaki in bug #2929647, which fixed a memory leak when an 'outbuf' was still allocated when a session was freed. - free "outbuf" when killing a session Fix memoary leak: if there was an "output" still allocated when a session was torn down it needs to be freed in session_free() Patch by Yoichi Iwaki in bug #2929647 - the working version name is now 1.2.5_DEV Version 1.2.4 (13 Feb 2010) Daniel Stenberg (13 Feb 2010) - updated info for 1.2.4 Dan Fandrich (10 Feb 2010) - Allow compiling with OpenSSL when AES isn't available. Peter Stuge (9 Feb 2010) - [Dave McCaldon brought this change] Fix Tru64 socklen_t compile issue with example/direct_tcpip.c Building libssh2-1.2.3 on Tru64 fails at line 48 and 166 because socklen_t isn't defined on Tru64 unless _POSIX_PII_SOCKET is defined. This patch updates configure.ac to add -D_POSIX_PII_SOCKET when building on Tru64 platform(s). - [Dave McCaldon brought this change] Resolve compile issues on Solaris x64 and UltraSPARC Solaris builds of libssh2-1.2.3 failed on both x64 and UltraSPARC platforms because of two problems: 1) src/agent.c:145 sun is a reserved word when using the SUNWspro compiler 2) example/direct_tcpip.c:84 INADDR_NONE is not defined Daniel Stenberg (3 Feb 2010) - towards 1.2.4 now Version 1.2.3 (3 Feb 2010) Daniel Stenberg (3 Feb 2010) - Version 1.2.3 (February 3, 2010) - fix building out of source tree by proving better include path when building out of source tree, we provide -I$(top_builddir)/example since the libssh2_config.h gets generated in that dir Peter Stuge (1 Feb 2010) - [Sofian Brabez brought this change] Replace : in hexdump with " " (two spaces) - Detect when the forwarded connection is closed in example/direct_tcpip.c - Fix example/direct_tcpip.c to work also on WIN32 read() and write() are no good for WIN32 sockets, use recv() and send(). - Ignore libssh2_config.h.in and stamp-h2 in example/ and remove .cvsignore - Simplify WIN32 ifdefs in example/direct_tcpip.c to allow standalone compile - Always #define INVALID_SOCKET -1 in libssh2_priv.h when not on win32 Fix broken builds since commit abd9bd0bbe631efeada1f54552c70b54e1c490c1 for all non-win32 platforms. - Include hmac-md5 and hmac-md5-96 only if crypto backend supports MD5 - Use LIBSSH2_HOSTKEY_HASH_SHA1 instead of _MD5 in examples and tests MD5 support is optional and may not always be available, while SHA1 is both required and recommended. - Update mailing list address in configure.ac to @cool.haxx.se - Make example/direct_tcpip.c compile for win32 One warning from FD_SET() remains, it is also in some other examples. - Correctly check for an invalid socket in session_startup() - Small documentation fix after Dave's _USERAUTH_FAILURE improvement - [Dave McCaldon brought this change] Handle SSH_MSG_USERAUTH_FAILURE for password and kbd-int authentication Neither libssh2_userauth_password_ex() nor libssh2_userauth_keyboard_interactive_ex() would return a login failure error if the server responded with a SSH_MSG_USERAUTH_FAILURE, instead you would see whatever previous error had occurred, typically LIBSSH2_ERROR_EAGAIN. This patch changes error code -18 to LIBSSH2_ERROR_AUTHENTICATION_FAILED and makes LIBSSH2_ERROR_PUBLICKEY_UNRECOGNIZED an alias for LIBSSH2_ERROR_AUTHENTICATION_FAILED. In addition, new logic in userauth_password() properly handles SSH_MSG_USERAUTH_FAILURE and both this function and userauth_keyboard_interactive() now properly return LIBSSH2_ERROR_AUTHENTICATION_FAILED. Simon Josefsson (28 Jan 2010) - Fix. - Also deal with GLOBAL_REQUEST keep-alives. - Make OpenSSH-style keepalive work against libssh2 clients. Daniel Stenberg (27 Jan 2010) - clarified Peter Stuge (26 Jan 2010) - [Dave McCaldon brought this change] Fix trace context lookup in libssh2_debug() The trace context is actually a bitmask so that tracing output can be controlled by setting a bitmask using libssh2_trace(). However, the logic in libssh2_debug() that converted the context to a string was using the context value as an array index. Because the code used a bounds check on the array, there was never a danger of a crash, but you would certainly either get the wrong string, or "unknown". This patch adds a lookup that iterates over the context strings and uses it's index to check for the corresponding bit in the context. - Fix typo in RELEASE-NOTES Daniel Stenberg (20 Jan 2010) - updated for 1.2.3 with all the stuff I found in the log - ignore more generated files - [Dave McCaldon brought this change] Pass user context through libssh2_trace_sethandler() to callback The libssh2_trace_sethandler() call allows the user to handle the output of libssh2 rather than having it written to stderr. This patch updates libssh2_trace_sethandler() to allow a user-defined void* context value to be passed back to the output handler. - [Dave McCaldon brought this change] Add libssh2_trace_sethandler() to the API (even more) - [Dave McCaldon brought this change] Add libssh2_trace_sethandler() to the API - cleanup includes We now produce a local libssh2_config.h file in this dir for the examples to use so I cleaned up the include path at the same time. - generate a libssh2_config.h in the example dir buildconf copies the template to example/ and configure makes sure to generate a proper file from it and the direct_tcpip.c example is the first one to use it - to make sure it builds fine on more paltforms Simon Josefsson (13 Jan 2010) - Remove redundant #includes and reorder sys/types.h include. Daniel Stenberg (10 Jan 2010) - avoid a free(NULL) Simon Josefsson (7 Jan 2010) - Make it simpler to get more debug info. Daiki Ueno (1 Jan 2010) - Simplify the commit 63457dfa using type cast from size_t * to ulong *. Alexander Lamaison (30 Dec 2009) - Fixed memory leak in userauth_publickey(). userauth_publickey_fromfile() reads the key from a file using file_read_publickey() which returns two allocated strings, the decoded key and the key method (such as "ssh-dss"). The latter can be derived from the former but returning both avoids a later allocation while doing so. Older versions of userauth_publickey_fromfile() used this method string directly but when userauth_publickey() was factored out of userauth_publickey_fromfile() it derived the method from the key itself. This resulted in the method being allocated twice. This fix, which maintains the optimisation that avoids an extra allocation, changes userauth_publickey() so it doesn't allocate and derive the method when userauth_pblc_method already has a value. Signed-off-by: Alexander Lamaison <awl03@doc.ic.ac.uk> Daiki Ueno (25 Dec 2009) - Fix the return value description of libssh2_knownhost_free(). - Fix compiler warnings for size_t pointers on 32-bit Windows. - Define INVALID_SOCKET and use it instead of SOCKET_BAD. Revert the part of previous commit that defines SOCKET_BAD library wide. - Use libssh2_socket_t in the ssh-agent stuff. Define a portability macro SOCKET_BAD which means "invalid socket". - Mark/unmark connection to Pageant is open/close. - Add test to check if the socket is connected. Peter Stuge (24 Dec 2009) - Add libssh2.pc to top-level .gitignore - Fix publickey authentication regression Commit 70b199f47659a74b8778c528beccf893843e5ecb introduced a parsing bug in file_read_publickey() which made the algorithm name contain an extra trailing space character, breaking all publickey authentication. - Add a direct-tcpip example which shows local port forwarding - Add session parameter and LIBSSH2_TRACE_SOCKET to libssh2_trace(3) man page - Add TODO: Expose error messages sent by the server Daiki Ueno (23 Dec 2009) - Fix doc comments. - Add man pages for ssh-agent API. - Don't request userauthlist after authentication. Simon Josefsson (21 Dec 2009) - Add. - [Daiki Ueno brought this change] Add an example to use ssh-agent API. Signed-off-by: Simon Josefsson <simon@josefsson.org> - [Daiki Ueno brought this change] Add ssh-agent API. Signed-off-by: Simon Josefsson <simon@josefsson.org> - [Daiki Ueno brought this change] Add callback-based API for publickey auth. Signed-off-by: Simon Josefsson <simon@josefsson.org> - Move examples from example/simple to example/. - Move examples from example/simple to example/. Daniel Stenberg (17 Dec 2009) - _libssh2_list_insert() fixed to work While this is code not currently in use, it is part of the generic linked list code and since I found the error I thought I'd better fix it since we might bring in this function into the code one day. Simon Josefsson (16 Dec 2009) - Silence compiler warnings. Based on patch by Kamil Dudka <kdudka@redhat.com> in <http://www.mail-archive.com/libssh2-devel@cool.haxx.se/msg00796.html>. - [Kamil Dudka brought this change] libgcrypt: simplify code of _libssh2_dsa_sha1_sign Signed-off-by: Simon Josefsson <simon@josefsson.org> - [Kamil Dudka brought this change] libgcrypt: follow-up for ssh-dss padding fix Signed-off-by: Simon Josefsson <simon@josefsson.org> Dan Fandrich (15 Dec 2009) - Check for the right environment variable in the test app Simon Josefsson (14 Dec 2009) - Silence warning about unused function parameter. Reported by Steven Van Ingelgem <steven@vaningelgem.be>. Daniel Stenberg (10 Dec 2009) - avoid returning data to memory already freed In case of failure we must make sure that the data we return doesn't point to a memory area already freed. Reported anonymously in the bug report #2910103. Peter Stuge (8 Dec 2009) - Use LIBSSH2_TRACE_* internally and remove redundant LIBSSH2_DBG_* - Add LIBSSH2_TRACE_SOCKET context for tracing send() and recv() Helpful in debugging the -39 errors. - Another transport layer fix for bogus -39 (LIBSSH2_ERROR_BAD_USE) errors Commit 683aa0f6b52fb1014873c961709102b5006372fc made send_existing() send more than just the second part of a packet when the kernel did not accept the full packet, but the function still overlooked the SSH protocol overhead in each packet, often 48 bytes. If only the last few bytes of a packet remained, then the packet would erroneously be considered completely sent, and the next call to write more data in the session would return a -39 error. Daniel Stenberg (6 Dec 2009) - move local variable to be more localized - fixed some indent mistakes Peter Stuge (6 Dec 2009) - Fix padding in ssh-dss signature blob encoding DSA signatures consist of two 160-bit integers called r and s. In ssh-dss signature blobs r and s are stored directly after each other in binary representation, making up a 320-bit (40 byte) string. (See RFC4253 p14.) The crypto wrappers in libssh2 would either pack r and s incorrectly, or fail, when at least one integer was small enough to be stored in 19 bytes or less. The patch ensures that r and s are always stored as two 160 bit numbers. - Don't always clear write direction blocking flag When libssh2_transport_write() is called to continue sending a partially sent packet the write direction flag must not be cleared until the previous packet has been completely sent, or the app would hang if the packet still isn't sent completely, since select() gets called by the internal blocking emulation layer in libssh2 but would then not be watching the socket for writability. Clear the flag only once processing of previous packet data is complete and a new packet is about to be prepared. Alexander Lamaison (24 Nov 2009) - Detabify. - [Daniel Stenberg brought this change] Fixed memory leak in sftp_fstat(). Simon Josefsson (17 Nov 2009) - Mark date of 1.2.2 release. - Merge branch 'master' of ssh://git.stuge.se/var/lib/git/libssh2 Version 1.2.2 (16 Nov 2009) Daniel Stenberg (16 Nov 2009) - prepared for 1.2.2 Simon Josefsson (16 Nov 2009) - Improve NEWS items. - Support AES-Counter ciphers. - Silence compiler warning. Reported by Steven Van Ingelgem <steven@vaningelgem.be> in <http://thread.gmane.org/gmane.network.ssh.libssh2.devel/2566>. - Mention libssh2-style.el. - Use memmove instead of memcpy on overlapping memory areas. Reported by Bob Alexander <balexander@expressor-software.com> in <http://thread.gmane.org/gmane.network.ssh.libssh2.devel/2530>. - Add. - Protect against crash on too small SSH_MSG_IGNORE packets. Reported by Bob Alexander <balexander@expressor-software.com> in <http://thread.gmane.org/gmane.network.ssh.libssh2.devel/2530>. - add copyright line PK ]h�\�� �� � man/man1/nghttpd.1nu �[��� .\" Man page generated from reStructuredText .\" by the Docutils 0.22.4 manpage writer. . . .nr rst2man-indent-level 0 . .de1 rstReportMargin \\$1 \\n[an-margin] level \\n[rst2man-indent-level] level margin: \\n[rst2man-indent\\n[rst2man-indent-level]] - \\n[rst2man-indent0] \\n[rst2man-indent1] \\n[rst2man-indent2] .. .de1 INDENT .\" .rstReportMargin pre: . RS \\$1 . nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin] . nr rst2man-indent-level +1 .\" .rstReportMargin post: .. .de UNINDENT . RE .\" indent \\n[an-margin] .\" old: \\n[rst2man-indent\\n[rst2man-indent-level]] .nr rst2man-indent-level -1 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]] .in \\n[rst2man-indent\\n[rst2man-indent-level]]u .. .TH "NGHTTPD" "1" "Apr 19, 2026" "1.69.0" "nghttp2" .SH NAME nghttpd \- HTTP/2 server .SH SYNOPSIS .sp \fBnghttpd\fP [OPTION]... <PORT> [<PRIVATE_KEY> <CERT>] .SH DESCRIPTION .sp HTTP/2 server .INDENT 0.0 .TP .B <PORT> Specify listening port number. .UNINDENT .INDENT 0.0 .TP .B <PRIVATE_KEY> Set path to server\(aqs private key. Required unless \fB\-\-no\-tls\fP is specified. .UNINDENT .INDENT 0.0 .TP .B <CERT> Set path to server\(aqs certificate. Required unless \fB\-\-no\-tls\fP is specified. .UNINDENT .SH OPTIONS .INDENT 0.0 .TP .B \-a, \-\-address=<ADDR> The address to bind to. If not specified the default IP address determined by getaddrinfo is used. .UNINDENT .INDENT 0.0 .TP .B \-D, \-\-daemon Run in a background. If \fB\-D\fP is used, the current working directory is changed to \(aq\fI/\fP\(aq. Therefore if this option is used, \fB\-d\fP option must be specified. .UNINDENT .INDENT 0.0 .TP .B \-V, \-\-verify\-client The server sends a client certificate request. If the client did not return a certificate, the handshake is terminated. Currently, this option just requests a client certificate and does not verify it. .UNINDENT .INDENT 0.0 .TP .B \-d, \-\-htdocs=<PATH> Specify document root. If this option is not specified, the document root is the current working directory. .UNINDENT .INDENT 0.0 .TP .B \-v, \-\-verbose Print debug information such as reception/ transmission of frames and name/value pairs. .UNINDENT .INDENT 0.0 .TP .B \-\-no\-tls Disable SSL/TLS. .UNINDENT .INDENT 0.0 .TP .B \-c, \-\-header\-table\-size=<SIZE> Specify decoder header table size. .UNINDENT .INDENT 0.0 .TP .B \-\-encoder\-header\-table\-size=<SIZE> Specify encoder header table size. The decoder (client) specifies the maximum dynamic table size it accepts. Then the negotiated dynamic table size is the minimum of this option value and the value which client specified. .UNINDENT .INDENT 0.0 .TP .B \-\-color Force colored log output. .UNINDENT .INDENT 0.0 .TP .B \-p, \-\-push=<PATH>=<PUSH_PATH,...> Push resources <PUSH_PATH>s when <PATH> is requested. This option can be used repeatedly to specify multiple push configurations. <PATH> and <PUSH_PATH>s are relative to document root. See \fB\-\-htdocs\fP option. Example: \fB\-p\fP/=/foo.png \fB\-p\fP/doc=/bar.css .UNINDENT .INDENT 0.0 .TP .B \-b, \-\-padding=<N> Add at most <N> bytes to a frame payload as padding. Specify 0 to disable padding. .UNINDENT .INDENT 0.0 .TP .B \-m, \-\-max\-concurrent\-streams=<N> Set the maximum number of the concurrent streams in one HTTP/2 session. .sp Default: \fB100\fP .UNINDENT .INDENT 0.0 .TP .B \-n, \-\-workers=<N> Set the number of worker threads. .sp Default: \fB1\fP .UNINDENT .INDENT 0.0 .TP .B \-e, \-\-error\-gzip Make error response gzipped. .UNINDENT .INDENT 0.0 .TP .B \-w, \-\-window\-bits=<N> Sets the stream level initial window size to 2**<N>\-1. .UNINDENT .INDENT 0.0 .TP .B \-W, \-\-connection\-window\-bits=<N> Sets the connection level initial window size to 2**<N>\-1. .UNINDENT .INDENT 0.0 .TP .B \-\-dh\-param\-file=<PATH> Path to file that contains DH parameters in PEM format. Without this option, DHE cipher suites are not available. .UNINDENT .INDENT 0.0 .TP .B \-\-early\-response Start sending response when request HEADERS is received, rather than complete request is received. .UNINDENT .INDENT 0.0 .TP .B \-\-trailer=<HEADER> Add a trailer header to a response. <HEADER> must not include pseudo header field (header field name starting with \(aq:\(aq). The trailer is sent only if a response has body part. Example: \fB\-\-trailer\fP \(aqfoo: bar\(aq. .UNINDENT .INDENT 0.0 .TP .B \-\-hexdump Display the incoming traffic in hexadecimal (Canonical hex+ASCII display). If SSL/TLS is used, decrypted data are used. .UNINDENT .INDENT 0.0 .TP .B \-\-echo\-upload Send back uploaded content if method is POST or PUT. .UNINDENT .INDENT 0.0 .TP .B \-\-mime\-types\-file=<PATH> Path to file that contains MIME media types and the extensions that represent them. .sp Default: \fB/etc/mime.types\fP .UNINDENT .INDENT 0.0 .TP .B \-\-no\-content\-length Don\(aqt send content\-length header field. .UNINDENT .INDENT 0.0 .TP .B \-\-groups=<GROUPS> Specify the supported groups. .sp Default: \fBX25519:P\-256:P\-384:P\-521\fP .UNINDENT .INDENT 0.0 .TP .B \-\-ktls Enable ktls. .UNINDENT .INDENT 0.0 .TP .B \-\-version Display version information and exit. .UNINDENT .INDENT 0.0 .TP .B \-h, \-\-help Display this help and exit. .UNINDENT .sp The <SIZE> argument is an integer and an optional unit (e.g., 10K is 10 * 1024). Units are K, M and G (powers of 1024). .SH SEE ALSO .sp \fBnghttp(1)\fP, \fBnghttpx(1)\fP, \fBh2load(1)\fP .SH Author Tatsuhiro Tsujikawa .SH Copyright 2012, 2015, 2016, Tatsuhiro Tsujikawa .\" End of generated man page. PK ]h�\���ܒc �c man/man1/nghttpx.1nu �[��� .\" Man page generated from reStructuredText .\" by the Docutils 0.22.4 manpage writer. . . .nr rst2man-indent-level 0 . .de1 rstReportMargin \\$1 \\n[an-margin] level \\n[rst2man-indent-level] level margin: \\n[rst2man-indent\\n[rst2man-indent-level]] - \\n[rst2man-indent0] \\n[rst2man-indent1] \\n[rst2man-indent2] .. .de1 INDENT .\" .rstReportMargin pre: . RS \\$1 . nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin] . nr rst2man-indent-level +1 .\" .rstReportMargin post: .. .de UNINDENT . RE .\" indent \\n[an-margin] .\" old: \\n[rst2man-indent\\n[rst2man-indent-level]] .nr rst2man-indent-level -1 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]] .in \\n[rst2man-indent\\n[rst2man-indent-level]]u .. .TH "NGHTTPX" "1" "Apr 19, 2026" "1.69.0" "nghttp2" .SH NAME nghttpx \- HTTP/2 proxy .SH SYNOPSIS .sp \fBnghttpx\fP [OPTIONS]... [<PRIVATE_KEY> <CERT>] .SH DESCRIPTION .sp A reverse proxy for HTTP/3, HTTP/2, and HTTP/1. .INDENT 0.0 .TP .B <PRIVATE_KEY> Set path to server\(aqs private key. Required unless \(dqno\-tls\(dq parameter is used in \fB\-\-frontend\fP option. .UNINDENT .INDENT 0.0 .TP .B <CERT> Set path to server\(aqs certificate. Required unless \(dqno\-tls\(dq parameter is used in \fB\-\-frontend\fP option. .UNINDENT .SH OPTIONS .sp The options are categorized into several groups. .SS Connections .INDENT 0.0 .TP .B \-b, \-\-backend=(<HOST>,<PORT>|unix:<PATH>)[;[<PATTERN>[:...]][[;<PARAM>]...] Set backend host and port. The multiple backend addresses are accepted by repeating this option. UNIX domain socket can be specified by prefixing path name with \(dqunix:\(dq (e.g., unix:/var/run/backend.sock). .sp Optionally, if <PATTERN>s are given, the backend address is only used if request matches the pattern. The pattern matching is closely designed to ServeMux in net/http package of Go programming language. <PATTERN> consists of path, host + path or just host. The path must start with \(dq\fI/\fP\(dq. If it ends with \(dq\fI/\fP\(dq, it matches all request path in its subtree. To deal with the request to the directory without trailing slash, the path which ends with \(dq\fI/\fP\(dq also matches the request path which only lacks trailing \(aq\fI/\fP\(aq (e.g., path \(dq\fI/foo/\fP\(dq matches request path \(dq\fI/foo\fP\(dq). If it does not end with \(dq\fI/\fP\(dq, it performs exact match against the request path. If host is given, it performs a match against the request host. For a request received on the frontend listener with \(dqsni\-fwd\(dq parameter enabled, SNI host is used instead of a request host. If host alone is given, \(dq\fI/\fP\(dq is appended to it, so that it matches all request paths under the host (e.g., specifying \(dqnghttp2.org\(dq equals to \(dqnghttp2.org/\(dq). CONNECT method is treated specially. It does not have path, and we don\(aqt allow empty path. To workaround this, we assume that CONNECT method has \(dq\fI/\fP\(dq as path. .sp Patterns with host take precedence over patterns with just path. Then, longer patterns take precedence over shorter ones. .sp Host can include \(dq*\(dq in the left most position to indicate wildcard match (only suffix match is done). The \(dq*\(dq must match at least one character. For example, host pattern \(dq*.nghttp2.org\(dq matches against \(dqwww.nghttp2.org\(dq and \(dqgit.ngttp2.org\(dq, but does not match against \(dqnghttp2.org\(dq. The exact hosts match takes precedence over the wildcard hosts match. .sp If path part ends with \(dq*\(dq, it is treated as wildcard path. The wildcard path behaves differently from the normal path. For normal path, match is made around the boundary of path component separator,\(dq\fI/\fP\(dq. On the other hand, the wildcard path does not take into account the path component separator. All paths which include the wildcard path without last \(dq*\(dq as prefix, and are strictly longer than wildcard path without last \(dq*\(dq are matched. \(dq*\(dq must match at least one character. For example, the pattern \(dq\fI/foo*\fP\(dq matches \(dq\fI/foo/\fP\(dq and \(dq\fI/foobar\fP\(dq. But it does not match \(dq\fI/foo\fP\(dq, or \(dq\fI/fo\fP\(dq. .sp If <PATTERN> is omitted or empty string, \(dq\fI/\fP\(dq is used as pattern, which matches all request paths (catch\-all pattern). The catch\-all backend must be given. .sp When doing a match, nghttpx made some normalization to pattern, request host and path. For host part, they are converted to lower case. For path part, percent\-encoded unreserved characters defined in RFC 3986 are decoded, and any dot\-segments (\(dq..\(dq and \(dq.\(dq) are resolved and removed. .sp For example, \fB\-b\fP\(aq127.0.0.1,8080;nghttp2.org/httpbin/\(aq matches the request host \(dqnghttp2.org\(dq and the request path \(dq\fI/httpbin/get\fP\(dq, but does not match the request host \(dqnghttp2.org\(dq and the request path \(dq\fI/index.html\fP\(dq. .sp The multiple <PATTERN>s can be specified, delimiting them by \(dq:\(dq. Specifying \fB\-b\fP\(aq127.0.0.1,8080;nghttp2.org:www.nghttp2.org\(aq has the same effect to specify \fB\-b\fP\(aq127.0.0.1,8080;nghttp2.org\(aq and \fB\-b\fP\(aq127.0.0.1,8080;www.nghttp2.org\(aq. .sp The backend addresses sharing same <PATTERN> are grouped together forming load balancing group. .sp Several parameters <PARAM> are accepted after <PATTERN>. The parameters are delimited by \(dq;\(dq. The available parameters are: \(dqproto=<PROTO>\(dq, \(dqtls\(dq, \(dqsni=<SNI_HOST>\(dq, \(dqfall=<N>\(dq, \(dqrise=<N>\(dq, \(dqaffinity=<METHOD>\(dq, \(dqdns\(dq, \(dqredirect\-if\-not\-tls\(dq, \(dqupgrade\-scheme\(dq, \(dqmruby=<PATH>\(dq, \(dqread\-timeout=<DURATION>\(dq, \(dqwrite\-timeout=<DURATION>\(dq, \(dqgroup=<GROUP>\(dq, \(dqgroup\-weight=<N>\(dq, \(dqweight=<N>\(dq, and \(dqdnf\(dq. The parameter consists of keyword, and optionally followed by \(dq=\(dq and value. For example, the parameter \(dqproto=h2\(dq consists of the keyword \(dqproto\(dq and value \(dqh2\(dq. The parameter \(dqtls\(dq consists of the keyword \(dqtls\(dq without value. Each parameter is described as follows. .sp The backend application protocol can be specified using optional \(dqproto\(dq parameter, and in the form of \(dqproto=<PROTO>\(dq. <PROTO> should be one of the following list without quotes: \(dqh2\(dq, \(dqhttp/1.1\(dq. The default value of <PROTO> is \(dqhttp/1.1\(dq. Note that usually \(dqh2\(dq refers to HTTP/2 over TLS. But in this option, it may mean HTTP/2 over cleartext TCP unless \(dqtls\(dq keyword is used (see below). .sp TLS can be enabled by specifying optional \(dqtls\(dq parameter. TLS is not enabled by default. .sp With \(dqsni=<SNI_HOST>\(dq parameter, it can override the TLS SNI field value with given <SNI_HOST>. This will default to the backend <HOST> name .sp The feature to detect whether backend is online or offline can be enabled using optional \(dqfall\(dq and \(dqrise\(dq parameters. Using \(dqfall=<N>\(dq parameter, if nghttpx cannot connect to a this backend <N> times in a row, this backend is assumed to be offline, and it is excluded from load balancing. If <N> is 0, this backend never be excluded from load balancing whatever times nghttpx cannot connect to it, and this is the default. There is also \(dqrise=<N>\(dq parameter. After backend was excluded from load balancing group, nghttpx periodically attempts to make a connection to the failed backend, and if the connection is made successfully <N> times in a row, the backend is assumed to be online, and it is now eligible for load balancing target. If <N> is 0, a backend is permanently offline, once it goes in that state, and this is the default behaviour. .sp The session affinity is enabled using \(dqaffinity=<METHOD>\(dq parameter. If \(dqip\(dq is given in <METHOD>, client IP based session affinity is enabled. If \(dqcookie\(dq is given in <METHOD>, cookie based session affinity is enabled. If \(dqnone\(dq is given in <METHOD>, session affinity is disabled, and this is the default. The session affinity is enabled per <PATTERN>. If at least one backend has \(dqaffinity\(dq parameter, and its <METHOD> is not \(dqnone\(dq, session affinity is enabled for all backend servers sharing the same <PATTERN>. It is advised to set \(dqaffinity\(dq parameter to all backend explicitly if session affinity is desired. The session affinity may break if one of the backend gets unreachable, or backend settings are reloaded or replaced by API. .sp If \(dqaffinity=cookie\(dq is used, the additional configuration is required. \(dqaffinity\-cookie\-name=<NAME>\(dq must be used to specify a name of cookie to use. Optionally, \(dqaffinity\-cookie\-path=<PATH>\(dq can be used to specify a path which cookie is applied. The optional \(dqaffinity\-cookie\-secure=<SECURE>\(dq controls the Secure attribute of a cookie. The default value is \(dqauto\(dq, and the Secure attribute is determined by a request scheme. If a request scheme is \(dqhttps\(dq, then Secure attribute is set. Otherwise, it is not set. If <SECURE> is \(dqyes\(dq, the Secure attribute is always set. If <SECURE> is \(dqno\(dq, the Secure attribute is always omitted. \(dqaffinity\-cookie\-stickiness=<STICKINESS>\(dq controls stickiness of this affinity. If <STICKINESS> is \(dqloose\(dq, removing or adding a backend server might break the affinity and the request might be forwarded to a different backend server. If <STICKINESS> is \(dqstrict\(dq, removing the designated backend server breaks affinity, but adding new backend server does not cause breakage. If the designated backend server becomes unavailable, new backend server is chosen as if the request does not have an affinity cookie. <STICKINESS> defaults to \(dqloose\(dq. .sp By default, name resolution of backend host name is done at start up, or reloading configuration. If \(dqdns\(dq parameter is given, name resolution takes place dynamically. This is useful if backend address changes frequently. If \(dqdns\(dq is given, name resolution of backend host name at start up, or reloading configuration is skipped. .sp If \(dqredirect\-if\-not\-tls\(dq parameter is used, the matched backend requires that frontend connection is TLS encrypted. If it isn\(aqt, nghttpx responds to the request with 308 status code, and https URI the client should use instead is included in Location header field. The port number in redirect URI is 443 by default, and can be changed using \fB\-\-redirect\-https\-port\fP option. If at least one backend has \(dqredirect\-if\-not\-tls\(dq parameter, this feature is enabled for all backend servers sharing the same <PATTERN>. It is advised to set \(dqredirect\-if\-no\-tls\(dq parameter to all backends explicitly if this feature is desired. .sp If \(dqupgrade\-scheme\(dq parameter is used along with \(dqtls\(dq parameter, HTTP/2 :scheme pseudo header field is changed to \(dqhttps\(dq from \(dqhttp\(dq when forwarding a request to this particular backend. This is a workaround for a backend server which requires \(dqhttps\(dq :scheme pseudo header field on TLS encrypted connection. .sp \(dqmruby=<PATH>\(dq parameter specifies a path to mruby script file which is invoked when this pattern is matched. All backends which share the same pattern must have the same mruby path. .sp \(dqread\-timeout=<DURATION>\(dq and \(dqwrite\-timeout=<DURATION>\(dq parameters specify the read and write timeout of the backend connection when this pattern is matched. All backends which share the same pattern must have the same timeouts. If these timeouts are entirely omitted for a pattern, \fB\-\-backend\-read\-timeout\fP and \fB\-\-backend\-write\-timeout\fP are used. .sp \(dqgroup=<GROUP>\(dq parameter specifies the name of group this backend address belongs to. By default, it belongs to the unnamed default group. The name of group is unique per pattern. \(dqgroup\-weight=<N>\(dq parameter specifies the weight of the group. The higher weight gets more frequently selected by the load balancing algorithm. <N> must be [1, 256] inclusive. The weight 8 has 4 times more weight than 2. <N> must be the same for all addresses which share the same <GROUP>. If \(dqgroup\-weight\(dq is omitted in an address, but the other address which belongs to the same group specifies \(dqgroup\-weight\(dq, its weight is used. If no \(dqgroup\-weight\(dq is specified for all addresses, the weight of a group becomes 1. \(dqgroup\(dq and \(dqgroup\-weight\(dq are ignored if session affinity is enabled. .sp \(dqweight=<N>\(dq parameter specifies the weight of the backend address inside a group which this address belongs to. The higher weight gets more frequently selected by the load balancing algorithm. <N> must be [1, 256] inclusive. The weight 8 has 4 times more weight than weight 2. If this parameter is omitted, weight becomes 1. \(dqweight\(dq is ignored if session affinity is enabled. .sp If \(dqdnf\(dq parameter is specified, an incoming request is not forwarded to a backend and just consumed along with the request body (actually a backend server never be contacted). It is expected that the HTTP response is generated by mruby script (see \(dqmruby=<PATH>\(dq parameter above). \(dqdnf\(dq is an abbreviation of \(dqdo not forward\(dq. .sp Since \(dq;\(dq and \(dq:\(dq are used as delimiter, <PATTERN> must not contain these characters. In order to include \(dq:\(dq in <PATTERN>, one has to specify \(dq%3A\(dq (which is percent\-encoded from of \(dq:\(dq) instead. Since \(dq;\(dq has special meaning in shell, the option value must be quoted. .sp Default: \fB127.0.0.1,80\fP .UNINDENT .INDENT 0.0 .TP .B \-f, \-\-frontend=(<HOST>,<PORT>|unix:<PATH>)[[;<PARAM>]...] Set frontend host and port. If <HOST> is \(aq*\(aq, it assumes all addresses including both IPv4 and IPv6. UNIX domain socket can be specified by prefixing path name with \(dqunix:\(dq (e.g., unix:/var/run/nghttpx.sock). This option can be used multiple times to listen to multiple addresses. .sp This option can take 0 or more parameters, which are described below. Note that \(dqapi\(dq and \(dqhealthmon\(dq parameters are mutually exclusive. .sp Optionally, TLS can be disabled by specifying \(dqno\-tls\(dq parameter. TLS is enabled by default. .sp If \(dqsni\-fwd\(dq parameter is used, when performing a match to select a backend server, SNI host name received from the client is used instead of the request host. See \fB\-\-backend\fP option about the pattern match. .sp To make this frontend as API endpoint, specify \(dqapi\(dq parameter. This is disabled by default. It is important to limit the access to the API frontend. Otherwise, someone may change the backend server, and break your services, or expose confidential information to the outside the world. .sp To make this frontend as health monitor endpoint, specify \(dqhealthmon\(dq parameter. This is disabled by default. Any requests which come through this address are replied with 200 HTTP status, without no body. .sp To accept PROXY protocol version 1 and 2 on frontend connection, specify \(dqproxyproto\(dq parameter. This is disabled by default. .sp To receive HTTP/3 (QUIC) traffic, specify \(dqquic\(dq parameter. It makes nghttpx listen on UDP port rather than TCP port. UNIX domain socket, \(dqapi\(dq, and \(dqhealthmon\(dq parameters cannot be used with \(dqquic\(dq parameter. .sp Default: \fB*,3000\fP .UNINDENT .INDENT 0.0 .TP .B \-\-backlog=<N> Set listen backlog size. .sp Default: \fB65536\fP .UNINDENT .INDENT 0.0 .TP .B \-\-backend\-address\-family=(auto|IPv4|IPv6) Specify address family of backend connections. If \(dqauto\(dq is given, both IPv4 and IPv6 are considered. If \(dqIPv4\(dq is given, only IPv4 address is considered. If \(dqIPv6\(dq is given, only IPv6 address is considered. .sp Default: \fBauto\fP .UNINDENT .INDENT 0.0 .TP .B \-\-backend\-http\-proxy\-uri=<URI> Specify proxy URI in the form \%<http:/>/[<USER>:<PASS>@]<PROXY>:<PORT>. If a proxy requires authentication, specify <USER> and <PASS>. Note that they must be properly percent\-encoded. This proxy is used when the backend connection is HTTP/2. First, make a CONNECT request to the proxy and it connects to the backend on behalf of nghttpx. This forms tunnel. After that, nghttpx performs SSL/TLS handshake with the downstream through the tunnel. The timeouts when connecting and making CONNECT request can be specified by \fB\-\-backend\-read\-timeout\fP and \fB\-\-backend\-write\-timeout\fP options. .UNINDENT .SS Performance .INDENT 0.0 .TP .B \-n, \-\-workers=<N> Set the number of worker threads. .sp Default: \fB1\fP .UNINDENT .INDENT 0.0 .TP .B \-\-single\-thread Run everything in one thread inside the worker process. This feature is provided for better debugging experience, or for the platforms which lack thread support. If threading is disabled, this option is always enabled. .UNINDENT .INDENT 0.0 .TP .B \-\-read\-rate=<SIZE> Set maximum average read rate on frontend connection. Setting 0 to this option means read rate is unlimited. .sp Default: \fB0\fP .UNINDENT .INDENT 0.0 .TP .B \-\-read\-burst=<SIZE> Set maximum read burst size on frontend connection. Setting 0 to this option means read burst size is unlimited. .sp Default: \fB0\fP .UNINDENT .INDENT 0.0 .TP .B \-\-write\-rate=<SIZE> Set maximum average write rate on frontend connection. Setting 0 to this option means write rate is unlimited. .sp Default: \fB0\fP .UNINDENT .INDENT 0.0 .TP .B \-\-write\-burst=<SIZE> Set maximum write burst size on frontend connection. Setting 0 to this option means write burst size is unlimited. .sp Default: \fB0\fP .UNINDENT .INDENT 0.0 .TP .B \-\-worker\-read\-rate=<SIZE> Set maximum average read rate on frontend connection per worker. Setting 0 to this option means read rate is unlimited. Not implemented yet. .sp Default: \fB0\fP .UNINDENT .INDENT 0.0 .TP .B \-\-worker\-read\-burst=<SIZE> Set maximum read burst size on frontend connection per worker. Setting 0 to this option means read burst size is unlimited. Not implemented yet. .sp Default: \fB0\fP .UNINDENT .INDENT 0.0 .TP .B \-\-worker\-write\-rate=<SIZE> Set maximum average write rate on frontend connection per worker. Setting 0 to this option means write rate is unlimited. Not implemented yet. .sp Default: \fB0\fP .UNINDENT .INDENT 0.0 .TP .B \-\-worker\-write\-burst=<SIZE> Set maximum write burst size on frontend connection per worker. Setting 0 to this option means write burst size is unlimited. Not implemented yet. .sp Default: \fB0\fP .UNINDENT .INDENT 0.0 .TP .B \-\-worker\-frontend\-connections=<N> Set maximum number of simultaneous connections frontend accepts. Setting 0 means unlimited. .sp Default: \fB0\fP .UNINDENT .INDENT 0.0 .TP .B \-\-backend\-connections\-per\-host=<N> Set maximum number of backend concurrent connections (and/or streams in case of HTTP/2) per origin host. This option is meaningful when \fB\-\-http2\-proxy\fP option is used. The origin host is determined by authority portion of request URI (or :authority header field for HTTP/2). To limit the number of connections per frontend for default mode, use \fB\-\-backend\-connections\-per\-frontend\fP\&. .sp Default: \fB8\fP .UNINDENT .INDENT 0.0 .TP .B \-\-backend\-connections\-per\-frontend=<N> Set maximum number of backend concurrent connections (and/or streams in case of HTTP/2) per frontend. This option is only used for default mode. 0 means unlimited. To limit the number of connections per host with \fB\-\-http2\-proxy\fP option, use \fB\-\-backend\-connections\-per\-host\fP\&. .sp Default: \fB0\fP .UNINDENT .INDENT 0.0 .TP .B \-\-rlimit\-nofile=<N> Set maximum number of open files (RLIMIT_NOFILE) to <N>. If 0 is given, nghttpx does not set the limit. .sp Default: \fB0\fP .UNINDENT .INDENT 0.0 .TP .B \-\-rlimit\-memlock=<N> Set maximum number of bytes of memory that may be locked into RAM. If 0 is given, nghttpx does not set the limit. .sp Default: \fB0\fP .UNINDENT .INDENT 0.0 .TP .B \-\-backend\-request\-buffer=<SIZE> Set buffer size used to store backend request. .sp Default: \fB16K\fP .UNINDENT .INDENT 0.0 .TP .B \-\-backend\-response\-buffer=<SIZE> Set buffer size used to store backend response. .sp Default: \fB128K\fP .UNINDENT .INDENT 0.0 .TP .B \-\-fastopen=<N> Enables \(dqTCP Fast Open\(dq for the listening socket and limits the maximum length for the queue of connections that have not yet completed the three\-way handshake. If value is 0 then fast open is disabled. .sp Default: \fB0\fP .UNINDENT .INDENT 0.0 .TP .B \-\-no\-kqueue Don\(aqt use kqueue. This option is only applicable for the platforms which have kqueue. For other platforms, this option will be simply ignored. .UNINDENT .SS Timeout .INDENT 0.0 .TP .B \-\-frontend\-http2\-idle\-timeout=<DURATION> Specify idle timeout for HTTP/2 frontend connection. If no active streams exist for this duration, connection is closed. .sp Default: \fB3m\fP .UNINDENT .INDENT 0.0 .TP .B \-\-frontend\-http3\-idle\-timeout=<DURATION> Specify idle timeout for HTTP/3 frontend connection. If no active streams exist for this duration, connection is closed. .sp Default: \fB3m\fP .UNINDENT .INDENT 0.0 .TP .B \-\-frontend\-write\-timeout=<DURATION> Specify write timeout for all frontend connections. .sp Default: \fB30s\fP .UNINDENT .INDENT 0.0 .TP .B \-\-frontend\-keep\-alive\-timeout=<DURATION> Specify keep\-alive timeout for frontend HTTP/1 connection. .sp Default: \fB1m\fP .UNINDENT .INDENT 0.0 .TP .B \-\-frontend\-header\-timeout=<DURATION> Specify duration that the server waits for an HTTP request header fields to be received completely. On timeout, HTTP/1 and HTTP/2 connections are closed. For HTTP/3, the stream is shutdown, and the connection itself is left intact. .sp Default: \fB1m\fP .UNINDENT .INDENT 0.0 .TP .B \-\-stream\-read\-timeout=<DURATION> Specify read timeout for HTTP/2 streams. 0 means no timeout. .sp Default: \fB0\fP .UNINDENT .INDENT 0.0 .TP .B \-\-stream\-write\-timeout=<DURATION> Specify write timeout for HTTP/2 streams. 0 means no timeout. .sp Default: \fB1m\fP .UNINDENT .INDENT 0.0 .TP .B \-\-backend\-read\-timeout=<DURATION> Specify read timeout for backend connection. .sp Default: \fB1m\fP .UNINDENT .INDENT 0.0 .TP .B \-\-backend\-write\-timeout=<DURATION> Specify write timeout for backend connection. .sp Default: \fB30s\fP .UNINDENT .INDENT 0.0 .TP .B \-\-backend\-connect\-timeout=<DURATION> Specify timeout before establishing TCP connection to backend. .sp Default: \fB30s\fP .UNINDENT .INDENT 0.0 .TP .B \-\-backend\-keep\-alive\-timeout=<DURATION> Specify keep\-alive timeout for backend HTTP/1 connection. .sp Default: \fB2s\fP .UNINDENT .INDENT 0.0 .TP .B \-\-listener\-disable\-timeout=<DURATION> After accepting connection failed, connection listener is disabled for a given amount of time. Specifying 0 disables this feature. .sp Default: \fB30s\fP .UNINDENT .INDENT 0.0 .TP .B \-\-frontend\-http2\-setting\-timeout=<DURATION> Specify timeout before SETTINGS ACK is received from client. .sp Default: \fB10s\fP .UNINDENT .INDENT 0.0 .TP .B \-\-backend\-http2\-settings\-timeout=<DURATION> Specify timeout before SETTINGS ACK is received from backend server. .sp Default: \fB10s\fP .UNINDENT .INDENT 0.0 .TP .B \-\-backend\-max\-backoff=<DURATION> Specify maximum backoff interval. This is used when doing health check against offline backend (see \(dqfail\(dq parameter in \fB\-\-backend\fP option). It is also used to limit the maximum interval to temporarily disable backend when nghttpx failed to connect to it. These intervals are calculated using exponential backoff, and consecutive failed attempts increase the interval. This option caps its maximum value. .sp Default: \fB2m\fP .UNINDENT .SS SSL/TLS .INDENT 0.0 .TP .B \-\-ciphers=<SUITE> Set allowed cipher list for frontend connection. The format of the string is described in OpenSSL ciphers(1). This option sets cipher suites for TLSv1.2. Use \fB\-\-tls13\-ciphers\fP for TLSv1.3. .sp Default: \fBECDHE\-ECDSA\-AES128\-GCM\-SHA256:ECDHE\-RSA\-AES128\-GCM\-SHA256:ECDHE\-ECDSA\-AES256\-GCM\-SHA384:ECDHE\-RSA\-AES256\-GCM\-SHA384:ECDHE\-ECDSA\-CHACHA20\-POLY1305:ECDHE\-RSA\-CHACHA20\-POLY1305:DHE\-RSA\-AES128\-GCM\-SHA256:DHE\-RSA\-AES256\-GCM\-SHA384\fP .UNINDENT .INDENT 0.0 .TP .B \-\-tls13\-ciphers=<SUITE> Set allowed cipher list for frontend connection. The format of the string is described in OpenSSL ciphers(1). This option sets cipher suites for TLSv1.3. Use \fB\-\-ciphers\fP for TLSv1.2. .sp Default: \fBTLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256\fP .UNINDENT .INDENT 0.0 .TP .B \-\-client\-ciphers=<SUITE> Set allowed cipher list for backend connection. The format of the string is described in OpenSSL ciphers(1). This option sets cipher suites for TLSv1.2. Use \fB\-\-tls13\-client\-ciphers\fP for TLSv1.3. .sp Default: \fBECDHE\-ECDSA\-AES128\-GCM\-SHA256:ECDHE\-RSA\-AES128\-GCM\-SHA256:ECDHE\-ECDSA\-AES256\-GCM\-SHA384:ECDHE\-RSA\-AES256\-GCM\-SHA384:ECDHE\-ECDSA\-CHACHA20\-POLY1305:ECDHE\-RSA\-CHACHA20\-POLY1305:DHE\-RSA\-AES128\-GCM\-SHA256:DHE\-RSA\-AES256\-GCM\-SHA384\fP .UNINDENT .INDENT 0.0 .TP .B \-\-tls13\-client\-ciphers=<SUITE> Set allowed cipher list for backend connection. The format of the string is described in OpenSSL ciphers(1). This option sets cipher suites for TLSv1.3. Use \fB\-\-client\-ciphers\fP for TLSv1.2. .sp Default: \fBTLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256\fP .UNINDENT .INDENT 0.0 .TP .B \-\-groups=<LIST> Set the supported group list for frontend connections. <LIST> is a colon separated list of group NID or names in the preference order. The supported curves depend on the linked OpenSSL library. This function requires OpenSSL >= 1.0.2. .sp Default: \fBX25519:P\-256:P\-384:P\-521\fP .UNINDENT .INDENT 0.0 .TP .B \-k, \-\-insecure Don\(aqt verify backend server\(aqs certificate if TLS is enabled for backend connections. .UNINDENT .INDENT 0.0 .TP .B \-\-cacert=<PATH> Set path to trusted CA certificate file. It is used in backend TLS connections to verify peer\(aqs certificate. The file must be in PEM format. It can contain multiple certificates. If the linked OpenSSL is configured to load system wide certificates, they are loaded at startup regardless of this option. .UNINDENT .INDENT 0.0 .TP .B \-\-private\-key\-passwd\-file=<PATH> Path to file that contains password for the server\(aqs private key. If none is given and the private key is password protected it\(aqll be requested interactively. .UNINDENT .INDENT 0.0 .TP .B \-\-subcert=<KEYPATH>:<CERTPATH>[[;<PARAM>]...] Specify additional certificate and private key file. nghttpx will choose certificates based on the hostname indicated by client using TLS SNI extension. If nghttpx is built with OpenSSL >= 1.0.2, the signature algorithms (e.g., ECDSA+SHA256) presented by client are also taken into consideration. This allows nghttpx to send ML\-DSA or ECDSA certificate to modern clients, while sending RSA based certificate to older clients. This option can be used multiple times. .sp Additional parameter can be specified in <PARAM>. The available <PARAM> is \(dqsct\-dir=<DIR>\(dq. .sp \(dqsct\-dir=<DIR>\(dq specifies the path to directory which contains *.sct files for TLS signed_certificate_timestamp extension (RFC 6962). This feature requires OpenSSL >= 1.0.2. See also \fB\-\-tls\-sct\-dir\fP option. .UNINDENT .INDENT 0.0 .TP .B \-\-dh\-param\-file=<PATH> Path to file that contains DH parameters in PEM format. Without this option, DHE cipher suites are not available. .UNINDENT .INDENT 0.0 .TP .B \-\-alpn\-list=<LIST> Comma delimited list of ALPN protocol identifier sorted in the order of preference. That means most desirable protocol comes first. The parameter must be delimited by a single comma only and any white spaces are treated as a part of protocol string. .sp Default: \fBh2,http/1.1\fP .UNINDENT .INDENT 0.0 .TP .B \-\-verify\-client Require and verify client certificate. .UNINDENT .INDENT 0.0 .TP .B \-\-verify\-client\-cacert=<PATH> Path to file that contains CA certificates to verify client certificate. The file must be in PEM format. It can contain multiple certificates. .UNINDENT .INDENT 0.0 .TP .B \-\-verify\-client\-tolerate\-expired Accept expired client certificate. Operator should handle the expired client certificate by some means (e.g., mruby script). Otherwise, this option might cause a security risk. .UNINDENT .INDENT 0.0 .TP .B \-\-client\-private\-key\-file=<PATH> Path to file that contains client private key used in backend client authentication. .UNINDENT .INDENT 0.0 .TP .B \-\-client\-cert\-file=<PATH> Path to file that contains client certificate used in backend client authentication. .UNINDENT .INDENT 0.0 .TP .B \-\-tls\-min\-proto\-version=<VER> Specify minimum SSL/TLS protocol. The name matching is done in case\-insensitive manner. The versions between \fB\-\-tls\-min\-proto\-version\fP and \fB\-\-tls\-max\-proto\-version\fP are enabled. If the protocol list advertised by client does not overlap this range, you will receive the error message \(dqunknown protocol\(dq. The available versions are: TLSv1.3 and TLSv1.2 .sp Default: \fBTLSv1.2\fP .UNINDENT .INDENT 0.0 .TP .B \-\-tls\-max\-proto\-version=<VER> Specify maximum SSL/TLS protocol. The name matching is done in case\-insensitive manner. The versions between \fB\-\-tls\-min\-proto\-version\fP and \fB\-\-tls\-max\-proto\-version\fP are enabled. If the protocol list advertised by client does not overlap this range, you will receive the error message \(dqunknown protocol\(dq. The available versions are: TLSv1.3 and TLSv1.2 .sp Default: \fBTLSv1.3\fP .UNINDENT .INDENT 0.0 .TP .B \-\-tls\-ticket\-key\-file=<PATH> Path to file that contains random data to construct TLS session ticket parameters. If aes\-128\-cbc is given in \fB\-\-tls\-ticket\-key\-cipher\fP, the file must contain exactly 48 bytes. If aes\-256\-cbc is given in \fB\-\-tls\-ticket\-key\-cipher\fP, the file must contain exactly 80 bytes. This options can be used repeatedly to specify multiple ticket parameters. If several files are given, only the first key is used to encrypt TLS session tickets. Other keys are accepted but server will issue new session ticket with first key. This allows session key rotation. Please note that key rotation does not occur automatically. User should rearrange files or change options values and restart nghttpx gracefully. If opening or reading given file fails, all loaded keys are discarded and it is treated as if none of this option is given. If this option is not given or an error occurred while opening or reading a file, key is generated every 1 hour internally and they are valid for 12 hours. This is recommended if ticket key sharing between nghttpx instances is not required. .UNINDENT .INDENT 0.0 .TP .B \-\-tls\-ticket\-key\-memcached=<HOST>,<PORT>[;tls] Specify address of memcached server to get TLS ticket keys for session resumption. This enables shared TLS ticket key between multiple nghttpx instances. nghttpx does not set TLS ticket key to memcached. The external ticket key generator is required. nghttpx just gets TLS ticket keys from memcached, and use them, possibly replacing current set of keys. It is up to extern TLS ticket key generator to rotate keys frequently. See \(dqTLS SESSION TICKET RESUMPTION\(dq section in manual page to know the data format in memcached entry. Optionally, memcached connection can be encrypted with TLS by specifying \(dqtls\(dq parameter. .UNINDENT .INDENT 0.0 .TP .B \-\-tls\-ticket\-key\-memcached\-address\-family=(auto|IPv4|IPv6) Specify address family of memcached connections to get TLS ticket keys. If \(dqauto\(dq is given, both IPv4 and IPv6 are considered. If \(dqIPv4\(dq is given, only IPv4 address is considered. If \(dqIPv6\(dq is given, only IPv6 address is considered. .sp Default: \fBauto\fP .UNINDENT .INDENT 0.0 .TP .B \-\-tls\-ticket\-key\-memcached\-interval=<DURATION> Set interval to get TLS ticket keys from memcached. .sp Default: \fB10m\fP .UNINDENT .INDENT 0.0 .TP .B \-\-tls\-ticket\-key\-memcached\-max\-retry=<N> Set maximum number of consecutive retries before abandoning TLS ticket key retrieval. If this number is reached, the attempt is considered as failure, and \(dqfailure\(dq count is incremented by 1, which contributed to the value controlled \fB\-\-tls\-ticket\-key\-memcached\-max\-fail\fP option. .sp Default: \fB3\fP .UNINDENT .INDENT 0.0 .TP .B \-\-tls\-ticket\-key\-memcached\-max\-fail=<N> Set maximum number of consecutive failure before disabling TLS ticket until next scheduled key retrieval. .sp Default: \fB2\fP .UNINDENT .INDENT 0.0 .TP .B \-\-tls\-ticket\-key\-cipher=<CIPHER> Specify cipher to encrypt TLS session ticket. Specify either aes\-128\-cbc or aes\-256\-cbc. By default, aes\-128\-cbc is used. .UNINDENT .INDENT 0.0 .TP .B \-\-tls\-ticket\-key\-memcached\-cert\-file=<PATH> Path to client certificate for memcached connections to get TLS ticket keys. .UNINDENT .INDENT 0.0 .TP .B \-\-tls\-ticket\-key\-memcached\-private\-key\-file=<PATH> Path to client private key for memcached connections to get TLS ticket keys. .UNINDENT .INDENT 0.0 .TP .B \-\-tls\-dyn\-rec\-warmup\-threshold=<SIZE> Specify the threshold size for TLS dynamic record size behaviour. During a TLS session, after the threshold number of bytes have been written, the TLS record size will be increased to the maximum allowed (16K). The max record size will continue to be used on the active TLS session. After \fB\-\-tls\-dyn\-rec\-idle\-timeout\fP has elapsed, the record size is reduced to 1300 bytes. Specify 0 to always use the maximum record size, regardless of idle period. This behaviour applies to all TLS based frontends, and TLS HTTP/2 backends. .sp Default: \fB1M\fP .UNINDENT .INDENT 0.0 .TP .B \-\-tls\-dyn\-rec\-idle\-timeout=<DURATION> Specify TLS dynamic record size behaviour timeout. See \fB\-\-tls\-dyn\-rec\-warmup\-threshold\fP for more information. This behaviour applies to all TLS based frontends, and TLS HTTP/2 backends. .sp Default: \fB1s\fP .UNINDENT .INDENT 0.0 .TP .B \-\-no\-http2\-cipher\-block\-list Allow block listed cipher suite on frontend HTTP/2 connection. See \%<https://\:tools\:.ietf\:.org/\:html/\:rfc7540#\:appendix-A> for the complete HTTP/2 cipher suites block list. .UNINDENT .INDENT 0.0 .TP .B \-\-client\-no\-http2\-cipher\-block\-list Allow block listed cipher suite on backend HTTP/2 connection. See \%<https://\:tools\:.ietf\:.org/\:html/\:rfc7540#\:appendix-A> for the complete HTTP/2 cipher suites block list. .UNINDENT .INDENT 0.0 .TP .B \-\-tls\-sct\-dir=<DIR> Specifies the directory where *.sct files exist. All *.sct files in <DIR> are read, and sent as extension_data of TLS signed_certificate_timestamp (RFC 6962) to client. These *.sct files are for the certificate specified in positional command\-line argument <CERT>, or certificate option in configuration file. For additional certificates, use \fB\-\-subcert\fP option. This option requires OpenSSL >= 1.0.2. .UNINDENT .INDENT 0.0 .TP .B \-\-psk\-secrets=<PATH> Read list of PSK identity and secrets from <PATH>. This is used for frontend connection. The each line of input file is formatted as <identity>:<hex\-secret>, where <identity> is PSK identity, and <hex\-secret> is secret in hex. An empty line, and line which starts with \(aq#\(aq are skipped. The default enabled cipher list might not contain any PSK cipher suite. In that case, desired PSK cipher suites must be enabled using \fB\-\-ciphers\fP option. The desired PSK cipher suite may be block listed by HTTP/2. To use those cipher suites with HTTP/2, consider to use \fB\-\-no\-http2\-cipher\-block\-list\fP option. But be aware its implications. .UNINDENT .INDENT 0.0 .TP .B \-\-client\-psk\-secrets=<PATH> Read PSK identity and secrets from <PATH>. This is used for backend connection. The each line of input file is formatted as <identity>:<hex\-secret>, where <identity> is PSK identity, and <hex\-secret> is secret in hex. An empty line, and line which starts with \(aq#\(aq are skipped. The first identity and secret pair encountered is used. The default enabled cipher list might not contain any PSK cipher suite. In that case, desired PSK cipher suites must be enabled using \fB\-\-client\-ciphers\fP option. The desired PSK cipher suite may be block listed by HTTP/2. To use those cipher suites with HTTP/2, consider to use \fB\-\-client\-no\-http2\-cipher\-block\-list\fP option. But be aware its implications. .UNINDENT .INDENT 0.0 .TP .B \-\-tls\-no\-postpone\-early\-data By default, except for QUIC connections, nghttpx postpones forwarding HTTP requests sent in early data, including those sent in partially in it, until TLS handshake finishes. If all backend server recognizes \(dqEarly\-Data\(dq header field, using this option makes nghttpx not postpone forwarding request and get full potential of 0\-RTT data. .UNINDENT .INDENT 0.0 .TP .B \-\-tls\-max\-early\-data=<SIZE> Sets the maximum amount of 0\-RTT data that server accepts. .sp Default: \fB16K\fP .UNINDENT .INDENT 0.0 .TP .B \-\-tls\-ktls Enable ktls. .UNINDENT .INDENT 0.0 .TP .B \-\-ech\-config\-file=<PATH> Read Encrypted Client Hello (ECH) server configuration from <PATH>. See \fB\-\-ech\-retry\-config\-file\fP for details. .UNINDENT .INDENT 0.0 .TP .B \-\-ech\-retry\-config\-file=<PATH> This option and \fB\-\-ech\-config\-file\fP option read Encrypted Client Hello (ECH) server configuration from <PATH>. If \fB\-\-ech\-retry\-config\-file\fP is used, the configurations are included in the retry configurations. The file format must be PEM ECH file described in RFC 9934. These options can be used repeatedly to read multiple files. \fB\-\-ech\-retry\-config\-file\fP must be used at least once when enabling ECH. .UNINDENT .SS HTTP/2 .INDENT 0.0 .TP .B \-c, \-\-frontend\-http2\-max\-concurrent\-streams=<N> Set the maximum number of the concurrent streams in one frontend HTTP/2 session. .sp Default: \fB100\fP .UNINDENT .INDENT 0.0 .TP .B \-\-backend\-http2\-max\-concurrent\-streams=<N> Set the maximum number of the concurrent streams in one backend HTTP/2 session. This sets maximum number of concurrent opened pushed streams. The maximum number of concurrent requests are set by a remote server. .sp Default: \fB100\fP .UNINDENT .INDENT 0.0 .TP .B \-\-frontend\-http2\-window\-size=<SIZE> Sets the per\-stream initial window size of HTTP/2 frontend connection. .sp Default: \fB65535\fP .UNINDENT .INDENT 0.0 .TP .B \-\-frontend\-http2\-connection\-window\-size=<SIZE> Sets the per\-connection window size of HTTP/2 frontend connection. .sp Default: \fB65535\fP .UNINDENT .INDENT 0.0 .TP .B \-\-backend\-http2\-window\-size=<SIZE> Sets the initial window size of HTTP/2 backend connection. .sp Default: \fB65535\fP .UNINDENT .INDENT 0.0 .TP .B \-\-backend\-http2\-connection\-window\-size=<SIZE> Sets the per\-connection window size of HTTP/2 backend connection. .sp Default: \fB2147483647\fP .UNINDENT .INDENT 0.0 .TP .B \-\-http2\-no\-cookie\-crumbling Don\(aqt crumble cookie header field. .UNINDENT .INDENT 0.0 .TP .B \-\-padding=<N> Add at most <N> bytes to a HTTP/2 frame payload as padding. Specify 0 to disable padding. This option is meant for debugging purpose and not intended to enhance protocol security. .UNINDENT .INDENT 0.0 .TP .B \-\-no\-server\-push Disable HTTP/2 server push. Server push is supported by default mode and HTTP/2 frontend via Link header field. It is also supported if both frontend and backend are HTTP/2 in default mode. In this case, server push from backend session is relayed to frontend, and server push via Link header field is also supported. .UNINDENT .INDENT 0.0 .TP .B \-\-frontend\-http2\-optimize\-write\-buffer\-size (Experimental) Enable write buffer size optimization in frontend HTTP/2 TLS connection. This optimization aims to reduce write buffer size so that it only contains bytes which can send immediately. This makes server more responsive to prioritized HTTP/2 stream because the buffering of lower priority stream is reduced. This option is only effective on recent Linux platform. .UNINDENT .INDENT 0.0 .TP .B \-\-frontend\-http2\-optimize\-window\-size (Experimental) Automatically tune connection level window size of frontend HTTP/2 TLS connection. If this feature is enabled, connection window size starts with the default window size, 65535 bytes. nghttpx automatically adjusts connection window size based on TCP receiving window size. The maximum window size is capped by the value specified by \fB\-\-frontend\-http2\-connection\-window\-size\fP\&. Since the stream is subject to stream level window size, it should be adjusted using \fB\-\-frontend\-http2\-window\-size\fP option as well. This option is only effective on recent Linux platform. .UNINDENT .INDENT 0.0 .TP .B \-\-frontend\-http2\-encoder\-dynamic\-table\-size=<SIZE> Specify the maximum dynamic table size of HPACK encoder in the frontend HTTP/2 connection. The decoder (client) specifies the maximum dynamic table size it accepts. Then the negotiated dynamic table size is the minimum of this option value and the value which client specified. .sp Default: \fB4K\fP .UNINDENT .INDENT 0.0 .TP .B \-\-frontend\-http2\-decoder\-dynamic\-table\-size=<SIZE> Specify the maximum dynamic table size of HPACK decoder in the frontend HTTP/2 connection. .sp Default: \fB4K\fP .UNINDENT .INDENT 0.0 .TP .B \-\-backend\-http2\-encoder\-dynamic\-table\-size=<SIZE> Specify the maximum dynamic table size of HPACK encoder in the backend HTTP/2 connection. The decoder (backend) specifies the maximum dynamic table size it accepts. Then the negotiated dynamic table size is the minimum of this option value and the value which backend specified. .sp Default: \fB4K\fP .UNINDENT .INDENT 0.0 .TP .B \-\-backend\-http2\-decoder\-dynamic\-table\-size=<SIZE> Specify the maximum dynamic table size of HPACK decoder in the backend HTTP/2 connection. .sp Default: \fB4K\fP .UNINDENT .SS Mode .INDENT 0.0 .TP .B (default mode) Accept HTTP/2, and HTTP/1.1 over SSL/TLS. \(dqno\-tls\(dq parameter is used in \fB\-\-frontend\fP option, accept HTTP/2 and HTTP/1.1 over cleartext TCP. The incoming HTTP/1.1 connection can be upgraded to HTTP/2 through HTTP Upgrade. .UNINDENT .INDENT 0.0 .TP .B \-s, \-\-http2\-proxy Like default mode, but enable forward proxy. This is so called HTTP/2 proxy mode. .UNINDENT .SS Logging .INDENT 0.0 .TP .B \-L, \-\-log\-level=<LEVEL> Set the severity level of log output. <LEVEL> must be one of INFO, NOTICE, WARN, ERROR and FATAL. .sp Default: \fBNOTICE\fP .UNINDENT .INDENT 0.0 .TP .B \-\-accesslog\-file=<PATH> Set path to write access log. To reopen file, send USR1 signal to nghttpx. .UNINDENT .INDENT 0.0 .TP .B \-\-accesslog\-syslog Send access log to syslog. If this option is used, \fB\-\-accesslog\-file\fP option is ignored. .UNINDENT .INDENT 0.0 .TP .B \-\-accesslog\-format=<FORMAT> Specify format string for access log. The default format is combined format. The following variables are available: .INDENT 7.0 .IP \(bu 2 $remote_addr: client IP address. .IP \(bu 2 $time_local: local time in Common Log format. .IP \(bu 2 $time_iso8601: local time in ISO 8601 format. .IP \(bu 2 $request: HTTP request line. .IP \(bu 2 $status: HTTP response status code. .IP \(bu 2 $body_bytes_sent: the number of bytes sent to client as response body. .IP \(bu 2 $http_<VAR>: value of HTTP request header <VAR> where \(aq_\(aq in <VAR> is replaced with \(aq\-\(aq. .IP \(bu 2 $remote_port: client port. .IP \(bu 2 $server_port: server port. .IP \(bu 2 $request_time: request processing time in seconds with milliseconds resolution. .IP \(bu 2 $pid: PID of the running process. .IP \(bu 2 $alpn: ALPN identifier of the protocol which generates the response. For HTTP/1, ALPN is always http/1.1, regardless of minor version. .IP \(bu 2 $tls_cipher: cipher used for SSL/TLS connection. .IP \(bu 2 $tls_client_fingerprint_sha256: SHA\-256 fingerprint of client certificate. .IP \(bu 2 $tls_client_fingerprint_sha1: SHA\-1 fingerprint of client certificate. .IP \(bu 2 $tls_client_subject_name: subject name in client certificate. .IP \(bu 2 $tls_client_issuer_name: issuer name in client certificate. .IP \(bu 2 $tls_client_serial: serial number in client certificate. .IP \(bu 2 $tls_protocol: protocol for SSL/TLS connection. .IP \(bu 2 $tls_session_id: session ID for SSL/TLS connection. .IP \(bu 2 $tls_session_reused: \(dqr\(dq if SSL/TLS session was reused. Otherwise, \(dq.\(dq .IP \(bu 2 $tls_sni: SNI server name for SSL/TLS connection. .IP \(bu 2 $tls_ech_accepted: \(dqe\(dq if ECH was accepted in SSL/TLS session. Otherwise, \(dq.\(dq .IP \(bu 2 $backend_host: backend host used to fulfill the request. \(dq\-\(dq if backend host is not available. .IP \(bu 2 $backend_port: backend port used to fulfill the request. \(dq\-\(dq if backend host is not available. .IP \(bu 2 $method: HTTP method .IP \(bu 2 $path: Request path including query. For CONNECT request, authority is recorded. .IP \(bu 2 $path_without_query: $path up to the first \(aq?\(aq character. For CONNECT request, authority is recorded. .IP \(bu 2 $protocol_version: HTTP version (e.g., HTTP/1.1, HTTP/2) .UNINDENT .sp The variable can be enclosed by \(dq{\(dq and \(dq}\(dq for disambiguation (e.g., ${remote_addr}). .sp Default: \fB$remote_addr \- \- [$time_local] \(dq$request\(dq $status $body_bytes_sent \(dq$http_referer\(dq \(dq$http_user_agent\(dq\fP .UNINDENT .INDENT 0.0 .TP .B \-\-accesslog\-write\-early Write access log when response header fields are received from backend rather than when request transaction finishes. .UNINDENT .INDENT 0.0 .TP .B \-\-errorlog\-file=<PATH> Set path to write error log. To reopen file, send USR1 signal to nghttpx. stderr will be redirected to the error log file unless \fB\-\-errorlog\-syslog\fP is used. .sp Default: \fB/dev/stderr\fP .UNINDENT .INDENT 0.0 .TP .B \-\-errorlog\-syslog Send error log to syslog. If this option is used, \fB\-\-errorlog\-file\fP option is ignored. .UNINDENT .INDENT 0.0 .TP .B \-\-syslog\-facility=<FACILITY> Set syslog facility to <FACILITY>. .sp Default: \fBdaemon\fP .UNINDENT .SS HTTP .INDENT 0.0 .TP .B \-\-add\-x\-forwarded\-for Append X\-Forwarded\-For header field to the downstream request. .UNINDENT .INDENT 0.0 .TP .B \-\-strip\-incoming\-x\-forwarded\-for Strip X\-Forwarded\-For header field from inbound client requests. .UNINDENT .INDENT 0.0 .TP .B \-\-no\-add\-x\-forwarded\-proto Don\(aqt append additional X\-Forwarded\-Proto header field to the backend request. If inbound client sets X\-Forwarded\-Proto, and \fB\-\-no\-strip\-incoming\-x\-forwarded\-proto\fP option is used, they are passed to the backend. .UNINDENT .INDENT 0.0 .TP .B \-\-no\-strip\-incoming\-x\-forwarded\-proto Don\(aqt strip X\-Forwarded\-Proto header field from inbound client requests. .UNINDENT .INDENT 0.0 .TP .B \-\-add\-forwarded=<LIST> Append RFC 7239 Forwarded header field with parameters specified in comma delimited list <LIST>. The supported parameters are \(dqby\(dq, \(dqfor\(dq, \(dqhost\(dq, and \(dqproto\(dq. By default, the value of \(dqby\(dq and \(dqfor\(dq parameters are obfuscated string. See \fB\-\-forwarded\-by\fP and \fB\-\-forwarded\-for\fP options respectively. Note that nghttpx does not translate non\-standard X\-Forwarded\-* header fields into Forwarded header field, and vice versa. .UNINDENT .INDENT 0.0 .TP .B \-\-strip\-incoming\-forwarded Strip Forwarded header field from inbound client requests. .UNINDENT .INDENT 0.0 .TP .B \-\-forwarded\-by=(obfuscated|ip|<VALUE>) Specify the parameter value sent out with \(dqby\(dq parameter of Forwarded header field. If \(dqobfuscated\(dq is given, the string is randomly generated at startup. If \(dqip\(dq is given, the interface address of the connection, including port number, is sent with \(dqby\(dq parameter. In case of UNIX domain socket, \(dqlocalhost\(dq is used instead of address and port. User can also specify the static obfuscated string. The limitation is that it must start with \(dq_\(dq, and only consists of character set [A\-Za\-z0\-9._\-], as described in RFC 7239. .sp Default: \fBobfuscated\fP .UNINDENT .INDENT 0.0 .TP .B \-\-forwarded\-for=(obfuscated|ip) Specify the parameter value sent out with \(dqfor\(dq parameter of Forwarded header field. If \(dqobfuscated\(dq is given, the string is randomly generated for each client connection. If \(dqip\(dq is given, the remote client address of the connection, without port number, is sent with \(dqfor\(dq parameter. In case of UNIX domain socket, \(dqlocalhost\(dq is used instead of address. .sp Default: \fBobfuscated\fP .UNINDENT .INDENT 0.0 .TP .B \-\-no\-via Don\(aqt append to Via header field. If Via header field is received, it is left unaltered. .UNINDENT .INDENT 0.0 .TP .B \-\-no\-strip\-incoming\-early\-data Don\(aqt strip Early\-Data header field from inbound client requests. .UNINDENT .INDENT 0.0 .TP .B \-\-no\-location\-rewrite Don\(aqt rewrite location header field in default mode. When \fB\-\-http2\-proxy\fP is used, location header field will not be altered regardless of this option. .UNINDENT .INDENT 0.0 .TP .B \-\-host\-rewrite Rewrite host and :authority header fields in default mode. When \fB\-\-http2\-proxy\fP is used, these headers will not be altered regardless of this option. .UNINDENT .INDENT 0.0 .TP .B \-\-altsvc=<PROTOID,PORT[,HOST,[ORIGIN[,PARAMS]]]> Specify protocol ID, port, host and origin of alternative service. <HOST>, <ORIGIN> and <PARAMS> are optional. Empty <HOST> and <ORIGIN> are allowed and they are treated as nothing is specified. They are advertised in alt\-svc header field only in HTTP/1.1 frontend. This option can be used multiple times to specify multiple alternative services. Example: \fB\-\-altsvc\fP=\(dqh2,443,,,ma=3600; persist=1\(dq .UNINDENT .INDENT 0.0 .TP .B \-\-http2\-altsvc=<PROTOID,PORT[,HOST,[ORIGIN[,PARAMS]]]> Just like \fB\-\-altsvc\fP option, but this altsvc is only sent in HTTP/2 frontend. .UNINDENT .INDENT 0.0 .TP .B \-\-add\-request\-header=<HEADER> Specify additional header field to add to request header set. The field name must be lowercase. This option just appends header field and won\(aqt replace anything already set. This option can be used several times to specify multiple header fields. Example: \fB\-\-add\-request\-header\fP=\(dqfoo: bar\(dq .UNINDENT .INDENT 0.0 .TP .B \-\-add\-response\-header=<HEADER> Specify additional header field to add to response header set. The field name must be lowercase. This option just appends header field and won\(aqt replace anything already set. This option can be used several times to specify multiple header fields. Example: \fB\-\-add\-response\-header\fP=\(dqfoo: bar\(dq .UNINDENT .INDENT 0.0 .TP .B \-\-request\-header\-field\-buffer=<SIZE> Set maximum buffer size for incoming HTTP request header field list. This is the sum of header name and value in bytes. If trailer fields exist, they are counted towards this number. .sp Default: \fB64K\fP .UNINDENT .INDENT 0.0 .TP .B \-\-max\-request\-header\-fields=<N> Set maximum number of incoming HTTP request header fields. If trailer fields exist, they are counted towards this number. .sp Default: \fB100\fP .UNINDENT .INDENT 0.0 .TP .B \-\-response\-header\-field\-buffer=<SIZE> Set maximum buffer size for incoming HTTP response header field list. This is the sum of header name and value in bytes. If trailer fields exist, they are counted towards this number. .sp Default: \fB64K\fP .UNINDENT .INDENT 0.0 .TP .B \-\-max\-response\-header\-fields=<N> Set maximum number of incoming HTTP response header fields. If trailer fields exist, they are counted towards this number. .sp Default: \fB500\fP .UNINDENT .INDENT 0.0 .TP .B \-\-error\-page=(<CODE>|*)=<PATH> Set file path to custom error page served when nghttpx originally generates HTTP error status code <CODE>. <CODE> must be greater than or equal to 400, and at most 599. If \(dq*\(dq is used instead of <CODE>, it matches all HTTP status code. If error status code comes from backend server, the custom error pages are not used. .UNINDENT .INDENT 0.0 .TP .B \-\-server\-name=<NAME> Change server response header field value to <NAME>. .sp Default: \fBnghttpx\fP .UNINDENT .INDENT 0.0 .TP .B \-\-no\-server\-rewrite Don\(aqt rewrite server header field in default mode. When \fB\-\-http2\-proxy\fP is used, these headers will not be altered regardless of this option. .UNINDENT .INDENT 0.0 .TP .B \-\-redirect\-https\-port=<PORT> Specify the port number which appears in Location header field when redirect to HTTPS URI is made due to \(dqredirect\-if\-not\-tls\(dq parameter in \fB\-\-backend\fP option. .sp Default: \fB443\fP .UNINDENT .INDENT 0.0 .TP .B \-\-require\-http\-scheme Always require http or https scheme in HTTP request. It also requires that https scheme must be used for an encrypted connection. Otherwise, http scheme must be used. This option is recommended for a server deployment which directly faces clients and the services it provides only require http or https scheme. .UNINDENT .SS API .INDENT 0.0 .TP .B \-\-api\-max\-request\-body=<SIZE> Set the maximum size of request body for API request. .sp Default: \fB32M\fP .UNINDENT .SS DNS .INDENT 0.0 .TP .B \-\-dns\-cache\-timeout=<DURATION> Set duration that cached DNS results remain valid. Note that nghttpx caches the unsuccessful results as well. .sp Default: \fB10s\fP .UNINDENT .INDENT 0.0 .TP .B \-\-dns\-lookup\-timeout=<DURATION> Set timeout that DNS server is given to respond to the initial DNS query. For the 2nd and later queries, server is given time based on this timeout, and it is scaled linearly. .sp Default: \fB250ms\fP .UNINDENT .INDENT 0.0 .TP .B \-\-dns\-max\-try=<N> Set the number of DNS query before nghttpx gives up name lookup. .sp Default: \fB3\fP .UNINDENT .INDENT 0.0 .TP .B \-\-frontend\-max\-requests=<N> The number of requests that single frontend connection can process. For HTTP/2, this is the number of streams in one HTTP/2 connection. For HTTP/1, this is the number of keep alive requests. This is hint to nghttpx, and it may allow additional few requests. The default value is unlimited. .UNINDENT .SS Debug .INDENT 0.0 .TP .B \-\-frontend\-http2\-dump\-request\-header=<PATH> Dumps request headers received by HTTP/2 frontend to the file denoted in <PATH>. The output is done in HTTP/1 header field format and each header block is followed by an empty line. This option is not thread safe and MUST NOT be used with option \fB\-n\fP<N>, where <N> >= 2. .UNINDENT .INDENT 0.0 .TP .B \-\-frontend\-http2\-dump\-response\-header=<PATH> Dumps response headers sent from HTTP/2 frontend to the file denoted in <PATH>. The output is done in HTTP/1 header field format and each header block is followed by an empty line. This option is not thread safe and MUST NOT be used with option \fB\-n\fP<N>, where <N> >= 2. .UNINDENT .INDENT 0.0 .TP .B \-o, \-\-frontend\-frame\-debug Print HTTP/2 frames in frontend to stderr. This option is not thread safe and MUST NOT be used with option \fB\-n\fP=N, where N >= 2. .UNINDENT .SS Process .INDENT 0.0 .TP .B \-D, \-\-daemon Run in a background. If \fB\-D\fP is used, the current working directory is changed to \(aq\fI/\fP\(aq. .UNINDENT .INDENT 0.0 .TP .B \-\-pid\-file=<PATH> Set path to save PID of this program. .UNINDENT .INDENT 0.0 .TP .B \-\-user=<USER> Run this program as <USER>. This option is intended to be used to drop root privileges. .UNINDENT .INDENT 0.0 .TP .B \-\-single\-process Run this program in a single process mode for debugging purpose. Without this option, nghttpx creates at least 2 processes: main and worker processes. If this option is used, main and worker are unified into a single process. nghttpx still spawns additional process if neverbleed is used. In the single process mode, the signal handling feature is disabled. .UNINDENT .INDENT 0.0 .TP .B \-\-max\-worker\-processes=<N> The maximum number of worker processes. nghttpx spawns new worker process when it reloads its configuration. The previous worker process enters graceful termination period and will terminate when it finishes handling the existing connections. However, if reloading configurations happen very frequently, the worker processes might be piled up if they take a bit long time to finish the existing connections. With this option, if the number of worker processes exceeds the given value, the oldest worker process is terminated immediately. Specifying 0 means no limit and it is the default behaviour. .UNINDENT .INDENT 0.0 .TP .B \-\-worker\-process\-grace\-shutdown\-period=<DURATION> Maximum period for a worker process to terminate gracefully. When a worker process enters in graceful shutdown period (e.g., when nghttpx reloads its configuration) and it does not finish handling the existing connections in the given period of time, it is immediately terminated. Specifying 0 means no limit and it is the default behaviour. .UNINDENT .SS Scripting .INDENT 0.0 .TP .B \-\-mruby\-file=<PATH> Set mruby script file .UNINDENT .INDENT 0.0 .TP .B \-\-ignore\-per\-pattern\-mruby\-error Ignore mruby compile error for per\-pattern mruby script file. If error occurred, it is treated as if no mruby file were specified for the pattern. .UNINDENT .SS HTTP/3 and QUIC .INDENT 0.0 .TP .B \-\-frontend\-quic\-idle\-timeout=<DURATION> Specify an idle timeout for QUIC connection. .sp Default: \fB30s\fP .UNINDENT .INDENT 0.0 .TP .B \-\-frontend\-quic\-debug\-log Output QUIC debug log to \fI/dev/stderr.\fP .UNINDENT .INDENT 0.0 .TP .B \-\-quic\-bpf\-program\-file=<PATH> Specify a path to eBPF program file reuseport_kern.o to direct an incoming QUIC UDP datagram to a correct socket. .sp Default: \fB/usr/local/lib/nghttp2/reuseport_kern.o\fP .UNINDENT .INDENT 0.0 .TP .B \-\-frontend\-quic\-early\-data Enable early data on frontend QUIC connections. nghttpx sends \(dqEarly\-Data\(dq header field to a backend server if a request is received in early data and handshake has not finished. All backend servers should deal with possibly replayed requests. .UNINDENT .INDENT 0.0 .TP .B \-\-frontend\-quic\-qlog\-dir=<DIR> Specify a directory where a qlog file is written for frontend QUIC connections. A qlog file is created per each QUIC connection. The file name is ISO8601 basic format, followed by \(dq\-\(dq, server Source Connection ID and \(dq.sqlog\(dq. .UNINDENT .INDENT 0.0 .TP .B \-\-frontend\-quic\-require\-token Require an address validation token for a frontend QUIC connection. Server sends a token in Retry packet or NEW_TOKEN frame in the previous connection. .UNINDENT .INDENT 0.0 .TP .B \-\-frontend\-quic\-congestion\-controller=<CC> Specify a congestion controller algorithm for a frontend QUIC connection. <CC> should be either \(dqcubic\(dq or \(dqbbr\(dq. .sp Default: \fBcubic\fP .UNINDENT .INDENT 0.0 .TP .B \-\-frontend\-quic\-secret\-file=<PATH> Path to file that contains secure random data to be used as QUIC keying materials. It is used to derive keys for encrypting tokens and Connection IDs. It is not used to encrypt QUIC packets. Each line of this file must contain exactly 136 bytes hex\-encoded string (when decoded the byte string is 68 bytes long). The first 3 bits of decoded byte string are used to identify the keying material. An empty line or a line which starts \(aq#\(aq is ignored. The file can contain more than one keying materials. Because the identifier is 3 bits, at most 8 keying materials are read and the remaining data is discarded. The first keying material in the file is primarily used for encryption and decryption for new connection. The other ones are used to decrypt data for the existing connections. Specifying multiple keying materials enables key rotation. Please note that key rotation does not occur automatically. User should update files or change options values and restart nghttpx gracefully. If opening or reading given file fails, all loaded keying materials are discarded and it is treated as if none of this option is given. If this option is not given or an error occurred while opening or reading a file, a keying material is generated internally on startup and reload. .UNINDENT .INDENT 0.0 .TP .B \-\-quic\-server\-id=<HEXSTRING> Specify server ID encoded in Connection ID to identify this particular server instance. Connection ID is encrypted and this part is not visible in public. It must be 4 bytes long and must be encoded in hex string (which is 8 bytes long). If this option is omitted, a random server ID is generated on startup and configuration reload. .UNINDENT .INDENT 0.0 .TP .B \-\-frontend\-quic\-initial\-rtt=<DURATION> Specify the initial RTT of the frontend QUIC connection. .sp Default: \fB333ms\fP .UNINDENT .INDENT 0.0 .TP .B \-\-no\-quic\-bpf Disable eBPF. .UNINDENT .INDENT 0.0 .TP .B \-\-frontend\-http3\-window\-size=<SIZE> Sets the per\-stream initial window size of HTTP/3 frontend connection. .sp Default: \fB256K\fP .UNINDENT .INDENT 0.0 .TP .B \-\-frontend\-http3\-connection\-window\-size=<SIZE> Sets the per\-connection window size of HTTP/3 frontend connection. .sp Default: \fB1M\fP .UNINDENT .INDENT 0.0 .TP .B \-\-frontend\-http3\-max\-window\-size=<SIZE> Sets the maximum per\-stream window size of HTTP/3 frontend connection. The window size is adjusted based on the receiving rate of stream data. The initial value is the value specified by \fB\-\-frontend\-http3\-window\-size\fP and the window size grows up to <SIZE> bytes. .sp Default: \fB6M\fP .UNINDENT .INDENT 0.0 .TP .B \-\-frontend\-http3\-max\-connection\-window\-size=<SIZE> Sets the maximum per\-connection window size of HTTP/3 frontend connection. The window size is adjusted based on the receiving rate of stream data. The initial value is the value specified by \fB\-\-frontend\-http3\-connection\-window\-size\fP and the window size grows up to <SIZE> bytes. .sp Default: \fB8M\fP .UNINDENT .INDENT 0.0 .TP .B \-\-frontend\-http3\-max\-concurrent\-streams=<N> Set the maximum number of the concurrent streams in one frontend HTTP/3 connection. .sp Default: \fB100\fP .UNINDENT .SS Misc .INDENT 0.0 .TP .B \-\-conf=<PATH> Load configuration from <PATH>. Please note that nghttpx always tries to read the default configuration file if \fB\-\-conf\fP is not given. .sp Default: \fB/etc/nghttpx/nghttpx.conf\fP .UNINDENT .INDENT 0.0 .TP .B \-\-include=<PATH> Load additional configurations from <PATH>. File <PATH> is read when configuration parser encountered this option. This option can be used multiple times, or even recursively. .UNINDENT .INDENT 0.0 .TP .B \-v, \-\-version Print version and exit. .UNINDENT .INDENT 0.0 .TP .B \-h, \-\-help Print this help and exit. .UNINDENT .sp The <SIZE> argument is an integer and an optional unit (e.g., 10K is 10 * 1024). Units are K, M and G (powers of 1024). .sp The <DURATION> argument is an integer and an optional unit (e.g., 1s is 1 second and 500ms is 500 milliseconds). Units are h, m, s or ms (hours, minutes, seconds and milliseconds, respectively). If a unit is omitted, a second is used as unit. .SH FILES .INDENT 0.0 .TP .B \fI/etc/nghttpx/nghttpx.conf\fP The default configuration file path nghttpx searches at startup. The configuration file path can be changed using \fB\-\-conf\fP option. .sp Those lines which are staring \fB#\fP are treated as comment. .sp The option name in the configuration file is the long command\-line option name with leading \fB\-\-\fP stripped (e.g., \fBfrontend\fP). Put \fB=\fP between option name and value. Don\(aqt put extra leading or trailing spaces. .sp When specifying arguments including characters which have special meaning to a shell, we usually use quotes so that shell does not interpret them. When writing this configuration file, quotes for this purpose must not be used. For example, specify additional request header field, do this: .INDENT 7.0 .INDENT 3.5 .sp .EX add\-request\-header=foo: bar .EE .UNINDENT .UNINDENT .sp instead of: .INDENT 7.0 .INDENT 3.5 .sp .EX add\-request\-header=\(dqfoo: bar\(dq .EE .UNINDENT .UNINDENT .sp The options which do not take argument in the command\-line \fItake\fP argument in the configuration file. Specify \fByes\fP as an argument (e.g., \fBhttp2\-proxy=yes\fP). If other string is given, it is ignored. .sp To specify private key and certificate file which are given as positional arguments in command\-line, use \fBprivate\-key\-file\fP and \fBcertificate\-file\fP\&. .sp \fB\-\-conf\fP option cannot be used in the configuration file and will be ignored if specified. .TP .B Error log Error log is written to stderr by default. It can be configured using \fB\-\-errorlog\-file\fP\&. The format of log message is as follows: .sp <datetime> <main\-pid> <current\-pid> <thread\-id> <level> (<filename>:<line>) <msg> .INDENT 7.0 .TP .B <datetime> It is a combination of date and time when the log is written. It is in ISO 8601 format. .TP .B <main\-pid> It is a main process ID. .TP .B <current\-pid> It is a process ID which writes this log. .TP .B <thread\-id> It is a thread ID which writes this log. It would be unique within <current\-pid>. .TP .B <filename> and <line> They are source file name, and line number which produce this log. .TP .B <msg> It is a log message body. .UNINDENT .UNINDENT .SH SIGNALS .INDENT 0.0 .TP .B SIGQUIT Shutdown gracefully. First accept pending connections and stop accepting connection. After all connections are handled, nghttpx exits. .TP .B SIGHUP Reload configuration file given in \fB\-\-conf\fP\&. .TP .B SIGUSR1 Reopen log files. .UNINDENT .sp SIGUSR2 .INDENT 0.0 .INDENT 3.5 Fork and execute nghttpx. It will execute the binary in the same path with same command\-line arguments and environment variables. As of nghttpx version 1.20.0, the new main process sends SIGQUIT to the original main process when it is ready to serve requests. For the earlier versions of nghttpx, user has to send SIGQUIT to the original main process. .sp The difference between SIGUSR2 (+ SIGQUIT) and SIGHUP is that former is usually used to execute new binary, and the main process is newly spawned. On the other hand, the latter just reloads configuration file, and the same main process continues to exist. .UNINDENT .UNINDENT .sp \fBNote:\fP .INDENT 0.0 .INDENT 3.5 nghttpx consists of multiple processes: one process for processing these signals, and another one for processing requests. The former spawns the latter. The former is called main process, and the latter is called worker process. If neverbleed is enabled, the worker process spawns neverbleed daemon process which does RSA key processing. The above signal must be sent to the main process. If the other processes received one of them, it is ignored. This behaviour of these processes may change in the future release. In other words, in the future release, the processes other than main process may terminate upon the reception of these signals. Therefore these signals should not be sent to the processes other than main process. .UNINDENT .UNINDENT .SH SERVER PUSH .sp nghttpx supports HTTP/2 server push in default mode with Link header field. nghttpx looks for Link header field (RFC 5988 \%<http://\:tools\:.ietf\:.org/\:html/\:rfc5988>) in response headers from backend server and extracts URI\-reference with parameter \fBrel=preload\fP (see preload \%<http://\:w3c\:.github\:.io/\:preload/#\:interoperability-with-http-link-header>) and pushes those URIs to the frontend client. Here is a sample Link header field to initiate server push: .INDENT 0.0 .INDENT 3.5 .sp .EX Link: </fonts/font.woff>; rel=preload Link: </css/theme.css>; rel=preload .EE .UNINDENT .UNINDENT .sp Currently, the following restriction is applied for server push: .INDENT 0.0 .IP 1. 3 The associated stream must have method \(dqGET\(dq or \(dqPOST\(dq. The associated stream\(aqs status code must be 200. .UNINDENT .sp This limitation may be loosened in the future release. .sp nghttpx also supports server push if both frontend and backend are HTTP/2 in default mode. In this case, in addition to server push via Link header field, server push from backend is forwarded to frontend HTTP/2 session. .sp HTTP/2 server push will be disabled if \fB\-\-http2\-proxy\fP is used. .SH UNIX DOMAIN SOCKET .sp nghttpx supports UNIX domain socket with a filename for both frontend and backend connections. .sp Please note that current nghttpx implementation does not delete a socket with a filename. And on start up, if nghttpx detects that the specified socket already exists in the file system, nghttpx first deletes it. However, if SIGUSR2 is used to execute new binary and both old and new configurations use same filename, new binary does not delete the socket and continues to use it. .SH TLS SESSION RESUMPTION .sp nghttpx supports TLS session resumption through both session ID and session ticket. .SS SESSION ID RESUMPTION .sp By default, session ID is shared by all worker threads. .SS TLS SESSION TICKET RESUMPTION .sp By default, session ticket is shared by all worker threads. The automatic key rotation is also enabled by default. Every an hour, new encryption key is generated, and previous encryption key becomes decryption only key. We set session timeout to 12 hours, and thus we keep at most 12 keys. .sp If \fB\-\-tls\-ticket\-key\-memcached\fP is given, encryption keys are retrieved from memcached. nghttpx just reads keys from memcached; one has to deploy key generator program to update keys frequently (e.g., every 1 hour). The example key generator tlsticketupdate.go is available under contrib directory in nghttp2 archive. The memcached entry key is \fBnghttpx:tls\-ticket\-key\fP\&. The data format stored in memcached is the binary format described below: .INDENT 0.0 .INDENT 3.5 .sp .EX +\-\-\-\-\-\-\-\-\-\-\-\-\-\-+\-\-\-\-\-\-\-+\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-+ | VERSION (4) |LEN (2)|KEY(48 or 80) ... +\-\-\-\-\-\-\-\-\-\-\-\-\-\-+\-\-\-\-\-\-\-+\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-+ ^ | | | +\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-+ (LEN, KEY) pair can be repeated .EE .UNINDENT .UNINDENT .sp All numbers in the above figure is bytes. All integer fields are network byte order. .sp First 4 bytes integer VERSION field, which must be 1. The 2 bytes integer LEN field gives the length of following KEY field, which contains key. If \fB\-\-tls\-ticket\-key\-cipher\fP=aes\-128\-cbc is used, LEN must be 48. If \fB\-\-tls\-ticket\-key\-cipher\fP=aes\-256\-cbc is used, LEN must be 80. LEN and KEY pair can be repeated multiple times to store multiple keys. The key appeared first is used as encryption key. All the remaining keys are used as decryption only. .sp By default, connections to memcached server are not encrypted. To enable encryption, use \fBtls\fP keyword in \fB\-\-tls\-ticket\-key\-memcached\fP option. .sp If \fB\-\-tls\-ticket\-key\-file\fP is given, encryption key is read from the given file. In this case, nghttpx does not rotate key automatically. To rotate key, one has to restart nghttpx (see SIGNALS). .SH CERTIFICATE TRANSPARENCY .sp nghttpx supports TLS \fBsigned_certificate_timestamp\fP extension (RFC 6962 \%<https://\:tools\:.ietf\:.org/\:html/\:rfc6962>). The relevant options are \fB\-\-tls\-sct\-dir\fP and \fBsct\-dir\fP parameter in \fB\-\-subcert\fP\&. They takes a directory, and nghttpx reads all files whose extension is \fB\&.sct\fP under the directory. The \fB*.sct\fP files are encoded as \fBSignedCertificateTimestamp\fP struct described in section 3.2 of RFC 69662 \%<https://\:tools\:.ietf\:.org/\:html/\:rfc6962#\:section-3.2>\&. This format is the same one used by nginx\-ct \%<https://\:github\:.com/\:grahamedgecombe/\:nginx-ct> and mod_ssl_ct \%<https://\:httpd\:.apache\:.org/\:docs/\:trunk/\:mod/\:mod_ssl_ct\:.html>\&. ct\-submit \%<https://\:github\:.com/\:grahamedgecombe/\:ct-submit> can be used to submit certificates to log servers, and obtain the \fBSignedCertificateTimestamp\fP struct which can be used with nghttpx. .SH MRUBY SCRIPTING .sp \fBWarning:\fP .INDENT 0.0 .INDENT 3.5 The current mruby extension API is experimental and not frozen. The API is subject to change in the future release. .UNINDENT .UNINDENT .sp \fBWarning:\fP .INDENT 0.0 .INDENT 3.5 Almost all string value returned from method, or attribute is a fresh new mruby string, which involves memory allocation, and copies. Therefore, it is strongly recommended to store a return value in a local variable, and use it, instead of calling method or accessing attribute repeatedly. .UNINDENT .UNINDENT .sp nghttpx allows users to extend its capability using mruby scripts. nghttpx has 2 hook points to execute mruby script: request phase and response phase. The request phase hook is invoked after all request header fields are received from client. The response phase hook is invoked after all response header fields are received from backend server. These hooks allows users to modify header fields, or common HTTP variables, like authority or request path, and even return custom response without forwarding request to backend servers. .sp There are 2 levels of mruby script invocations: global and per\-pattern. The global mruby script is set by \fB\-\-mruby\-file\fP option and is called for all requests. The per\-pattern mruby script is set by \(dqmruby\(dq parameter in \fB\-b\fP option. It is invoked for a request which matches the particular pattern. The order of hook invocation is: global request phase hook, per\-pattern request phase hook, per\-pattern response phase hook, and finally global response phase hook. If a hook returns a response, any later hooks are not invoked. The global request hook is invoked before the pattern matching is made and changing request path may affect the pattern matching. .sp Please note that request and response hooks of per\-pattern mruby script for a single request might not come from the same script. This might happen after a request hook is executed, backend failed for some reason, and at the same time, backend configuration is replaced by API request, and then the request uses new configuration on retry. The response hook from new configuration, if it is specified, will be invoked. .sp The all mruby script will be evaluated once per thread on startup, and it must instantiate object and evaluate it as the return value (e.g., \fBApp.new\fP). This object is called app object. If app object defines \fBon_req\fP method, it is called with \fBNghttpx::Env\fP object on request hook. Similarly, if app object defines \fBon_resp\fP method, it is called with \fBNghttpx::Env\fP object on response hook. For each method invocation, user can can access \fBNghttpx::Request\fP and \fBNghttpx::Response\fP objects via \fBNghttpx::Env#req\fP and \fBNghttpx::Env#resp\fP respectively. .INDENT 0.0 .TP .B Nghttpx::REQUEST_PHASE Constant to represent request phase. .UNINDENT .INDENT 0.0 .TP .B Nghttpx::RESPONSE_PHASE Constant to represent response phase. .UNINDENT .INDENT 0.0 .TP .B class Nghttpx::Env Object to represent current request specific context. .INDENT 7.0 .TP .B attribute [R] req Return \fBRequest\fP object. .UNINDENT .INDENT 7.0 .TP .B attribute [R] resp Return \fBResponse\fP object. .UNINDENT .INDENT 7.0 .TP .B attribute [R] ctx Return Ruby hash object. It persists until request finishes. So values set in request phase hook can be retrieved in response phase hook. .UNINDENT .INDENT 7.0 .TP .B attribute [R] phase Return the current phase. .UNINDENT .INDENT 7.0 .TP .B attribute [R] remote_addr Return IP address of a remote client. If connection is made via UNIX domain socket, this returns the string \(dqlocalhost\(dq. .UNINDENT .INDENT 7.0 .TP .B attribute [R] server_addr Return address of server that accepted the connection. This is a string which specified in \fB\-\-frontend\fP option, excluding port number, and not a resolved IP address. For UNIX domain socket, this is a path to UNIX domain socket. .UNINDENT .INDENT 7.0 .TP .B attribute [R] server_port Return port number of the server frontend which accepted the connection from client. .UNINDENT .INDENT 7.0 .TP .B attribute [R] tls_used Return true if TLS is used on the connection. .UNINDENT .INDENT 7.0 .TP .B attribute [R] tls_sni Return the TLS SNI value which client sent in this connection. .UNINDENT .INDENT 7.0 .TP .B attribute [R] tls_client_fingerprint_sha256 Return the SHA\-256 fingerprint of a client certificate. .UNINDENT .INDENT 7.0 .TP .B attribute [R] tls_client_fingerprint_sha1 Return the SHA\-1 fingerprint of a client certificate. .UNINDENT .INDENT 7.0 .TP .B attribute [R] tls_client_issuer_name Return the issuer name of a client certificate. .UNINDENT .INDENT 7.0 .TP .B attribute [R] tls_client_subject_name Return the subject name of a client certificate. .UNINDENT .INDENT 7.0 .TP .B attribute [R] tls_client_serial Return the serial number of a client certificate. .UNINDENT .INDENT 7.0 .TP .B attribute [R] tls_client_not_before Return the start date of a client certificate in seconds since the epoch. .UNINDENT .INDENT 7.0 .TP .B attribute [R] tls_client_not_after Return the end date of a client certificate in seconds since the epoch. .UNINDENT .INDENT 7.0 .TP .B attribute [R] tls_cipher Return a TLS cipher negotiated in this connection. .UNINDENT .INDENT 7.0 .TP .B attribute [R] tls_protocol Return a TLS protocol version negotiated in this connection. .UNINDENT .INDENT 7.0 .TP .B attribute [R] tls_session_id Return a session ID for this connection in hex string. .UNINDENT .INDENT 7.0 .TP .B attribute [R] tls_session_reused Return true if, and only if a SSL/TLS session is reused. .UNINDENT .INDENT 7.0 .TP .B attribute [R] alpn Return ALPN identifier negotiated in this connection. .UNINDENT .INDENT 7.0 .TP .B attribute [R] tls_handshake_finished Return true if SSL/TLS handshake has finished. If it returns false in the request phase hook, the request is received in TLSv1.3 early data (0\-RTT) and might be vulnerable to the replay attack. nghttpx will send Early\-Data header field to backend servers to indicate this. .UNINDENT .UNINDENT .INDENT 0.0 .TP .B class Nghttpx::Request Object to represent request from client. The modification to Request object is allowed only in request phase hook. .INDENT 7.0 .TP .B attribute [R] http_version_major Return HTTP major version. .UNINDENT .INDENT 7.0 .TP .B attribute [R] http_version_minor Return HTTP minor version. .UNINDENT .INDENT 7.0 .TP .B attribute [R/W] method HTTP method. On assignment, copy of given value is assigned. We don\(aqt accept arbitrary method name. We will document them later, but well known methods, like GET, PUT and POST, are all supported. .UNINDENT .INDENT 7.0 .TP .B attribute [R/W] authority Authority (i.e., example.org), including optional port component . On assignment, copy of given value is assigned. .UNINDENT .INDENT 7.0 .TP .B attribute [R/W] scheme Scheme (i.e., http, https). On assignment, copy of given value is assigned. .UNINDENT .INDENT 7.0 .TP .B attribute [R/W] path Request path, including query component (i.e., /index.html). On assignment, copy of given value is assigned. The path does not include authority component of URI. This may include query component. nghttpx makes certain normalization for path. It decodes percent\-encoding for unreserved characters (see \%<https://\:tools\:.ietf\:.org/\:html/\:rfc3986#\:section-2.3>), and resolves \(dq..\(dq and \(dq.\(dq. But it may leave characters which should be percent\-encoded as is. So be careful when comparing path against desired string. .UNINDENT .INDENT 7.0 .TP .B attribute [R] headers Return Ruby hash containing copy of request header fields. Changing values in returned hash does not change request header fields actually used in request processing. Use \fBNghttpx::Request#add_header\fP or \fBNghttpx::Request#set_header\fP to change request header fields. .UNINDENT .INDENT 7.0 .TP .B add_header(key, value) Add header entry associated with key. The value can be single string or array of string. It does not replace any existing values associated with key. .UNINDENT .INDENT 7.0 .TP .B set_header(key, value) Set header entry associated with key. The value can be single string or array of string. It replaces any existing values associated with key. .UNINDENT .INDENT 7.0 .TP .B clear_headers() Clear all existing request header fields. .UNINDENT .INDENT 7.0 .TP .B push(uri) Initiate to push resource identified by \fIuri\fP\&. Only HTTP/2 protocol supports this feature. For the other protocols, this method is noop. \fIuri\fP can be absolute URI, absolute path or relative path to the current request. For absolute or relative path, scheme and authority are inherited from the current request. Currently, method is always GET. nghttpx will issue request to backend servers to fulfill this request. The request and response phase hooks will be called for pushed resource as well. .UNINDENT .UNINDENT .INDENT 0.0 .TP .B class Nghttpx::Response Object to represent response from backend server. .INDENT 7.0 .TP .B attribute [R] http_version_major Return HTTP major version. .UNINDENT .INDENT 7.0 .TP .B attribute [R] http_version_minor Return HTTP minor version. .UNINDENT .INDENT 7.0 .TP .B attribute [R/W] status HTTP status code. It must be in the range [200, 999], inclusive. The non\-final status code is not supported in mruby scripting at the moment. .UNINDENT .INDENT 7.0 .TP .B attribute [R] headers Return Ruby hash containing copy of response header fields. Changing values in returned hash does not change response header fields actually used in response processing. Use \fBNghttpx::Response#add_header\fP or \fBNghttpx::Response#set_header\fP to change response header fields. .UNINDENT .INDENT 7.0 .TP .B add_header(key, value) Add header entry associated with key. The value can be single string or array of string. It does not replace any existing values associated with key. .UNINDENT .INDENT 7.0 .TP .B set_header(key, value) Set header entry associated with key. The value can be single string or array of string. It replaces any existing values associated with key. .UNINDENT .INDENT 7.0 .TP .B clear_headers() Clear all existing response header fields. .UNINDENT .INDENT 7.0 .TP .B return(body) Return custom response \fIbody\fP to a client. When this method is called in request phase hook, the request is not forwarded to the backend, and response phase hook for this request will not be invoked. When this method is called in response phase hook, response from backend server is canceled and discarded. The status code and response header fields should be set before using this method. To set status code, use \fBNghttpx::Response#status\fP\&. If status code is not set, 200 is used. To set response header fields, \fBNghttpx::Response#add_header\fP and \fBNghttpx::Response#set_header\fP\&. When this method is invoked in response phase hook, the response headers are filled with the ones received from backend server. To send completely custom header fields, first call \fBNghttpx::Response#clear_headers\fP to erase all existing header fields, and then add required header fields. It is an error to call this method twice for a given request. .UNINDENT .INDENT 7.0 .TP .B send_info(status, headers) Send non\-final (informational) response to a client. \fIstatus\fP must be in the range [100, 199], inclusive. \fIheaders\fP is a hash containing response header fields. Its key must be a string, and the associated value must be either string or array of strings. Since this is not a final response, even if this method is invoked, request is still forwarded to a backend unless \fBNghttpx::Response#return\fP is called. This method can be called multiple times. It cannot be called after \fBNghttpx::Response#return\fP is called. .UNINDENT .UNINDENT .SS MRUBY EXAMPLES .sp Modify request path: .INDENT 0.0 .INDENT 3.5 .sp .EX class App def on_req(env) env.req.path = \(dq/apps#{env.req.path}\(dq end end App.new .EE .UNINDENT .UNINDENT .sp Don\(aqt forget to instantiate and evaluate object at the last line. .sp Restrict permission of viewing a content to a specific client addresses: .INDENT 0.0 .INDENT 3.5 .sp .EX class App def on_req(env) allowed_clients = [\(dq127.0.0.1\(dq, \(dq::1\(dq] if env.req.path.start_with?(\(dq/log/\(dq) && !allowed_clients.include?(env.remote_addr) then env.resp.status = 404 env.resp.return \(dqpermission denied\(dq end end end App.new .EE .UNINDENT .UNINDENT .SH API ENDPOINTS .sp nghttpx exposes API endpoints to manipulate it via HTTP based API. By default, API endpoint is disabled. To enable it, add a dedicated frontend for API using \fB\-\-frontend\fP option with \(dqapi\(dq parameter. All requests which come from this frontend address, will be treated as API request. .sp The response is normally JSON dictionary, and at least includes the following keys: .INDENT 0.0 .TP .B status The status of the request processing. The following values are defined: .INDENT 7.0 .TP .B Success The request was successful. .TP .B Failure The request was failed. No change has been made. .UNINDENT .TP .B code HTTP status code .UNINDENT .sp Additionally, depending on the API endpoint, \fBdata\fP key may be present, and its value contains the API endpoint specific data. .sp We wrote \(dqnormally\(dq, since nghttpx may return ordinal HTML response in some cases where the error has occurred before reaching API endpoint (e.g., header field is too large). .sp The following section describes available API endpoints. .SS POST /api/v1beta1/backendconfig .sp This API replaces the current backend server settings with the requested ones. The request method should be POST, but PUT is also acceptable. The request body must be nghttpx configuration file format. For configuration file format, see FILES section. The line separator inside the request body must be single LF (0x0A). Currently, only \fBbackend\fP option is parsed, the others are simply ignored. The semantics of this API is replace the current backend with the backend options in request body. Describe the desired set of backend severs, and nghttpx makes it happen. If there is no \fBbackend\fP option is found in request body, the current set of backend is replaced with the \fBbackend\fP option\(aqs default value, which is \fB127.0.0.1,80\fP\&. .sp The replacement is done instantly without breaking existing connections or requests. It also avoids any process creation as is the case with hot swapping with signals. .sp The one limitation is that only numeric IP address is allowed in \fBbackend\fP in request body unless \(dqdns\(dq parameter is used while non numeric hostname is allowed in command\-line or configuration file is read using \fB\-\-conf\fP\&. .SS GET /api/v1beta1/configrevision .sp This API returns configuration revision of the current nghttpx. The configuration revision is opaque string, and it changes after each reloading by SIGHUP. With this API, an external application knows that whether nghttpx has finished reloading its configuration by comparing the configuration revisions between before and after reloading. It is recommended to disable persistent (keep\-alive) connection for this purpose in order to avoid to send a request using the reused connection which may bound to an old process. .sp This API returns response including \fBdata\fP key. Its value is JSON object, and it contains at least the following key: .INDENT 0.0 .TP .B configRevision The configuration revision of the current nghttpx .UNINDENT .SH SEE ALSO .sp \fBnghttp(1)\fP, \fBnghttpd(1)\fP, \fBh2load(1)\fP .SH Author Tatsuhiro Tsujikawa .SH Copyright 2012, 2015, 2016, Tatsuhiro Tsujikawa .\" End of generated man page. PK ]h�\��>(� � man/man1/nghttp.1nu �[��� .\" Man page generated from reStructuredText .\" by the Docutils 0.22.4 manpage writer. . . .nr rst2man-indent-level 0 . .de1 rstReportMargin \\$1 \\n[an-margin] level \\n[rst2man-indent-level] level margin: \\n[rst2man-indent\\n[rst2man-indent-level]] - \\n[rst2man-indent0] \\n[rst2man-indent1] \\n[rst2man-indent2] .. .de1 INDENT .\" .rstReportMargin pre: . RS \\$1 . nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin] . nr rst2man-indent-level +1 .\" .rstReportMargin post: .. .de UNINDENT . RE .\" indent \\n[an-margin] .\" old: \\n[rst2man-indent\\n[rst2man-indent-level]] .nr rst2man-indent-level -1 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]] .in \\n[rst2man-indent\\n[rst2man-indent-level]]u .. .TH "NGHTTP" "1" "Apr 19, 2026" "1.69.0" "nghttp2" .SH NAME nghttp \- HTTP/2 client .SH SYNOPSIS .sp \fBnghttp\fP [OPTIONS]... <URI>... .SH DESCRIPTION .sp HTTP/2 client .INDENT 0.0 .TP .B <URI> Specify URI to access. .UNINDENT .SH OPTIONS .INDENT 0.0 .TP .B \-v, \-\-verbose Print debug information such as reception and transmission of frames and name/value pairs. Specifying this option multiple times increases verbosity. .UNINDENT .INDENT 0.0 .TP .B \-n, \-\-null\-out Discard downloaded data. .UNINDENT .INDENT 0.0 .TP .B \-O, \-\-remote\-name Save download data in the current directory. The filename is derived from URI. If URI ends with \(aq\fI/\fP\(aq, \(aqindex.html\(aq is used as a filename. Not implemented yet. .UNINDENT .INDENT 0.0 .TP .B \-t, \-\-timeout=<DURATION> Timeout each request after <DURATION>. Set 0 to disable timeout. .UNINDENT .INDENT 0.0 .TP .B \-w, \-\-window\-bits=<N> Sets the stream level initial window size to 2**<N>\-1. .UNINDENT .INDENT 0.0 .TP .B \-W, \-\-connection\-window\-bits=<N> Sets the connection level initial window size to 2**<N>\-1. .UNINDENT .INDENT 0.0 .TP .B \-a, \-\-get\-assets Download assets such as stylesheets, images and script files linked from the downloaded resource. Only links whose origins are the same with the linking resource will be downloaded. nghttp prioritizes resources using HTTP/2 dependency based priority. The priority order, from highest to lowest, is html itself, css, javascript and images. .UNINDENT .INDENT 0.0 .TP .B \-s, \-\-stat Print statistics. .UNINDENT .INDENT 0.0 .TP .B \-H, \-\-header=<HEADER> Add a header to the requests. Example: \fB\-H\fP\(aq:method: PUT\(aq .UNINDENT .INDENT 0.0 .TP .B \-\-trailer=<HEADER> Add a trailer header to the requests. <HEADER> must not include pseudo header field (header field name starting with \(aq:\(aq). To send trailer, one must use \fB\-d\fP option to send request body. Example: \fB\-\-trailer\fP \(aqfoo: bar\(aq. .UNINDENT .INDENT 0.0 .TP .B \-\-cert=<CERT> Use the specified client certificate file. The file must be in PEM format. .UNINDENT .INDENT 0.0 .TP .B \-\-key=<KEY> Use the client private key file. The file must be in PEM format. .UNINDENT .INDENT 0.0 .TP .B \-d, \-\-data=<PATH> Post FILE to server. If \(aq\-\(aq is given, data will be read from stdin. .UNINDENT .INDENT 0.0 .TP .B \-m, \-\-multiply=<N> Request each URI <N> times. By default, same URI is not requested twice. This option disables it too. .UNINDENT .INDENT 0.0 .TP .B \-u, \-\-upgrade Perform HTTP Upgrade for HTTP/2. This option is ignored if the request URI has https scheme. If \fB\-d\fP is used, the HTTP upgrade request is performed with OPTIONS method. .UNINDENT .INDENT 0.0 .TP .B \-\-extpri=<PRI> Sets RFC 9218 priority of given URI. <PRI> must be the wire format of priority header field (e.g., \(dqu=3,i\(dq). This option can be used multiple times, and N\-th \fB\-\-extpri\fP option sets priority of N\-th URI in the command line. If the number of this option is less than the number of URI, the last option value is repeated. If there is no \fB\-\-extpri\fP option, urgency is 3, and incremental is false. .UNINDENT .INDENT 0.0 .TP .B \-M, \-\-peer\-max\-concurrent\-streams=<N> Use <N> as SETTINGS_MAX_CONCURRENT_STREAMS value of remote endpoint as if it is received in SETTINGS frame. .sp Default: \fB100\fP .UNINDENT .INDENT 0.0 .TP .B \-c, \-\-header\-table\-size=<SIZE> Specify decoder header table size. If this option is used multiple times, and the minimum value among the given values except for last one is strictly less than the last value, that minimum value is set in SETTINGS frame payload before the last value, to simulate multiple header table size change. .UNINDENT .INDENT 0.0 .TP .B \-\-encoder\-header\-table\-size=<SIZE> Specify encoder header table size. The decoder (server) specifies the maximum dynamic table size it accepts. Then the negotiated dynamic table size is the minimum of this option value and the value which server specified. .UNINDENT .INDENT 0.0 .TP .B \-b, \-\-padding=<N> Add at most <N> bytes to a frame payload as padding. Specify 0 to disable padding. .UNINDENT .INDENT 0.0 .TP .B \-r, \-\-har=<PATH> Output HTTP transactions <PATH> in HAR format. If \(aq\-\(aq is given, data is written to stdout. .UNINDENT .INDENT 0.0 .TP .B \-\-color Force colored log output. .UNINDENT .INDENT 0.0 .TP .B \-\-continuation Send large header to test CONTINUATION. .UNINDENT .INDENT 0.0 .TP .B \-\-no\-content\-length Don\(aqt send content\-length header field. .UNINDENT .INDENT 0.0 .TP .B \-\-hexdump Display the incoming traffic in hexadecimal (Canonical hex+ASCII display). If SSL/TLS is used, decrypted data are used. .UNINDENT .INDENT 0.0 .TP .B \-\-no\-push Disable server push. .UNINDENT .INDENT 0.0 .TP .B \-\-max\-concurrent\-streams=<N> The number of concurrent pushed streams this client accepts. .UNINDENT .INDENT 0.0 .TP .B \-\-expect\-continue Perform an Expect/Continue handshake: wait to send DATA (up to a short timeout) until the server sends a 100 Continue interim response. This option is ignored unless combined with the \fB\-d\fP option. .UNINDENT .INDENT 0.0 .TP .B \-y, \-\-no\-verify\-peer Suppress warning on server certificate verification failure. .UNINDENT .INDENT 0.0 .TP .B \-\-ktls Enable ktls. .UNINDENT .INDENT 0.0 .TP .B \-\-version Display version information and exit. .UNINDENT .INDENT 0.0 .TP .B \-h, \-\-help Display this help and exit. .UNINDENT .sp The <SIZE> argument is an integer and an optional unit (e.g., 10K is 10 * 1024). Units are K, M and G (powers of 1024). .sp The <DURATION> argument is an integer and an optional unit (e.g., 1s is 1 second and 500ms is 500 milliseconds). Units are h, m, s or ms (hours, minutes, seconds and milliseconds, respectively). If a unit is omitted, a second is used as unit. .SH SEE ALSO .sp \fBnghttpd(1)\fP, \fBnghttpx(1)\fP, \fBh2load(1)\fP .SH Author Tatsuhiro Tsujikawa .SH Copyright 2012, 2015, 2016, Tatsuhiro Tsujikawa .\" End of generated man page. PK ]h�\`)G�%= %= man/man1/h2load.1nu �[��� .\" Man page generated from reStructuredText .\" by the Docutils 0.22.4 manpage writer. . . .nr rst2man-indent-level 0 . .de1 rstReportMargin \\$1 \\n[an-margin] level \\n[rst2man-indent-level] level margin: \\n[rst2man-indent\\n[rst2man-indent-level]] - \\n[rst2man-indent0] \\n[rst2man-indent1] \\n[rst2man-indent2] .. .de1 INDENT .\" .rstReportMargin pre: . RS \\$1 . nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin] . nr rst2man-indent-level +1 .\" .rstReportMargin post: .. .de UNINDENT . RE .\" indent \\n[an-margin] .\" old: \\n[rst2man-indent\\n[rst2man-indent-level]] .nr rst2man-indent-level -1 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]] .in \\n[rst2man-indent\\n[rst2man-indent-level]]u .. .TH "H2LOAD" "1" "Apr 19, 2026" "1.69.0" "nghttp2" .SH NAME h2load \- HTTP/2 benchmarking tool .SH SYNOPSIS .sp \fBh2load\fP [OPTIONS]... [URI]... .SH DESCRIPTION .sp benchmarking tool for HTTP/2 server .INDENT 0.0 .TP .B <URI> Specify URI to access. Multiple URIs can be specified. URIs are used in this order for each client. All URIs are used, then first URI is used and then 2nd URI, and so on. The scheme, host and port in the subsequent URIs, if present, are ignored. Those in the first URI are used solely. Definition of a base URI overrides all scheme, host or port values. .UNINDENT .SH OPTIONS .INDENT 0.0 .TP .B \-n, \-\-requests=<N> Number of requests across all clients. If it is used with \fB\-\-timing\-script\-file\fP option, this option specifies the number of requests each client performs rather than the number of requests across all clients. This option is ignored if timing\-based benchmarking is enabled (see \fB\-\-duration\fP option). .sp Default: \fB1\fP .UNINDENT .INDENT 0.0 .TP .B \-c, \-\-clients=<N> Number of concurrent clients. With \fB\-r\fP option, this specifies the maximum number of connections to be made. .sp Default: \fB1\fP .UNINDENT .INDENT 0.0 .TP .B \-t, \-\-threads=<N> Number of native threads. .sp Default: \fB1\fP .UNINDENT .INDENT 0.0 .TP .B \-i, \-\-input\-file=<PATH> Path of a file with multiple URIs are separated by EOLs. This option will disable URIs getting from command\-line. If \(aq\-\(aq is given as <PATH>, URIs will be read from stdin. URIs are used in this order for each client. All URIs are used, then first URI is used and then 2nd URI, and so on. The scheme, host and port in the subsequent URIs, if present, are ignored. Those in the first URI are used solely. Definition of a base URI overrides all scheme, host or port values. .UNINDENT .INDENT 0.0 .TP .B \-m, \-\-max\-concurrent\-streams=<N> Max concurrent streams to issue per session. When http/1.1 is used, this specifies the number of HTTP pipelining requests in\-flight. .sp Default: \fB1\fP .UNINDENT .INDENT 0.0 .TP .B \-f, \-\-max\-frame\-size=<SIZE> Maximum frame size that the local endpoint is willing to receive. .sp Default: \fB16K\fP .UNINDENT .INDENT 0.0 .TP .B \-w, \-\-window\-bits=<N> Sets the stream level initial window size to (2**<N>)\-1. For QUIC, <N> is capped to 26 (roughly 64MiB). It defaults to 24 (16MiB) for QUIC, and 30 for other protocols. .UNINDENT .INDENT 0.0 .TP .B \-W, \-\-connection\-window\-bits=<N> Sets the connection level initial window size to (2**<N>)\-1. .sp Default: \fB30\fP .UNINDENT .INDENT 0.0 .TP .B \-H, \-\-header=<HEADER> Add/Override a header to the requests. .UNINDENT .INDENT 0.0 .TP .B \-\-ciphers=<SUITE> Set allowed cipher list for TLSv1.2 or earlier. The format of the string is described in OpenSSL ciphers(1). .sp Default: \fBECDHE\-ECDSA\-AES128\-GCM\-SHA256:ECDHE\-RSA\-AES128\-GCM\-SHA256:ECDHE\-ECDSA\-AES256\-GCM\-SHA384:ECDHE\-RSA\-AES256\-GCM\-SHA384:ECDHE\-ECDSA\-CHACHA20\-POLY1305:ECDHE\-RSA\-CHACHA20\-POLY1305:DHE\-RSA\-AES128\-GCM\-SHA256:DHE\-RSA\-AES256\-GCM\-SHA384\fP .UNINDENT .INDENT 0.0 .TP .B \-\-tls13\-ciphers=<SUITE> Set allowed cipher list for TLSv1.3. The format of the string is described in OpenSSL ciphers(1). .sp Default: \fBTLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_CCM_SHA256\fP .UNINDENT .INDENT 0.0 .TP .B \-p, \-\-no\-tls\-proto=<PROTOID> Specify ALPN identifier of the protocol to be used when accessing http URI without SSL/TLS. Available protocols: h2c and http/1.1 .sp Default: \fBh2c\fP .UNINDENT .INDENT 0.0 .TP .B \-d, \-\-data=<PATH> Post FILE to server. The request method is changed to POST. For http/1.1 connection, if \fB\-d\fP is used, the maximum number of in\-flight pipelined requests is set to 1. .UNINDENT .INDENT 0.0 .TP .B \-r, \-\-rate=<N> Specifies the fixed rate at which connections are created. The rate must be a positive integer, representing the number of connections to be made per rate period. The maximum number of connections to be made is given in \fB\-c\fP option. This rate will be distributed among threads as evenly as possible. For example, with \fB\-t\fP2 and \fB\-r\fP4, each thread gets 2 connections per period. When the rate is 0, the program will run as it normally does, creating connections at whatever variable rate it wants. The default value for this option is 0. \fB\-r\fP and \fB\-D\fP are mutually exclusive. .UNINDENT .INDENT 0.0 .TP .B \-\-rate\-period=<DURATION> Specifies the time period between creating connections. The period must be a positive number, representing the length of the period in time. This option is ignored if the rate option is not used. The default value for this option is 1s. .UNINDENT .INDENT 0.0 .TP .B \-D, \-\-duration=<DURATION> Specifies the main duration for the measurements in case of timing\-based benchmarking. \fB\-D\fP and \fB\-r\fP are mutually exclusive. .UNINDENT .INDENT 0.0 .TP .B \-\-warm\-up\-time=<DURATION> Specifies the time period before starting the actual measurements, in case of timing\-based benchmarking. Needs to provided along with \fB\-D\fP option. .UNINDENT .INDENT 0.0 .TP .B \-T, \-\-connection\-active\-timeout=<DURATION> Specifies the maximum time that h2load is willing to keep a connection open, regardless of the activity on said connection. <DURATION> must be a positive integer, specifying the amount of time to wait. When no timeout value is set (either active or inactive), h2load will keep a connection open indefinitely, waiting for a response. .UNINDENT .INDENT 0.0 .TP .B \-N, \-\-connection\-inactivity\-timeout=<DURATION> Specifies the amount of time that h2load is willing to wait to see activity on a given connection. <DURATION> must be a positive integer, specifying the amount of time to wait. When no timeout value is set (either active or inactive), h2load will keep a connection open indefinitely, waiting for a response. .UNINDENT .INDENT 0.0 .TP .B \-\-timing\-script\-file=<PATH> Path of a file containing one or more lines separated by EOLs. Each script line is composed of two tab\-separated fields. The first field represents the time offset from the start of execution, expressed as a positive value of milliseconds with microsecond resolution. The second field represents the URI. This option will disable URIs getting from command\-line. If \(aq\-\(aq is given as <PATH>, script lines will be read from stdin. Script lines are used in order for each client. If \fB\-n\fP is given, it must be less than or equal to the number of script lines, larger values are clamped to the number of script lines. If \fB\-n\fP is not given, the number of requests will default to the number of script lines. The scheme, host and port defined in the first URI are used solely. Values contained in other URIs, if present, are ignored. Definition of a base URI overrides all scheme, host or port values. \fB\-\-timing\-script\-file\fP and \fB\-\-rps\fP are mutually exclusive. .UNINDENT .INDENT 0.0 .TP .B \-B, \-\-base\-uri=(<URI>|unix:<PATH>) Specify URI from which the scheme, host and port will be used for all requests. The base URI overrides all values defined either at the command line or inside input files. If argument starts with \(dqunix:\(dq, then the rest of the argument will be treated as UNIX domain socket path. The connection is made through that path instead of TCP. In this case, scheme is inferred from the first URI appeared in the command line or inside input files as usual. .UNINDENT .INDENT 0.0 .TP .B \-\-alpn\-list=<LIST> Comma delimited list of ALPN protocol identifier sorted in the order of preference. That means most desirable protocol comes first. The parameter must be delimited by a single comma only and any white spaces are treated as a part of protocol string. .sp Default: \fBh2,http/1.1\fP .UNINDENT .INDENT 0.0 .TP .B \-\-h1 Short hand for \fB\-\-alpn\-list\fP=http/1.1 \fB\-\-no\-tls\-proto\fP=http/1.1, which effectively force http/1.1 for both http and https URI. .UNINDENT .INDENT 0.0 .TP .B \-\-h3 Short hand for \fB\-\-alpn\-list\fP=h3, which effectively forces HTTP/3. .UNINDENT .INDENT 0.0 .TP .B \-\-header\-table\-size=<SIZE> Specify decoder header table size. .sp Default: \fB4K\fP .UNINDENT .INDENT 0.0 .TP .B \-\-encoder\-header\-table\-size=<SIZE> Specify encoder header table size. The decoder (server) specifies the maximum dynamic table size it accepts. Then the negotiated dynamic table size is the minimum of this option value and the value which server specified. .sp Default: \fB4K\fP .UNINDENT .INDENT 0.0 .TP .B \-\-log\-file=<PATH> Write per\-request information to a file as tab\-separated columns: start time as microseconds since epoch; HTTP status code; microseconds until end of response. More columns may be added later. Rows are ordered by end\-of\- response time when using one worker thread, but may appear slightly out of order with multiple threads due to buffering. Status code is \-1 for failed streams. .UNINDENT .INDENT 0.0 .TP .B \-\-qlog\-file\-base=<PATH> Enable qlog output and specify base file name for qlogs. Qlog is emitted for each connection. For a given base name \(dqbase\(dq, each output file name becomes \(dqbase.M.N.sqlog\(dq where M is worker ID and N is client ID (e.g. \(dqbase.0.3.sqlog\(dq). Only effective in QUIC runs. .UNINDENT .INDENT 0.0 .TP .B \-\-connect\-to=<HOST>[:<PORT>] Host and port to connect instead of using the authority in <URI>. .UNINDENT .INDENT 0.0 .TP .B \-\-rps=<N> Specify request per second for each client. \fB\-\-rps\fP and \fB\-\-timing\-script\-file\fP are mutually exclusive. .UNINDENT .INDENT 0.0 .TP .B \-\-groups=<GROUPS> Specify the supported groups. .sp Default: \fBX25519:P\-256:P\-384:P\-521\fP .UNINDENT .INDENT 0.0 .TP .B \-\-no\-udp\-gso Disable UDP GSO. .UNINDENT .INDENT 0.0 .TP .B \-\-max\-udp\-payload\-size=<SIZE> Specify the maximum outgoing UDP datagram payload size. .UNINDENT .INDENT 0.0 .TP .B \-\-ktls Enable ktls. .UNINDENT .INDENT 0.0 .TP .B \-\-sni=<DNSNAME> Send <DNSNAME> in TLS SNI, overriding the host name specified in URI. .UNINDENT .INDENT 0.0 .TP .B \-\-histogram Plot histogram for performance statistics. .UNINDENT .INDENT 0.0 .TP .B \-\-tls\-session\-file=<PATH> Read TLS session from <PATH>, and set it to all TLS connections to perform the session resumption. It is also used to store the new TLS session. At most one session is written to the given file. .UNINDENT .INDENT 0.0 .TP .B \-\-output\-file=<PATH> Write the measurement results to <PATH> in JSON format. This basically includes all numbers reported to the normal output. In addition, for performance measurements, all raw samples are included. .UNINDENT .INDENT 0.0 .TP .B \-v, \-\-verbose Output debug information. .UNINDENT .INDENT 0.0 .TP .B \-\-version Display version information and exit. .UNINDENT .INDENT 0.0 .TP .B \-h, \-\-help Display this help and exit. .UNINDENT .sp The <SIZE> argument is an integer and an optional unit (e.g., 10K is 10 * 1024). Units are K, M and G (powers of 1024). .sp The <DURATION> argument is an integer and an optional unit (e.g., 1s is 1 second and 500ms is 500 milliseconds). Units are h, m, s or ms (hours, minutes, seconds and milliseconds, respectively). If a unit is omitted, a second is used as unit. .SH OUTPUT .SS REQUEST METRICS .INDENT 0.0 .TP .B requests .INDENT 7.0 .TP .B total The total number of requests h2load was instructed to make. .TP .B started The number of requests initiated by the tool. .TP .B done The number of requests that reached completion. .TP .B succeeded Requests resulting in an HTTP 2xx or 3xx status code. .TP .B failed The total number of failed requests. This includes both \fBerrored\fP requests and requests that completed with a non\-2xx/3xx status code. .TP .B errored A subset of \fBfailed\fP where the requests failed due to network\-level issues (e.g., TCP resets, \fBRST_STREAM\fP) rather than HTTP status codes. .TP .B timeout A subset of \fBerrored\fP where the connection timed out before completion. .UNINDENT .TP .B status codes The specific count of received HTTP status codes categorized by class (2xx, 3xx, 4xx, 5xx). .UNINDENT .SS TRAFFIC METRICS .INDENT 0.0 .TP .B traffic .INDENT 7.0 .TP .B total Total application data bytes received \(dqon the wire\(dq (decrypted if using TLS). .TP .B headers Total bytes used for response headers (pre\-decompression). .INDENT 7.0 .TP .B space savings Header compression efficiency, calculated as: .sp (1 \- headers / decompressed_headers) * 100 .sp where \fBheaders\fP is the compressed size and \fBdecompressed_headers\fP is the size after decompression. .UNINDENT .TP .B data Total bytes received in response bodies. .UNINDENT .UNINDENT .SS PERFORMANCE STATISTICS .INDENT 0.0 .TP .B Metric Definitions .INDENT 7.0 .TP .B request The duration from sending the first byte of a request to receiving the last byte of the response. .TP .B connect The time taken to establish a connection, including TLS handshakes. .TP .B TTFB The duration until the first byte of application data is received from the server (decrypted if using TLS). .TP .B req/s The requests per second measured individually across all clients. .TP .B min RTT The minimum RTT (QUIC). .TP .B smoothed RTT The smoothed RTT (QUIC). .TP .B packets sent The number of packets sent (QUIC). .TP .B packets recv The number of packets received (QUIC). .TP .B packets lost The number of packets declared lost (QUIC). .TP .B GRO packets The number of packets received in a single recvmsg call (QUIC). .UNINDENT .TP .B Distribution Fields .INDENT 7.0 .TP .B min / max The absolute minimum and maximum values recorded. .TP .B median The 50th percentile value. .TP .B p95 / p99 The 95th and 99th percentiles, indicating tail performance. .TP .B mean The arithmetic average of all samples. .TP .B sd The standard deviation (measure of data dispersion). .TP .B +/\- sd The percentage of successful samples falling within one standard deviation of the mean (mean +/\- sd). .UNINDENT .UNINDENT .SH FLOW CONTROL .sp h2load sets large flow control window by default, and effectively disables flow control to avoid under utilization of server performance. To set smaller flow control window, use \fB\-w\fP and \fB\-W\fP options. For example, use \fB\-w16 \-W16\fP to set default window size described in HTTP/2 protocol specification. .SH SEE ALSO .sp \fBnghttp(1)\fP, \fBnghttpd(1)\fP, \fBnghttpx(1)\fP .SH Author Tatsuhiro Tsujikawa .SH Copyright 2012, 2015, 2016, Tatsuhiro Tsujikawa .\" End of generated man page. PK ]h�\�M��� �� doc/nghttp2/README.rstnu �[��� nghttp2 - HTTP/2 C Library ========================== This is an implementation of the Hypertext Transfer Protocol version 2 in C. The framing layer of HTTP/2 is implemented as a reusable C library. On top of that, we have implemented an HTTP/2 client, server and proxy. We have also developed load test and benchmarking tools for HTTP/2. An HPACK encoder and decoder are available as a public API. Development Status ------------------ nghttp2 was originally developed based on `RFC 7540 <https://tools.ietf.org/html/rfc7540>`_ HTTP/2 and `RFC 7541 <https://tools.ietf.org/html/rfc7541>`_ HPACK - Header Compression for HTTP/2. Now we are updating our code to implement `RFC 9113 <https://datatracker.ietf.org/doc/html/rfc9113>`_. The nghttp2 code base was forked from the spdylay (https://github.com/tatsuhiro-t/spdylay) project. Public Test Server ------------------ The following endpoints are available to try out our nghttp2 implementation. * https://nghttp2.org/ (TLS + ALPN and HTTP/3) This endpoint supports ``h2`` and ``http/1.1`` via ALPN and requires TLSv1.2 for HTTP/2 connection. It also supports HTTP/3. * http://nghttp2.org/ (HTTP Upgrade and HTTP/2 Direct) ``h2c`` and ``http/1.1``. Requirements ------------ The following package is required to build the libnghttp2 library: * pkg-config >= 0.20 To build the documentation, you need to install: * sphinx (http://sphinx-doc.org/) If you need libnghttp2 (C library) only, then the above packages are all you need. Use ``--enable-lib-only`` to ensure that only libnghttp2 is built. This avoids potential build error related to building bundled applications. To build and run the application programs (``nghttp``, ``nghttpd``, ``nghttpx`` and ``h2load``) in the ``src`` directory, the following packages are required: * OpenSSL >= 1.1.1; or wolfSSL >= 5.7.0; or LibreSSL >= 3.8.1; or aws-lc >= 1.19.0; or BoringSSL * libev >= 4.11 * zlib >= 1.2.3 * libc-ares >= 1.7.5 To enable ``-a`` option (getting linked assets from the downloaded resource) in ``nghttp``, the following package is required: * libxml2 >= 2.6.26 To enable systemd support in nghttpx, the following package is required: * libsystemd-dev >= 209 The HPACK tools require the following package: * jansson >= 2.5 To build sources under the examples directory, libevent is required: * libevent-openssl >= 2.0.8 To mitigate heap fragmentation in long running server programs (``nghttpd`` and ``nghttpx``), jemalloc is recommended: * jemalloc .. note:: Alpine Linux currently does not support malloc replacement due to musl limitations. See details in issue `#762 <https://github.com/nghttp2/nghttp2/issues/762>`_. For BoringSSL or aws-lc build, to enable :rfc:`8879` TLS Certificate Compression in applications, the following library is required: * libbrotli-dev >= 1.0.9 To enable mruby support for nghttpx, `mruby <https://github.com/mruby/mruby>`_ is required. We need to build mruby with C++ ABI explicitly turned on, and probably need other mrgems, mruby is managed by git submodule under third-party/mruby directory. Currently, mruby support for nghttpx is disabled by default. To enable mruby support, use ``--with-mruby`` configure option. Note that at the time of this writing, libmruby-dev and mruby packages in Debian/Ubuntu are not usable for nghttp2, since they do not enable C++ ABI. To build mruby, the following packages are required: * ruby * bison nghttpx supports `neverbleed <https://github.com/h2o/neverbleed>`_, privilege separation engine for OpenSSL. In short, it minimizes the risk of private key leakage when serious bug like Heartbleed is exploited. The neverbleed is disabled by default. To enable it, use ``--with-neverbleed`` configure option. To enable the experimental HTTP/3 support for h2load and nghttpx, the following libraries are required: * `quictls <https://github.com/quictls/openssl/tree/OpenSSL_1_1_1w+quic>`_; or wolfSSL; or LibreSSL (does not support 0RTT); or aws-lc; or `BoringSSL <https://boringssl.googlesource.com/boringssl/>`_ (commit 664a985707470a62f436cca862ccec9524c561ca); or OpenSSL >= 3.5.0 * `ngtcp2 <https://github.com/ngtcp2/ngtcp2>`_ >= 1.16.0 * `nghttp3 <https://github.com/ngtcp2/nghttp3>`_ >= 1.12.0 Use ``--enable-http3`` configure option to enable HTTP/3 feature for h2load and nghttpx. In order to build optional eBPF program to direct an incoming QUIC UDP datagram to a correct socket for nghttpx, the following libraries are required: * libbpf-dev >= 0.7.0 Use ``--with-libbpf`` configure option to build eBPF program. libelf-dev is needed to build libbpf. For Ubuntu 20.04, you can build libbpf from `the source code <https://github.com/libbpf/libbpf/releases>`_. nghttpx requires eBPF program for reloading its configuration and hot swapping its executable. Compiling libnghttp2 C source code requires a C99 compiler. gcc 4.8 is known to be adequate. In order to compile the C++ source code, C++20 compliant compiler is required. At least g++ >= 12 and clang++ >= 18 are known to work. .. note:: To enable mruby support in nghttpx, and use ``--with-mruby`` configure option. .. note:: Mac OS X users may need the ``--disable-threads`` configure option to disable multi-threading in nghttpd, nghttpx and h2load to prevent them from crashing. A patch is welcome to make multi threading work on Mac OS X platform. .. note:: To compile the associated applications (nghttp, nghttpd, nghttpx and h2load), you must use the ``--enable-app`` configure option and ensure that the specified requirements above are met. Normally, configure script checks required dependencies to build these applications, and enable ``--enable-app`` automatically, so you don't have to use it explicitly. But if you found that applications were not built, then using ``--enable-app`` may find that cause, such as the missing dependency. .. note:: In order to detect third party libraries, pkg-config is used (however we don't use pkg-config for some libraries (e.g., libev)). By default, pkg-config searches ``*.pc`` file in the standard locations (e.g., /usr/lib/pkgconfig). If it is necessary to use ``*.pc`` file in the custom location, specify paths to ``PKG_CONFIG_PATH`` environment variable, and pass it to configure script, like so: .. code-block:: text $ ./configure PKG_CONFIG_PATH=/path/to/pkgconfig For pkg-config managed libraries, ``*_CFLAG`` and ``*_LIBS`` environment variables are defined (e.g., ``OPENSSL_CFLAGS``, ``OPENSSL_LIBS``). Specifying non-empty string to these variables completely overrides pkg-config. In other words, if they are specified, pkg-config is not used for detection, and user is responsible to specify the correct values to these variables. For complete list of these variables, run ``./configure -h``. If you are using Ubuntu 22.04 LTS, run the following to install the required packages: .. code-block:: text sudo apt-get install g++ clang make binutils autoconf automake \ autotools-dev libtool pkg-config \ zlib1g-dev libssl-dev libxml2-dev libev-dev \ libevent-dev libjansson-dev \ libc-ares-dev libjemalloc-dev libsystemd-dev \ ruby-dev bison libelf-dev Building nghttp2 from release tar archive ----------------------------------------- The nghttp2 project regularly releases tar archives which includes nghttp2 source code, and generated build files. They can be downloaded from `Releases <https://github.com/nghttp2/nghttp2/releases>`_ page. Building nghttp2 from git requires autotools development packages. Building from tar archives does not require them, and thus it is much easier. The usual build step is as follows: .. code-block:: text $ tar xf nghttp2-X.Y.Z.tar.bz2 $ cd nghttp2-X.Y.Z $ ./configure $ make Building from git ----------------- Building from git is easy, but please be sure that at least autoconf 2.68 is used: .. code-block:: text $ git submodule update --init $ autoreconf -i $ automake $ autoconf $ ./configure $ make Notes for building on Windows (MSVC) ------------------------------------ The easiest way to build native Windows nghttp2 dll is use `cmake <https://cmake.org/>`_. The free version of `Visual C++ Build Tools <http://landinghub.visualstudio.com/visual-cpp-build-tools>`_ works fine. 1. Install cmake for windows 2. Open "Visual C++ ... Native Build Tool Command Prompt", and inside nghttp2 directly, run ``cmake``. 3. Then run ``cmake --build`` to build library. 4. nghttp2.dll, nghttp2.lib, nghttp2.exp are placed under lib directory. Note that the above steps most likely produce nghttp2 library only. No bundled applications are compiled. Notes for building on Windows (Mingw/Cygwin) -------------------------------------------- Under Mingw environment, you can only compile the library, it's ``libnghttp2-X.dll`` and ``libnghttp2.a``. If you want to compile the applications(``h2load``, ``nghttp``, ``nghttpx``, ``nghttpd``), you need to use the Cygwin environment. Under Cygwin environment, to compile the applications you need to compile and install the libev first. Secondly, you need to undefine the macro ``__STRICT_ANSI__``, if you not, the functions ``fdopen``, ``fileno`` and ``strptime`` will not available. the sample command like this: .. code-block:: text $ export CFLAGS="-U__STRICT_ANSI__ -I$libev_PREFIX/include -L$libev_PREFIX/lib" $ export CXXFLAGS=$CFLAGS $ ./configure $ make If you want to compile the applications under ``examples/``, you need to remove or rename the ``event.h`` from libev's installation, because it conflicts with libevent's installation. Notes for installation on Linux systems -------------------------------------------- After installing nghttp2 tool suite with ``make install`` one might experience a similar error: .. code-block:: text nghttpx: error while loading shared libraries: libnghttp2.so.14: cannot open shared object file: No such file or directory This means that the tool is unable to locate the ``libnghttp2.so`` shared library. To update the shared library cache run ``sudo ldconfig``. Building the documentation -------------------------- .. note:: Documentation is still incomplete. To build the documentation, run: .. code-block:: text $ make html The documents will be generated under ``doc/manual/html/``. The generated documents will not be installed with ``make install``. The online documentation is available at https://nghttp2.org/documentation/ Build HTTP/3 enabled h2load and nghttpx --------------------------------------- To build h2load and nghttpx with HTTP/3 feature enabled, run the configure script with ``--enable-http3``. For nghttpx to reload configurations and swapping its executable while gracefully terminating old worker processes, eBPF is required. Run the configure script with ``--enable-http3 --with-libbpf`` to build eBPF program. The QUIC keying material must be set with ``--frontend-quic-secret-file`` in order to keep the existing connections alive during reload. The detailed steps to build HTTP/3 enabled h2load and nghttpx follow. Build aws-lc: .. code-block:: text $ git clone --depth 1 -b v1.72.0 https://github.com/aws/aws-lc $ cd aws-lc $ cmake -B build -DDISABLE_GO=ON --install-prefix=$PWD/opt $ make -j$(nproc) -C build $ cmake --install build $ cd .. Build nghttp3: .. code-block:: text $ git clone --depth 1 -b v1.15.0 https://github.com/ngtcp2/nghttp3 $ cd nghttp3 $ git submodule update --init --depth 1 $ autoreconf -i $ ./configure --prefix=$PWD/build --enable-lib-only $ make -j$(nproc) $ make install $ cd .. Build ngtcp2: .. code-block:: text $ git clone --depth 1 -b v1.22.1 https://github.com/ngtcp2/ngtcp2 $ cd ngtcp2 $ git submodule update --init --depth 1 $ autoreconf -i $ ./configure --prefix=$PWD/build --enable-lib-only --with-boringssl \ BORINGSSL_CFLAGS="-I$PWD/../aws-lc/opt/include" \ BORINGSSL_LIBS="-L$PWD/../aws-lc/opt/lib -lssl -lcrypto" $ make -j$(nproc) $ make install $ cd .. If your Linux distribution does not have libbpf-dev >= 0.7.0, build from source: .. code-block:: text $ git clone --depth 1 -b v1.7.0 https://github.com/libbpf/libbpf $ cd libbpf $ PREFIX=$PWD/build make -C src install $ cd .. Build nghttp2: .. code-block:: text $ git clone https://github.com/nghttp2/nghttp2 $ cd nghttp2 $ git submodule update --init $ autoreconf -i $ ./configure --with-mruby --enable-http3 --with-libbpf \ CC=clang-19 CXX=clang++-19 \ PKG_CONFIG_PATH="$PWD/../aws-lc/opt/lib/pkgconfig:$PWD/../nghttp3/build/lib/pkgconfig:$PWD/../ngtcp2/build/lib/pkgconfig:$PWD/../libbpf/build/lib64/pkgconfig" \ LDFLAGS="$LDFLAGS -Wl,-rpath,$PWD/../aws-lc/opt/lib -Wl,-rpath,$PWD/../libbpf/build/lib64" $ make -j$(nproc) The eBPF program ``reuseport_kern.o`` should be found under bpf directory. Pass ``--quic-bpf-program-file=bpf/reuseport_kern.o`` option to nghttpx to load it. See also `HTTP/3 section in nghttpx - HTTP/2 proxy - HOW-TO <https://nghttp2.org/documentation/nghttpx-howto.html#http-3>`_. Unit tests ---------- Unit tests are done by simply running ``make check``. Integration tests ----------------- We have the integration tests for the nghttpx proxy server. The tests are written in the `Go programming language <http://golang.org/>`_ and uses its testing framework. We depend on the following libraries: * golang.org/x/net/http2 * golang.org/x/net/websocket * https://github.com/tatsuhiro-t/go-nghttp2 Go modules will download these dependencies automatically. To run the tests, run the following command under ``integration-tests`` directory: .. code-block:: text $ make it Inside the tests, we use port 3009 to run the test subject server. Migration from v0.7.15 or earlier --------------------------------- nghttp2 v1.0.0 introduced several backward incompatible changes. In this section, we describe these changes and how to migrate to v1.0.0. ALPN protocol ID is now ``h2`` and ``h2c`` ++++++++++++++++++++++++++++++++++++++++++ Previously we announced ``h2-14`` and ``h2c-14``. v1.0.0 implements final protocol version, and we changed ALPN ID to ``h2`` and ``h2c``. The macros ``NGHTTP2_PROTO_VERSION_ID``, ``NGHTTP2_PROTO_VERSION_ID_LEN``, ``NGHTTP2_CLEARTEXT_PROTO_VERSION_ID``, and ``NGHTTP2_CLEARTEXT_PROTO_VERSION_ID_LEN`` have been updated to reflect this change. Basically, existing applications do not have to do anything, just recompiling is enough for this change. Use word "client magic" where we use "client connection preface" ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ We use "client connection preface" to mean first 24 bytes of client connection preface. This is technically not correct, since client connection preface is composed of 24 bytes client magic byte string followed by SETTINGS frame. For clarification, we call "client magic" for this 24 bytes byte string and updated API. * ``NGHTTP2_CLIENT_CONNECTION_PREFACE`` was replaced with ``NGHTTP2_CLIENT_MAGIC``. * ``NGHTTP2_CLIENT_CONNECTION_PREFACE_LEN`` was replaced with ``NGHTTP2_CLIENT_MAGIC_LEN``. * ``NGHTTP2_BAD_PREFACE`` was renamed as ``NGHTTP2_BAD_CLIENT_MAGIC`` The already deprecated ``NGHTTP2_CLIENT_CONNECTION_HEADER`` and ``NGHTTP2_CLIENT_CONNECTION_HEADER_LEN`` were removed. If application uses these macros, just replace old ones with new ones. Since v1.0.0, client magic is sent by library (see next subsection), so client application may just remove these macro use. Client magic is sent by library +++++++++++++++++++++++++++++++ Previously nghttp2 library did not send client magic, which is first 24 bytes byte string of client connection preface, and client applications have to send it by themselves. Since v1.0.0, client magic is sent by library via first call of ``nghttp2_session_send()`` or ``nghttp2_session_mem_send2()``. The client applications which send client magic must remove the relevant code. Remove HTTP Alternative Services (Alt-Svc) related code +++++++++++++++++++++++++++++++++++++++++++++++++++++++ Alt-Svc specification is not finalized yet. To make our API stable, we have decided to remove all Alt-Svc related API from nghttp2. * ``NGHTTP2_EXT_ALTSVC`` was removed. * ``nghttp2_ext_altsvc`` was removed. We have already removed the functionality of Alt-Svc in v0.7 series and they have been essentially noop. The application using these macro and struct, remove those lines. Use nghttp2_error in nghttp2_on_invalid_frame_recv_callback +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Previously ``nghttp2_on_invalid_frame_recv_cb_called`` took the ``error_code``, defined in ``nghttp2_error_code``, as parameter. But they are not detailed enough to debug. Therefore, we decided to use more detailed ``nghttp2_error`` values instead. The application using this callback should update the callback signature. If it treats ``error_code`` as HTTP/2 error code, update the code so that it is treated as ``nghttp2_error``. Receive client magic by default +++++++++++++++++++++++++++++++ Previously nghttp2 did not process client magic (24 bytes byte string). To make it deal with it, we had to use ``nghttp2_option_set_recv_client_preface()``. Since v1.0.0, nghttp2 processes client magic by default and ``nghttp2_option_set_recv_client_preface()`` was removed. Some application may want to disable this behaviour, so we added ``nghttp2_option_set_no_recv_client_magic()`` to achieve this. The application using ``nghttp2_option_set_recv_client_preface()`` with nonzero value, just remove it. The application using ``nghttp2_option_set_recv_client_preface()`` with zero value or not using it must use ``nghttp2_option_set_no_recv_client_magic()`` with nonzero value. Client, Server and Proxy programs --------------------------------- The ``src`` directory contains the HTTP/2 client, server and proxy programs. nghttp - client +++++++++++++++ ``nghttp`` is a HTTP/2 client. It can connect to the HTTP/2 server with prior knowledge, HTTP Upgrade and ALPN TLS extension. It has verbose output mode for framing information. Here is sample output from ``nghttp`` client: .. code-block:: text $ nghttp -nv https://nghttp2.org [ 0.190] Connected The negotiated protocol: h2 [ 0.212] recv SETTINGS frame <length=12, flags=0x00, stream_id=0> (niv=2) [SETTINGS_MAX_CONCURRENT_STREAMS(0x03):100] [SETTINGS_INITIAL_WINDOW_SIZE(0x04):65535] [ 0.212] send SETTINGS frame <length=12, flags=0x00, stream_id=0> (niv=2) [SETTINGS_MAX_CONCURRENT_STREAMS(0x03):100] [SETTINGS_INITIAL_WINDOW_SIZE(0x04):65535] [ 0.212] send SETTINGS frame <length=0, flags=0x01, stream_id=0> ; ACK (niv=0) [ 0.212] send PRIORITY frame <length=5, flags=0x00, stream_id=3> (dep_stream_id=0, weight=201, exclusive=0) [ 0.212] send PRIORITY frame <length=5, flags=0x00, stream_id=5> (dep_stream_id=0, weight=101, exclusive=0) [ 0.212] send PRIORITY frame <length=5, flags=0x00, stream_id=7> (dep_stream_id=0, weight=1, exclusive=0) [ 0.212] send PRIORITY frame <length=5, flags=0x00, stream_id=9> (dep_stream_id=7, weight=1, exclusive=0) [ 0.212] send PRIORITY frame <length=5, flags=0x00, stream_id=11> (dep_stream_id=3, weight=1, exclusive=0) [ 0.212] send HEADERS frame <length=39, flags=0x25, stream_id=13> ; END_STREAM | END_HEADERS | PRIORITY (padlen=0, dep_stream_id=11, weight=16, exclusive=0) ; Open new stream :method: GET :path: / :scheme: https :authority: nghttp2.org accept: */* accept-encoding: gzip, deflate user-agent: nghttp2/1.0.1-DEV [ 0.221] recv SETTINGS frame <length=0, flags=0x01, stream_id=0> ; ACK (niv=0) [ 0.221] recv (stream_id=13) :method: GET [ 0.221] recv (stream_id=13) :scheme: https [ 0.221] recv (stream_id=13) :path: /stylesheets/screen.css [ 0.221] recv (stream_id=13) :authority: nghttp2.org [ 0.221] recv (stream_id=13) accept-encoding: gzip, deflate [ 0.222] recv (stream_id=13) user-agent: nghttp2/1.0.1-DEV [ 0.222] recv PUSH_PROMISE frame <length=50, flags=0x04, stream_id=13> ; END_HEADERS (padlen=0, promised_stream_id=2) [ 0.222] recv (stream_id=13) :status: 200 [ 0.222] recv (stream_id=13) date: Thu, 21 May 2015 16:38:14 GMT [ 0.222] recv (stream_id=13) content-type: text/html [ 0.222] recv (stream_id=13) last-modified: Fri, 15 May 2015 15:38:06 GMT [ 0.222] recv (stream_id=13) etag: W/"555612de-19f6" [ 0.222] recv (stream_id=13) link: </stylesheets/screen.css>; rel=preload; as=stylesheet [ 0.222] recv (stream_id=13) content-encoding: gzip [ 0.222] recv (stream_id=13) server: nghttpx nghttp2/1.0.1-DEV [ 0.222] recv (stream_id=13) via: 1.1 nghttpx [ 0.222] recv (stream_id=13) strict-transport-security: max-age=31536000 [ 0.222] recv HEADERS frame <length=166, flags=0x04, stream_id=13> ; END_HEADERS (padlen=0) ; First response header [ 0.222] recv DATA frame <length=2601, flags=0x01, stream_id=13> ; END_STREAM [ 0.222] recv (stream_id=2) :status: 200 [ 0.222] recv (stream_id=2) date: Thu, 21 May 2015 16:38:14 GMT [ 0.222] recv (stream_id=2) content-type: text/css [ 0.222] recv (stream_id=2) last-modified: Fri, 15 May 2015 15:38:06 GMT [ 0.222] recv (stream_id=2) etag: W/"555612de-9845" [ 0.222] recv (stream_id=2) content-encoding: gzip [ 0.222] recv (stream_id=2) server: nghttpx nghttp2/1.0.1-DEV [ 0.222] recv (stream_id=2) via: 1.1 nghttpx [ 0.222] recv (stream_id=2) strict-transport-security: max-age=31536000 [ 0.222] recv HEADERS frame <length=32, flags=0x04, stream_id=2> ; END_HEADERS (padlen=0) ; First push response header [ 0.228] recv DATA frame <length=8715, flags=0x01, stream_id=2> ; END_STREAM [ 0.228] send GOAWAY frame <length=8, flags=0x00, stream_id=0> (last_stream_id=2, error_code=NO_ERROR(0x00), opaque_data(0)=[]) The HTTP Upgrade is performed like so: .. code-block:: text $ nghttp -nvu http://nghttp2.org [ 0.011] Connected [ 0.011] HTTP Upgrade request GET / HTTP/1.1 Host: nghttp2.org Connection: Upgrade, HTTP2-Settings Upgrade: h2c HTTP2-Settings: AAMAAABkAAQAAP__ Accept: */* User-Agent: nghttp2/1.0.1-DEV [ 0.018] HTTP Upgrade response HTTP/1.1 101 Switching Protocols Connection: Upgrade Upgrade: h2c [ 0.018] HTTP Upgrade success [ 0.018] recv SETTINGS frame <length=12, flags=0x00, stream_id=0> (niv=2) [SETTINGS_MAX_CONCURRENT_STREAMS(0x03):100] [SETTINGS_INITIAL_WINDOW_SIZE(0x04):65535] [ 0.018] send SETTINGS frame <length=12, flags=0x00, stream_id=0> (niv=2) [SETTINGS_MAX_CONCURRENT_STREAMS(0x03):100] [SETTINGS_INITIAL_WINDOW_SIZE(0x04):65535] [ 0.018] send SETTINGS frame <length=0, flags=0x01, stream_id=0> ; ACK (niv=0) [ 0.018] send PRIORITY frame <length=5, flags=0x00, stream_id=3> (dep_stream_id=0, weight=201, exclusive=0) [ 0.018] send PRIORITY frame <length=5, flags=0x00, stream_id=5> (dep_stream_id=0, weight=101, exclusive=0) [ 0.018] send PRIORITY frame <length=5, flags=0x00, stream_id=7> (dep_stream_id=0, weight=1, exclusive=0) [ 0.018] send PRIORITY frame <length=5, flags=0x00, stream_id=9> (dep_stream_id=7, weight=1, exclusive=0) [ 0.018] send PRIORITY frame <length=5, flags=0x00, stream_id=11> (dep_stream_id=3, weight=1, exclusive=0) [ 0.018] send PRIORITY frame <length=5, flags=0x00, stream_id=1> (dep_stream_id=11, weight=16, exclusive=0) [ 0.019] recv (stream_id=1) :method: GET [ 0.019] recv (stream_id=1) :scheme: http [ 0.019] recv (stream_id=1) :path: /stylesheets/screen.css [ 0.019] recv (stream_id=1) host: nghttp2.org [ 0.019] recv (stream_id=1) user-agent: nghttp2/1.0.1-DEV [ 0.019] recv PUSH_PROMISE frame <length=49, flags=0x04, stream_id=1> ; END_HEADERS (padlen=0, promised_stream_id=2) [ 0.019] recv (stream_id=1) :status: 200 [ 0.019] recv (stream_id=1) date: Thu, 21 May 2015 16:39:16 GMT [ 0.019] recv (stream_id=1) content-type: text/html [ 0.019] recv (stream_id=1) content-length: 6646 [ 0.019] recv (stream_id=1) last-modified: Fri, 15 May 2015 15:38:06 GMT [ 0.019] recv (stream_id=1) etag: "555612de-19f6" [ 0.019] recv (stream_id=1) link: </stylesheets/screen.css>; rel=preload; as=stylesheet [ 0.019] recv (stream_id=1) accept-ranges: bytes [ 0.019] recv (stream_id=1) server: nghttpx nghttp2/1.0.1-DEV [ 0.019] recv (stream_id=1) via: 1.1 nghttpx [ 0.019] recv HEADERS frame <length=157, flags=0x04, stream_id=1> ; END_HEADERS (padlen=0) ; First response header [ 0.019] recv DATA frame <length=6646, flags=0x01, stream_id=1> ; END_STREAM [ 0.019] recv (stream_id=2) :status: 200 [ 0.019] recv (stream_id=2) date: Thu, 21 May 2015 16:39:16 GMT [ 0.019] recv (stream_id=2) content-type: text/css [ 0.019] recv (stream_id=2) content-length: 38981 [ 0.019] recv (stream_id=2) last-modified: Fri, 15 May 2015 15:38:06 GMT [ 0.019] recv (stream_id=2) etag: "555612de-9845" [ 0.019] recv (stream_id=2) accept-ranges: bytes [ 0.019] recv (stream_id=2) server: nghttpx nghttp2/1.0.1-DEV [ 0.019] recv (stream_id=2) via: 1.1 nghttpx [ 0.019] recv HEADERS frame <length=36, flags=0x04, stream_id=2> ; END_HEADERS (padlen=0) ; First push response header [ 0.026] recv DATA frame <length=16384, flags=0x00, stream_id=2> [ 0.027] recv DATA frame <length=7952, flags=0x00, stream_id=2> [ 0.027] send WINDOW_UPDATE frame <length=4, flags=0x00, stream_id=0> (window_size_increment=33343) [ 0.032] send WINDOW_UPDATE frame <length=4, flags=0x00, stream_id=2> (window_size_increment=33707) [ 0.032] recv DATA frame <length=14645, flags=0x01, stream_id=2> ; END_STREAM [ 0.032] recv SETTINGS frame <length=0, flags=0x01, stream_id=0> ; ACK (niv=0) [ 0.032] send GOAWAY frame <length=8, flags=0x00, stream_id=0> (last_stream_id=2, error_code=NO_ERROR(0x00), opaque_data(0)=[]) Using the ``-s`` option, ``nghttp`` prints out some timing information for requests, sorted by completion time: .. code-block:: text $ nghttp -nas https://nghttp2.org/ ***** Statistics ***** Request timing: responseEnd: the time when last byte of response was received relative to connectEnd requestStart: the time just before first byte of request was sent relative to connectEnd. If '*' is shown, this was pushed by server. process: responseEnd - requestStart code: HTTP status code size: number of bytes received as response body without inflation. URI: request URI see http://www.w3.org/TR/resource-timing/#processing-model sorted by 'complete' id responseEnd requestStart process code size request path 13 +37.19ms +280us 36.91ms 200 2K / 2 +72.65ms * +36.38ms 36.26ms 200 8K /stylesheets/screen.css 17 +77.43ms +38.67ms 38.75ms 200 3K /javascripts/octopress.js 15 +78.12ms +38.66ms 39.46ms 200 3K /javascripts/modernizr-2.0.js Using the ``-r`` option, ``nghttp`` writes more detailed timing data to the given file in HAR format. nghttpd - server ++++++++++++++++ ``nghttpd`` is a multi-threaded static web server. By default, it uses SSL/TLS connection. Use ``--no-tls`` option to disable it. ``nghttpd`` only accepts HTTP/2 connections via ALPN or direct HTTP/2 connections. No HTTP Upgrade is supported. The ``-p`` option allows users to configure server push. Just like ``nghttp``, it has a verbose output mode for framing information. Here is sample output from ``nghttpd``: .. code-block:: text $ nghttpd --no-tls -v 8080 IPv4: listen 0.0.0.0:8080 IPv6: listen :::8080 [id=1] [ 1.521] send SETTINGS frame <length=6, flags=0x00, stream_id=0> (niv=1) [SETTINGS_MAX_CONCURRENT_STREAMS(0x03):100] [id=1] [ 1.521] recv SETTINGS frame <length=12, flags=0x00, stream_id=0> (niv=2) [SETTINGS_MAX_CONCURRENT_STREAMS(0x03):100] [SETTINGS_INITIAL_WINDOW_SIZE(0x04):65535] [id=1] [ 1.521] recv SETTINGS frame <length=0, flags=0x01, stream_id=0> ; ACK (niv=0) [id=1] [ 1.521] recv PRIORITY frame <length=5, flags=0x00, stream_id=3> (dep_stream_id=0, weight=201, exclusive=0) [id=1] [ 1.521] recv PRIORITY frame <length=5, flags=0x00, stream_id=5> (dep_stream_id=0, weight=101, exclusive=0) [id=1] [ 1.521] recv PRIORITY frame <length=5, flags=0x00, stream_id=7> (dep_stream_id=0, weight=1, exclusive=0) [id=1] [ 1.521] recv PRIORITY frame <length=5, flags=0x00, stream_id=9> (dep_stream_id=7, weight=1, exclusive=0) [id=1] [ 1.521] recv PRIORITY frame <length=5, flags=0x00, stream_id=11> (dep_stream_id=3, weight=1, exclusive=0) [id=1] [ 1.521] recv (stream_id=13) :method: GET [id=1] [ 1.521] recv (stream_id=13) :path: / [id=1] [ 1.521] recv (stream_id=13) :scheme: http [id=1] [ 1.521] recv (stream_id=13) :authority: localhost:8080 [id=1] [ 1.521] recv (stream_id=13) accept: */* [id=1] [ 1.521] recv (stream_id=13) accept-encoding: gzip, deflate [id=1] [ 1.521] recv (stream_id=13) user-agent: nghttp2/1.0.0-DEV [id=1] [ 1.521] recv HEADERS frame <length=41, flags=0x25, stream_id=13> ; END_STREAM | END_HEADERS | PRIORITY (padlen=0, dep_stream_id=11, weight=16, exclusive=0) ; Open new stream [id=1] [ 1.521] send SETTINGS frame <length=0, flags=0x01, stream_id=0> ; ACK (niv=0) [id=1] [ 1.521] send HEADERS frame <length=86, flags=0x04, stream_id=13> ; END_HEADERS (padlen=0) ; First response header :status: 200 server: nghttpd nghttp2/1.0.0-DEV content-length: 10 cache-control: max-age=3600 date: Fri, 15 May 2015 14:49:04 GMT last-modified: Tue, 30 Sep 2014 12:40:52 GMT [id=1] [ 1.522] send DATA frame <length=10, flags=0x01, stream_id=13> ; END_STREAM [id=1] [ 1.522] stream_id=13 closed [id=1] [ 1.522] recv GOAWAY frame <length=8, flags=0x00, stream_id=0> (last_stream_id=0, error_code=NO_ERROR(0x00), opaque_data(0)=[]) [id=1] [ 1.522] closed nghttpx - proxy +++++++++++++++ ``nghttpx`` is a multi-threaded reverse proxy for HTTP/3, HTTP/2, and HTTP/1.1, and powers http://nghttp2.org and supports HTTP/2 server push. We reworked ``nghttpx`` command-line interface, and as a result, there are several incompatibles from 1.8.0 or earlier. This is necessary to extend its capability, and secure the further feature enhancements in the future release. Please read `Migration from nghttpx v1.8.0 or earlier <https://nghttp2.org/documentation/nghttpx-howto.html#migration-from-nghttpx-v1-8-0-or-earlier>`_ to know how to migrate from earlier releases. ``nghttpx`` implements `important performance-oriented features <https://istlsfastyet.com/#server-performance>`_ in TLS, such as session IDs, session tickets (with automatic key rotation), dynamic record sizing, ALPN, forward secrecy and HTTP/2. ``nghttpx`` also offers the functionality to share ticket keys among multiple ``nghttpx`` instances via memcached. ``nghttpx`` has 2 operation modes: ================== ======================== ================ ============= Mode option Frontend Backend Note ================== ======================== ================ ============= default mode HTTP/3, HTTP/2, HTTP/1.1 HTTP/1.1, HTTP/2 Reverse proxy ``--http2-proxy`` HTTP/3, HTTP/2, HTTP/1.1 HTTP/1.1, HTTP/2 Forward proxy ================== ======================== ================ ============= The interesting mode at the moment is the default mode. It works like a reverse proxy and listens for HTTP/3, HTTP/2, and HTTP/1.1 and can be deployed as a SSL/TLS terminator for existing web server. In all modes, the frontend connections are encrypted by SSL/TLS by default. To disable encryption, use the ``no-tls`` keyword in ``--frontend`` option. If encryption is disabled, incoming HTTP/1.1 connections can be upgraded to HTTP/2 through HTTP Upgrade. On the other hard, backend connections are not encrypted by default. To encrypt backend connections, use ``tls`` keyword in ``--backend`` option. ``nghttpx`` supports a configuration file. See the ``--conf`` option and sample configuration file ``nghttpx.conf.sample``. In the default mode, ``nghttpx`` works as reverse proxy to the backend server: .. code-block:: text Client <-- (HTTP/3, HTTP/2, HTTP/1.1) --> nghttpx <-- (HTTP/1.1, HTTP/2) --> Web Server [reverse proxy] With the ``--http2-proxy`` option, it works as forward proxy, and it is so called secure HTTP/2 proxy: .. code-block:: text Client <-- (HTTP/3, HTTP/2, HTTP/1.1) --> nghttpx <-- (HTTP/1.1) --> Proxy [secure proxy] (e.g., Squid, ATS) The ``Client`` in the above example needs to be configured to use ``nghttpx`` as secure proxy. At the time of this writing, both Chrome and Firefox support secure HTTP/2 proxy. One way to configure Chrome to use a secure proxy is to create a proxy.pac script like this: .. code-block:: javascript function FindProxyForURL(url, host) { return "HTTPS SERVERADDR:PORT"; } ``SERVERADDR`` and ``PORT`` is the hostname/address and port of the machine nghttpx is running on. Please note that Chrome requires a valid certificate for secure proxy. Then run Chrome with the following arguments: .. code-block:: text $ google-chrome --proxy-pac-url=file:///path/to/proxy.pac --use-npn The backend HTTP/2 connections can be tunneled through an HTTP proxy. The proxy is specified using ``--backend-http-proxy-uri``. The following figure illustrates how nghttpx talks to the outside HTTP/2 proxy through an HTTP proxy: .. code-block:: text Client <-- (HTTP/3, HTTP/2, HTTP/1.1) --> nghttpx <-- (HTTP/2) -- --===================---> HTTP/2 Proxy (HTTP proxy tunnel) (e.g., nghttpx -s) Benchmarking tool ----------------- The ``h2load`` program is a benchmarking tool for HTTP/3, HTTP/2, and HTTP/1.1. The UI of ``h2load`` is heavily inspired by ``weighttp`` (https://github.com/lighttpd/weighttp). The typical usage is as follows: .. code-block:: text $ h2load -n100000 -c100 -m100 https://localhost:8443/ starting benchmark... spawning thread #0: 100 concurrent clients, 100000 total requests Protocol: TLSv1.2 Cipher: ECDHE-RSA-AES128-GCM-SHA256 Server Temp Key: ECDH P-256 256 bits progress: 10% done progress: 20% done progress: 30% done progress: 40% done progress: 50% done progress: 60% done progress: 70% done progress: 80% done progress: 90% done progress: 100% done finished in 771.26ms, 129658 req/s, 4.71MB/s requests: 100000 total, 100000 started, 100000 done, 100000 succeeded, 0 failed, 0 errored status codes: 100000 2xx, 0 3xx, 0 4xx, 0 5xx traffic: 3812300 bytes total, 1009900 bytes headers, 1000000 bytes data min max mean sd +/- sd time for request: 25.12ms 124.55ms 51.07ms 15.36ms 84.87% time for connect: 208.94ms 254.67ms 241.38ms 7.95ms 63.00% time to 1st byte: 209.11ms 254.80ms 241.51ms 7.94ms 63.00% The above example issued total 100,000 requests, using 100 concurrent clients (in other words, 100 HTTP/2 sessions), and a maximum of 100 streams per client. With the ``-t`` option, ``h2load`` will use multiple native threads to avoid saturating a single core on client side. .. warning:: **Don't use this tool against publicly available servers.** That is considered a DOS attack. Please only use it against your private servers. If the experimental HTTP/3 is enabled, h2load can send requests to HTTP/3 server. To do this, use ``--h3`` option (or ``--alpn-list=h3`` option) like so: .. code-block:: text $ h2load --h3 https://127.0.0.1:4433 For nghttp2 v1.58 or earlier, use ``--npn-list`` instead of ``--alpn-list``. HPACK tools ----------- The ``src`` directory contains the HPACK tools. The ``deflatehd`` program is a command-line header compression tool. The ``inflatehd`` program is a command-line header decompression tool. Both tools read input from stdin and write output to stdout. Errors are written to stderr. They take JSON as input and output. We (mostly) use the same JSON data format described at https://github.com/http2jp/hpack-test-case. deflatehd - header compressor +++++++++++++++++++++++++++++ The ``deflatehd`` program reads JSON data or HTTP/1-style header fields from stdin and outputs compressed header block in JSON. For the JSON input, the root JSON object must include a ``cases`` key. Its value has to include the sequence of input header set. They share the same compression context and are processed in the order they appear. Each item in the sequence is a JSON object and it must include a ``headers`` key. Its value is an array of JSON objects, which includes exactly one name/value pair. Example: .. code-block:: json { "cases": [ { "headers": [ { ":method": "GET" }, { ":path": "/" } ] }, { "headers": [ { ":method": "POST" }, { ":path": "/" } ] } ] } With the ``-t`` option, the program can accept more familiar HTTP/1 style header field blocks. Each header set is delimited by an empty line: Example: .. code-block:: text :method: GET :scheme: https :path: / :method: POST user-agent: nghttp2 The output is in JSON object. It should include a ``cases`` key and its value is an array of JSON objects, which has at least the following keys: seq The index of header set in the input. input_length The sum of the length of the name/value pairs in the input. output_length The length of the compressed header block. percentage_of_original_size ``output_length`` / ``input_length`` * 100 wire The compressed header block as a hex string. headers The input header set. header_table_size The header table size adjusted before deflating the header set. Examples: .. code-block:: json { "cases": [ { "seq": 0, "input_length": 66, "output_length": 20, "percentage_of_original_size": 30.303030303030305, "wire": "01881f3468e5891afcbf83868a3d856659c62e3f", "headers": [ { ":authority": "example.org" }, { ":method": "GET" }, { ":path": "/" }, { ":scheme": "https" }, { "user-agent": "nghttp2" } ], "header_table_size": 4096 } , { "seq": 1, "input_length": 74, "output_length": 10, "percentage_of_original_size": 13.513513513513514, "wire": "88448504252dd5918485", "headers": [ { ":authority": "example.org" }, { ":method": "POST" }, { ":path": "/account" }, { ":scheme": "https" }, { "user-agent": "nghttp2" } ], "header_table_size": 4096 } ] } The output can be used as the input for ``inflatehd`` and ``deflatehd``. With the ``-d`` option, the extra ``header_table`` key is added and its associated value includes the state of dynamic header table after the corresponding header set was processed. The value includes at least the following keys: entries The entry in the header table. If ``referenced`` is ``true``, it is in the reference set. The ``size`` includes the overhead (32 bytes). The ``index`` corresponds to the index of header table. The ``name`` is the header field name and the ``value`` is the header field value. size The sum of the spaces entries occupied, this includes the entry overhead. max_size The maximum header table size. deflate_size The sum of the spaces entries occupied within ``max_deflate_size``. max_deflate_size The maximum header table size the encoder uses. This can be smaller than ``max_size``. In this case, the encoder only uses up to first ``max_deflate_size`` buffer. Since the header table size is still ``max_size``, the encoder has to keep track of entries outside the ``max_deflate_size`` but inside the ``max_size`` and make sure that they are no longer referenced. Example: .. code-block:: json { "cases": [ { "seq": 0, "input_length": 66, "output_length": 20, "percentage_of_original_size": 30.303030303030305, "wire": "01881f3468e5891afcbf83868a3d856659c62e3f", "headers": [ { ":authority": "example.org" }, { ":method": "GET" }, { ":path": "/" }, { ":scheme": "https" }, { "user-agent": "nghttp2" } ], "header_table_size": 4096, "header_table": { "entries": [ { "index": 1, "name": "user-agent", "value": "nghttp2", "referenced": true, "size": 49 }, { "index": 2, "name": ":scheme", "value": "https", "referenced": true, "size": 44 }, { "index": 3, "name": ":path", "value": "/", "referenced": true, "size": 38 }, { "index": 4, "name": ":method", "value": "GET", "referenced": true, "size": 42 }, { "index": 5, "name": ":authority", "value": "example.org", "referenced": true, "size": 53 } ], "size": 226, "max_size": 4096, "deflate_size": 226, "max_deflate_size": 4096 } } , { "seq": 1, "input_length": 74, "output_length": 10, "percentage_of_original_size": 13.513513513513514, "wire": "88448504252dd5918485", "headers": [ { ":authority": "example.org" }, { ":method": "POST" }, { ":path": "/account" }, { ":scheme": "https" }, { "user-agent": "nghttp2" } ], "header_table_size": 4096, "header_table": { "entries": [ { "index": 1, "name": ":method", "value": "POST", "referenced": true, "size": 43 }, { "index": 2, "name": "user-agent", "value": "nghttp2", "referenced": true, "size": 49 }, { "index": 3, "name": ":scheme", "value": "https", "referenced": true, "size": 44 }, { "index": 4, "name": ":path", "value": "/", "referenced": false, "size": 38 }, { "index": 5, "name": ":method", "value": "GET", "referenced": false, "size": 42 }, { "index": 6, "name": ":authority", "value": "example.org", "referenced": true, "size": 53 } ], "size": 269, "max_size": 4096, "deflate_size": 269, "max_deflate_size": 4096 } } ] } inflatehd - header decompressor +++++++++++++++++++++++++++++++ The ``inflatehd`` program reads JSON data from stdin and outputs decompressed name/value pairs in JSON. The root JSON object must include the ``cases`` key. Its value has to include the sequence of compressed header blocks. They share the same compression context and are processed in the order they appear. Each item in the sequence is a JSON object and it must have at least a ``wire`` key. Its value is a compressed header block as a hex string. Example: .. code-block:: json { "cases": [ { "wire": "8285" }, { "wire": "8583" } ] } The output is a JSON object. It should include a ``cases`` key and its value is an array of JSON objects, which has at least following keys: seq The index of the header set in the input. headers A JSON array that includes decompressed name/value pairs. wire The compressed header block as a hex string. header_table_size The header table size adjusted before inflating compressed header block. Example: .. code-block:: json { "cases": [ { "seq": 0, "wire": "01881f3468e5891afcbf83868a3d856659c62e3f", "headers": [ { ":authority": "example.org" }, { ":method": "GET" }, { ":path": "/" }, { ":scheme": "https" }, { "user-agent": "nghttp2" } ], "header_table_size": 4096 } , { "seq": 1, "wire": "88448504252dd5918485", "headers": [ { ":method": "POST" }, { ":path": "/account" }, { "user-agent": "nghttp2" }, { ":scheme": "https" }, { ":authority": "example.org" } ], "header_table_size": 4096 } ] } The output can be used as the input for ``deflatehd`` and ``inflatehd``. With the ``-d`` option, the extra ``header_table`` key is added and its associated value includes the state of the dynamic header table after the corresponding header set was processed. The format is the same as ``deflatehd``. Contribution ------------ [This text was composed based on 1.2. License section of curl/libcurl project.] When contributing with code, you agree to put your changes and new code under the same license nghttp2 is already using unless stated and agreed otherwise. When changing existing source code, do not alter the copyright of the original file(s). The copyright will still be owned by the original creator(s) or those who have been assigned copyright by the original author(s). By submitting a patch to the nghttp2 project, you (or your employer, as the case may be) agree to assign the copyright of your submission to us. .. the above really needs to be reworded to pass legal muster. We will credit you for your changes as far as possible, to give credit but also to keep a trace back to who made what changes. Please always provide us with your full real name when contributing! See `Contribution Guidelines <https://nghttp2.org/documentation/contribute.html>`_ for more details. Versioning ---------- In general, we follow `Semantic Versioning <http://semver.org/>`_. We may release PATCH releases between the regular releases, mainly for severe security bug fixes. We have no plan to break API compatibility changes involving soname bump, so MAJOR version will stay 1 for the foreseeable future. License ------- The MIT License PK �M�\T?Ц � & licenses/alt-openldap11-2.4.46/LICENSEnu �[��� PK �M�\`)��) ) ( � licenses/alt-openldap11-2.4.46/COPYRIGHTnu �[��� PK �M�\�"l��B �B } man/man5/ldap.conf.5nu �[��� PK �M�\��lN N �U man/man5/ldif.5nu �[��� PK �M�\C���k �k ! %p doc/alt-openldap11-2.4.46/CHANGESnu �[��� PK �M�\�ѥ� � & s� doc/alt-openldap11-2.4.46/ANNOUNCEMENTnu �[��� PK �M�\�1�L� � �� doc/alt-openldap11-2.4.46/READMEnu �[��� PK �f�\���: �� doc/alt-libssh2-1.8.0/ChangeLognu �[��� PK �f�\���^ ^ � doc/alt-libssh2-1.8.0/COPYINGnu �[��� PK �f�\�Ee?� � � doc/alt-libssh2-1.8.0/READMEnu �[��� PK �f�\��G�N� N� � doc/alt-libssh2-1.8.0/NEWSnu �[��� PK ]h�\�� �� � ~� man/man1/nghttpd.1nu �[��� PK ]h�\���ܒc �c �� man/man1/nghttpx.1nu �[��� PK ]h�\��>(� � hP man/man1/nghttp.1nu �[��� PK ]h�\`)G�%= %= �k man/man1/h2load.1nu �[��� PK ]h�\�M��� �� �� doc/nghttp2/README.rstnu �[��� PK � �j
| ver. 1.4 |
Github
|
.
| PHP 8.2.32 | Generation time: 0.11 |
proxy
|
phpinfo
|
Settings