#
# sh-httpd usage notes
# 


Filenames (the 'base' URL before any ?, including any extra path info)
are restricted to alphanumerics, and a limited set of extra characters,
currently: /-_.=+,

The base URL is also not de-escaped.  Note that this could be done in
shell script, but it would be akward, presents security issues, and is
kind of pointless with the limited filename character set supported above.

Query string data is limited to the same set of characters when used as
command line parameters.  If illegal characters are found, the CGI program
is still run, but no command-line arguments are passed.  The full text
query string still exists as the environment variable QUERY_STRING, and
may be parsed by the CGI program.

Currently, URL's are not checked to see if they are files or directories.
If a URL ends with a slash '/', it is assumed to be a directory, and index
files are checked for.  If a URL does NOT end in a slash, it is assumed to
be a file and an error will be returned if it is actually a directory.


#
# Bugs and Oddities
# 


Probably exist...


#
# Config File Details:
#


SERVER_NAME=lrptest.steinkuehler.net
SERVER_ADDR=208.189.96.11
SERVER_PORT=8008

You have to tell the server it's local IP address, port, and name. If your
server does not have a resolvable DNS name, set SERVER_NAME to the IP
address.


CLIENT_ADDRS=""

A space seperated list of IP addresses allowed to access the server. Each
pattern is matched against the start of the numeric IP address of the
client,  so you may use a 'prefix' (ie 192.168. will match anything in the
192.168.0.0/16 network, but will NOT match 1.192.168.2).  Be VERY careful
here.  Since text pattern matching is used, there can be unexpected
consequences (ie  10 matches 10.0.0.0/8, but it also matches 100.x.x.x -
109.x.x.x).  To prevent  this, specify prefix patterns with trailing dots
(ie use 10. in the previous  example).  If this pattern is empty or null,
no IP checking is performed


DEFCONTENT="text/plain"

This is the assumed document type if a filename does not match one of the 
known content types.  Content types are specified in the MIME_TYPES
file(s) (see the next section).


MIME_TYPES="mime-types /etc/sh-httpd.mime"

A space seperated list of file names to read mime-type information from.
Each file line should contain a file suffix at the start of the line,
whitespace  (space or tab), and a mime-type.  The file suffix is the
result of the  expansion ${filename##*.}  If no matching suffix is found,
DEFCONTENT is used. If more than one matching suffix is located, the first
one found is used. Files are scanned in the order listed (ie: with the
above setting, mime-types is scanned first, followed by
/etc/sh-httpd.mime).

If a filename is not absolute (mime-types, above) the file is read from
the same directory as the requested document, allowing mime-types to vary
on a  directory-by-directory basis.  


DOCROOT=/usr/local/sh-www

This is the base location of all your web files.  No access by URL is
available outside this directory (ie http://server/../ will return a 403).
CGI scripts can still see the whole directory structure.


LOGFILE=/usr/local/sbin/log

Location for the log file.  The log must be writable by the user sh-httpd
runs as (typically nobody or sh-httpd).  If this is unset or null, logging
is disabled.


DEFINDEX="index.html index.htm index.cgi"

A space seperated list of filenames to try if a directory was specified.
These are tried in order, so put the most common filename first.


SCRIPT_ALIAS="/cgi-bin"

A space seperated list of patterns which are tested against the start of
the requested URL.  If any of the patterns match, the URL is parsed as
follows: $SCRIPT_ALIAS*/<cgi-script>/<extra-path-info>

Note that there should be no trailing slash in the pattern specification,
and the pattern is automatically extended to the next slash.  This means a
SCRIPT_ALIAS of /cgi-bin will match /cgi-bin/ /cgi-bin1/ /cgi-bin2/ etc...


SCRIPT_SUFFIX=".cgi .bat"

A space seperated list of patterns used to define cgi scripts.  Before
replying to a request, the web server checks the resulting filename (after
parsing)  against these suffixes.  If any match, the file is assumed to be
a CGI program and is executed instead of simply being sent. This method of
specifying CGI programs does not allow for any extra-path information to
be sent, and is only required if you mix CGI scripts and HTML documents in
the same directory.


TIMEOUT=30

This value controls the time (in seconds) the server will wait for a CGI
program to complete, before killing it and aborting the web request.


LSDATEFLAG="-e"            # BusyBox ls command (LRP & floppy disk linux)
#LSDATEFLAG="--full-date"  # 'real' ls command (full disto)

This tells the server how to obtain the full date from the ls command,
which is used to generate a Last-modified: header.


#
# Required external programs:
#


I think this is a comprehensive list of the external programs required to
run sh-httpd, but I might have missed something...

[ (test)
  usually a shell built-in

basename
  no longer needed...replaced with shell script (mainly 'set' command)

cat
  no special requirements 
 
cd
  no special requirements
 
date
  Must support the -u (UTC) and -R (RFC822 format) switches

dirname
  no longer needed...replaced with sed script

echo
  Must support the -e and -n switches, and evaluate \r as <CR> (0x0D)

getpeername
  Used to obtain the remote IP address for CGI programs and logging

ls
  should support the -e (busybox) or --full-time switch to allow
  generation of the Last-modified: header

sed
  used for general string processing

