Upgrading NCSA httpd

httpd 1.3R -> httpd 1.4

The primary focus of release 1.4 of the NCSA httpd server is to improve performance.

Changes from httpd 1.3R

Two new configuration directives have been added: StartServers, MaxServers
Previously, the httpd server forked with each new request To reduce this overhead the NCSA httpd was modified to support a hunt group. A pool of servers (of size _StartServers_) is created initially. As the load increase additional servers are started as needed to the configured maximum (_MaxServers_). These servers remain in the server pool. If additional requests are received, new servers are forked which answer the request, and die in a similar fashion to previous standalone versions of the code. If you don't want to have a pool of servers at all, you can set up StartServers and MaxServers to 0. In this way, httpd's behavior will be similar to previous versions of the code in standalone form.
Introduced a new mail script: /cgi-bin/mail
Associated file: /cgi-bin/mail.list
This PERL script uses the sendmail binary and an authorized list of recipients to generate an email form for the users on your Web server. It should fulfill the mail needs of Web users everywhere currently asking about custom email scripts and mailto: for sending form results: If called directly, it will output a blank form to fill in, and sends the values to itself for mailing. If referenced in the ACTION line of a form, it will forward the FORM INPUT to the named recipient.
Configuration documentation is provided at the top of the script. Official documentation will be available soon.
Previously each forked child made initialization calls to retrieve information available to the parent. This information is now retrieved by the parent processed once and passed to all child processes.
Additional performance and memory management improvements internal to the server have been made.
Several string copies have been modified to prevent buffer overflows. This addresses the problem reported in CERT Advisory CA-95:04. The CERN suggestion of increasing the buffer size was not implemented because we took a different approach. We do not recommend blindly increasing the buffer sizes because this can cause excessive swapping and performance degredation.

The NCSA httpd 1.4 supports modifiable error messages for the following errors using a new server resource map directive, ErrorDocument.

Modifiable error messages
REDIRECT	302
BAD_REQUEST	400
AUTH_REQUIRED	401
FORBIDDEN	403
NOT_FOUND	404
SERVER_ERROR	500
NOT_IMPLEMENTED	501

Two new logs are supported, an agent log and a referral log. The agent log lists the identity of the requesting client. The referral log lists the URL containing the link to the requested document.
Three new configuration directives have been added: AgentLog, RefererLog, and RefererIgnore.

httpd 1.3 -> httpd 1.3R

Fixed the vulnerablity described in Cert Advisory CA-95:04. For more information, please read the description.

httpd 1.2 -> httpd 1.3

httpd 1.3 is a maintenance release designed to fix some of the bugs which were introduced in httpd 1.2.

Changes from httpd 1.2

Now compiles cleanly under A/UX and Solaris.
Directory indexing bugs repaired, new options to suppress last modified, size, and description columns (thanks Tanmoy.)
Wildcard based access control should work this time.
Fixed core dump related to recursive parsed document include.
Fixed bug by which httpd would not follow a symbolic link it should have.
Fixed file typing (no longer case sensitive like in 1.2.)
Parent directory escaped in indexes.
IdentityCheck should work again.
LAST_MODIFIED and #flastmod are now local zone.
Time related functions work with NeXT now.
Fixed spelling error in 500 error page.
Server will log proper timeout message for non-DNS hosts.
Added x-bit hack for people to use the x-bit of an HTML file to determine if it is parsed or not.
Added compile defines so people can customize the amount of DNS the server performs (for speed).

httpd 1.1 -> httpd 1.2

httpd 1.2 makes some significant changes over httpd 1.1. These changes make its "look and feel" a bit different than 1.1.

New features

The CGI interface is now revised to version 1.1. See the changes that were made.
A new logfile format was agreed upon which should simplify the lives of the authors of logfile analyzers. Quickly, the format is:
```
host rfc931 authuser [DD/Mon/YYYY:hh:mm:ss [+/-]HHMM] "request" status bytes
```
Host = hostname
rfc931 = RFC931 user name if IdentityCheck active, - if not.
authuser = HTTP/1.0 authenticated user, - if none.
DD/Mon/YYY:hh:mm:ss [+/-]HHMM: Local time of the request with timezone offset from GMT at end.
"request" = the request as sent by the client
status = the HTTP/1.0 status code from this transaction
bytes = the count of the bytes sent in this transaction, not including the header. If not applicable, this will be a - character.
CGI scripts are now allowed anywhere. See this tutorial on the new setup (and how it relates to the old setup), and how to disable this feature in places you don't want it.
The server side includes interface has been completely rewritten. See this tutorial to learn how to convert your old INC SRV documents, and to learn how to take advantage of the new features.
There is a new access control option to disable symbolic links only if the owner of the pointer is not the same as the owner of that which is pointed to. This means your users can have symbolic links to things they own, but not to dangerous things like /etc.
A new access control method called mutual-failure has been added. This method is a bit unorthodox, but allows you to allow hosts from one domain while excluding certain hosts (such as public access machines) from that domain.
Wildcard expressions are now allowed in various areas of server configuration, to allow patterns to be specified. This is most useful in the Directory directive.
Directory indexing has been revamped. It looks much different, and I've written a short tutorial on how to set it up.
Access Control Files now allow the indexing directives as well as the DefaultType directive.
require user now allows quotes for PGP usernames with spaces.
Server now explicitly kills CGI scripts when the client aborts.
Server now verifies the DNS hostname it gets from the IP number to prevent PTR spoofs.
Support for 304 and If-modified-since.

Bug fixes

All of the known bugs in 1.1 have now been fixed. Now it's time to find the ones I introduce with 1.2.

Fixed problem running scripts in ServerMode inetd under IRIX.
Fixed bad port problem under OSF/1.
Inserted missing return statement for the IdentityCheck directive.
Fixed problem whereby errors would stop being logged after a restart.
Fixed 256 character limitation on CGI URLs.

httpd 1.0 -> httpd 1.1

httpd 1.1 should plug right in if you already have httpd 1.0.

Introduced experimental PEM/PGP based encrypted user authentication. See this overview to read about trying it out.
Improved directory indexing. See the new directives in srm.conf to use it.
Cleaned up error output and fixed horrible output when server-side include error occurred
Fixed slight bug in buffering code
Directory indexing for user-supported directories fixed
Retrieval of user supported directory with no trailing slash issues redirect again
Now supports RFC931 identd for logging purposes. See the IdentityCheck directive.
stderr for scripts and server side includes now sent to error_log
Fixed bug in NCSA POST script code which would cause Location: to be ignored for local files
Removed misfeature wherein Location: url's were being escaped by the server
Args to INC SRVURL escaped to avoid unpleasant surprises
Location: /cgi-bin/foo?arg now works
HEAD only for CGI scripts now ignores body put out by stupid scripts

httpd 1.0a5 -> httpd1.0

httpd 1.0 is fairly similar to httpd 1.0a5.

Changes which directly require configuration changes

CGI script interface introduced
ScriptAlias now used for CGI scripts only, access your NCSA scripts with OldScriptAlias
Fixed AddType directive
The NCSA scripts are no longer included, CGI replacements are now included

Other changes

NCSA POST scripts now have REMOTE_HOST set
Added AddEncoding directive to srm.conf and .htaccess
error_log now logs all failed accesses and the reason for failure
Time headers are now RFC822 compliant
You can now alias or disable user-supported directories
Added a require directive to allow you to allow any valid user
I/O is now buffered into chunks for speed
Redirect no longer supported from .htaccess files.
Added -v and -f command line flags

httpd 1.0a4 -> httpd 1.0a5

Fixed horrible bug in 1.0a4

httpd 1.0a3 -> httpd 1.0a4

Introduced user authentication (Basic scheme)
Multiple script directories now supported
Fixed bug in http_request.c related to clients not sending a method
Fixed bug in http_request.c which caused DirectoryIndex to be ignored and index.html to be used anyway
Added overrule for mime types in srm.conf and access config. so the user doesn't have to edit mime.types
Requests for directories which do not come with a trailing slash and will return a prewritten index are now redirected to the same URL with a trailing slash
The HEAD method is now supported
Fixed a getline call which was hardcoded to 1024 instead of HUGE_STRING_LEN
Fixed problem in which a user could GET /~user/../../../ and gain access outside of DocumentRoot
httpd.conf split into two files: a server configuration and a document configuration file
Introduced Redirect directive which allows you to redirect clients to documents' new locations
Introduced htpasswd program for managing user authentication
Fixed problems in http_access.c where certain .htaccess files were ignored and some symlinks were being followed when they shouldn't have
Distribution now places config files as foo.conf-dist instead of foo.conf so it doesn't write over your old files
Config files now case insensitive
MIME header scans are now case insensitive per the RFC
Added server config. diretive Timeout to control the timeouts when listening to or writing to a client
Script execution now uses execl() instead of system() to eliminiate extra tmp files and to allow system() from scripts.
New document config. directive DefaultType for type of files which cannot be typed from filename
Script arguments now not touched: Added support program to decode them for shell scripts
Added support for the post method of accessing forms
Added support for "extra path" in script name
Fixed so that an un-executable script now returns FORBIDDEN instead of blank page
Spaces in content type returned from scripts no longer included, so include files now work from imagerect script.
Thanks to Arjan de Vet, script execution no longer uses system() or popen(), reducing chroot requirements as well as allowing scripts to use system().
Added DefaultType directive to define what type a document with an unknown or missing extension should be
Added Timeout directive to allow servers to choose the length of time a client is given to send a request and to recieve the data.
Added preliminary support for POST scripts, or more importantly, support for scripts which interpret the new form submission methods.
Scripts now do all of their own URL decoding, which can be done either with provided C code, or with the support program unescape
Scripts may now have extra path information after the script name, so allowing filters
Improved Imagerect Script
Allowed non-URL location returns from script to allow access control, user authentication, and typing (great idea, Ari).
Returning content-length and last-modified headers

httpd 1.0a2 -> httpd 1.0a3

.htaccess files now affect subdirectories
Added option FollowSymLinks for security
Fixed MAJOR bug in init_mime function
Enhanced Makefile and httpd.h for people compiling httpd themselves
Added env. vars DOCUMENT_ROOT and SERVER_NAME for scripts

httpd 1.0a1 -> httpd 1.0a2

Introduced support for HTTP/1.0 3xx redirection from server scripts
Introduced per-directory access by host and options control
Added flags for BSD 4.2 compatibility (no killpg and no setsid)
Enhanced documentation
Introduced support for server restart through SIGHUP
Fixed bug which caused system not to return port when httpd is done
Fixed bug which caused server to go into infinite spin with GET /htbin
Bug in directory indexing repaired (thanks to neal@ctd.comsat.com).
Added timeout while sending data to client so as to alleviate zombie servers laying around when the client drops.

httpd 0.5 -> httpd 1.0a1

Introduced server scripts
Server scripts for a variety of UNIX commands like archie added
Server-side forms handling scripts added
Image rectangling scripts added
Introduced more extensible configuration file format
Server now replies to HTTP/1.0 clients in HTTP/1.0 format
Introduced MIME data type determination on the fly
Improved logging of client access as well as server errors
Major internal reworking
Added timeout for clients that disconnect
Added server include files

httpd 0.4beta -> httpd 0.5

Introduced standalone support
Final release for gopher support and experimental group annotation support
No reported outstanding bugs

httpd 0.3beta -> httpd 0.4beta

Introduced experimental group annotation support
Introduced access logging
Introduced HTTP/1.0 tolerance
Handling of full hostnames added
Bug fixed with index.html not being recognized without a trailing slash
Fixed bug with extraneous character being added to the end of the data stream
Fixed bug handling directory URL's with trailing slashes
Made a little more friendly to Ultrix's brain death

httpd 0.2beta -> httpd 0.3beta

Introduced drop-in gopher support
Fixed security hole
Not being able to find the config file does not send back a path

httpd 0.2beta

Two security holes fixed
Double slashes in index of root fixed
Not being able to find error files no longer hangs the server

[Back] Return to Overview

NCSA httpd Development Team

httpd@ncsa.uiuc.edu