hiawatha (12.1) stable; urgency=low

  * Added support for HTTP/2 via nghttp2. Credits to Heiko Zimmerman.
    Test carefully before enabling on production servers.
  * mbed TLS updated to 4.1.0.
  * Removed ssi-cgi. Check out Hiawatha's XSLT support for a more
    advanced alternative.
  * Small bugfixes and improvements.

 -- Hugo Leisink <hugo@leisink.net>  Sat,  4 Apr 2026 12:41:53 +0200

hiawatha (12.0) stable; urgency=low

  * mbed TLS updated to 4.0.0. Thanks to Heiko Zimmermann.
  * Replaced strcpy() with strlcpy() and sprintf() with snprintf().
    Thanks to Heiko Zimmermann.
  * Added OS sandbox. Credits to Heiko Zimmermann.
  * Removed DHsize option.
  * Known bug: mbed TLS v4.0.0 doesn't compile in Cygwin, so building
    a Windows package is not possible.

 -- Hugo Leisink <hugo@leisink.net>  Sat, 28 Feb 2026 14:09:36 +0100

hiawatha (11.8) stable; urgency=low

  * mbed TLS updated to 3.6.4.
  * Small bugfixes.

 -- Hugo Leisink <hugo@leisink.net>  Sun, 21 Sep 2025 10:47:53 +0200

hiawatha (11.7) stable; urgency=low

  * mbed TLS updated to 3.6.3.
  * All references to http://www.hiawatha-webserver.org/ changed to
    https://hiawatha.leisink.net/.
  * Bugfix: building without TLS support failed.

 -- Hugo Leisink <hugo@leisink.net>  Sun, 30 Mar 2025 12:56:41 +0200

hiawatha (11.6) stable; urgency=low

  * Enabled TLSv1.3.
  * mbed TLS updated to 3.6.0.

 -- Hugo Leisink <hugo@leisink.net>  Thu, 13 Jun 2024 21:16:34 +0200

hiawatha (11.5) stable; urgency=low

  * mbed TLS updated to 3.5.0.

 -- Hugo Leisink <hugo@leisink.net>  Fri, 13 Oct 2023 14:56:41 +0200

hiawatha (11.4) stable; urgency=low

  * mbed TLS updated to 3.4.0.
  * Bugfix: TunnelSSH issue with latest PuTTY versions.

 -- Hugo Leisink <hugo@leisink.net>  Wed,  5 Apr 2023 20:42:18 +0200

hiawatha (11.3) stable; urgency=low

  * PHP 8 compatibility for Let's Encrypt script.
  * Applied some patches from the FreeBSD community.
  * mbed TLS updated to 3.3.0.

 -- Hugo Leisink <hugo@leisink.net>  Wed,  4 Jan 2023 09:07:31 +0100

hiawatha (11.2) stable; urgency=low

  * mbed TLS updated to 3.2.1.
  * Small improvements.

 -- Hugo Leisink <hugo@leisink.net>  Thu, 14 Jul 2022 11:39:47 +0200

hiawatha (11.1) stable; urgency=low

  * mbed TLS updated to 3.1.0.
  * Small bugfixes.

 -- Hugo Leisink <hugo@leisink.net>  Thu, 23 Dec 2021 16:02:28 +0100

hiawatha (11.0) stable; urgency=low

  * mbed TLS updated to 3.0.0.
  * Dropped support for TLSv1.0 and TLSv1.1. Configuration option
    MinTLSversion removed.
  * Dropped support for HTTP Public Key Pinning (HPKP). Configuration
    option PublicKeyPins removed.

 -- Hugo Leisink <hugo@leisink.net>  Fri, 23 Jul 2021 08:52:10 +0200

hiawatha (10.12) stable; urgency=low

  * mbed TLS updated to 2.26.0.
  * New LE_ISSUERS setting for Let's Encrypt script.
  * Bugfix: vfprintf issue for syslog in log.c.

 -- Hugo Leisink <hugo@leisink.net>  Thu, 25 Mar 2021 09:30:07 +0100

hiawatha (10.11) stable; urgency=low

  * Default value of MinTLSversion set to 1.2.
  * mbed TLS updated to 2.23.0.
  * Small bugfixes.

 -- Hugo Leisink <hugo@leisink.net>  Wed,  8 Jul 2020 14:31:50 +0200

hiawatha (10.10) stable; urgency=low

  * Removed several build options. Functionalities are now always enabled.
  * mbed TLS updated to 2.16.3.
  * Updated Let's Encrypt script due to changes in the API.
  * Bugfix: AlterMode not working correctly.

 -- Hugo Leisink <hugo@leisink.net>  Thu, 19 Sep 2019 20:33:21 +0200

hiawatha (10.9) stable; urgency=low

  * Let's Encrypt script installed via CMake.
  * mbed TLS updated to 2.16.0.
  * Small improvements.

 -- Hugo Leisink <hugo@leisink.net>  Mon, 18 Feb 2019 19:15:46 +0100

hiawatha (10.8.4) stable; urgency=high

  * Bugfix: Directory traversal when AllowDotFiles is enabled.

 -- Hugo Leisink <hugo@leisink.net>  Tue, 12 Feb 2018 21:37:04 +0100

hiawatha (10.8.3) stable; urgency=low

  * Several fixes in build system.
  * mbed TLS updated to 2.13.0.
  * Added build system for nghttp2.

 -- Hugo Leisink <hugo@leisink.net>  Sun, 16 Sep 2018 10:50:23 +0200

hiawatha (10.8.2) stable; urgency=low

  * mbed TLS updated to 2.12.0.
  * New style for directory index.
  * uri_depth added to XML for directory index.

 -- Hugo Leisink <hugo@leisink.net>  Sat, 28 Jul 2018 09:51:07 +0200

hiawatha (10.8.1) stable; urgency=low

  * mbed TLS updated to 2.8.0.
  * Removed support for secp192r1 and secp192k1 curves, to make it PCI DSS
    compliant out of the box.
  * Small improvements to Let's Encrypt ACMEv2 script.

 -- Hugo Leisink <hugo@leisink.net>  Tue, 10 Apr 2018 21:58:41 +0200

hiawatha (10.8) stable; urgency=low

  * New Let's Encrypt script that supports ACME v2.
  * Added Syslog option.
  * Added GZipExtensions option.
  * AllowDotFiles now used to show hidden files in directory listings.
  * mbed TLS updated to 2.7.0.
  * Removed support for static RSA ciphers.
  * Hiawatha log format changed.
  * Small improvements.
  * Bugfix: certain characters in filenames disrupted directory index output.
  * Bugfix: requesting non-regular files now results in a 403 instead of
    blocking that thread.
 
 -- Hugo Leisink <hugo@leisink.net>  Wed, 21 Mar 2018 19:57:44 +0100

hiawatha (10.7) stable; urgency=low

  * Connect to a reverse proxy via a Unix socket.
  * Added BlockExtensions setting.
  * mbed TLS updated to 2.6.0.
  * Small improvements.
  * Bugfix: error in handling renewal scripts in Let's Encrypt script.

 -- Hugo Leisink <hugo@leisink.net>  Mon, 16 Oct 2017 19:31:54 +0100

hiawatha (10.6) stable; urgency=low

  * Added PublicKeyPins option.
  * Added renewal-scripts to Let's Encrypt script.
  * mbed TLS updated to 2.4.2.
  * Small changes to CMake build system.
  * Small improvements.
  * Bugfix: SCSV bug in mbed TLS.

 -- Hugo Leisink <hugo@leisink.net>  Sun, 16 Apr 2017 22:04:37 +0200

hiawatha (10.5) stable; urgency=low

  * mbed TLS updated to 2.4.0, using GPL version.
  * Added CustomHeaderBackend option.
  * Renamed CustomHeader option to CustomHeaderClient. Old name still works.
  * Hiawatha ignores FileHashes and ReverseProxy for Let's Encrypt
    authentication requests.
  * Small bugfixes.

 -- Hugo Leisink <hugo@leisink.net>  Fri, 27 Jan 2017 12:06:10 +0100

hiawatha (10.4) stable; urgency=low

  * mbed TLS updated to 2.3.0.
  * SkipCacheCookie option added.
  * Added Systemd init script to Debian package.
  * Small improvements and bugfixes.

 -- Hugo Leisink <hugo@leisink.net>  Wed,  5 Oct 2016 19:56:21 +0200

hiawatha (10.3) stable; urgency=low

  * PreventCSRF, PreventSQLi and PreventXSS improved.
  * Prevention of MySQL data mining via SQL injection. Thanks to
    Esmaeil Rahimian <rahimian@securehost.co>.
  * Added revoke option to Let's Encrypt script.
  * Hiawatha ignores RequireTLS for Let's Encrypt authentication requests.
  * Small bugfixes and improvements.
  * Bugfix: possible HTTP request pipelining error after CSRF prevented.

 -- Hugo Leisink <hugo@leisink.net>  Sun,  5 Jun 2016 08:21:38 +0200

hiawatha (10.2) stable; urgency=low

  * Added Let's Encrypt script (see extra/letsencrypt).
  * Added support for requesting Let's Encrypt certificates (see AccessList
    and PasswordFile settings in manual page).
  * Small improvements.
  * Bugfix: HideProxy not working for Forwarded header.

 -- Hugo Leisink <hugo@leisink.net>  Sun,  1 May 2016 20:21:41 +0200

hiawatha (10.1) stable; urgency=low

  * Added Extensions setting.
  * Added support for X-Sendfile header.
  * mbed TLS updated to 2.2.1.
  * Improved SQL injection detection.
  * Small bugfixes and improvements.

 -- Hugo Leisink <hugo@leisink.net>  Thu, 11 Feb 2016 08:39:12 +0100

hiawatha (10.0) stable; urgency=low

  * Usage of Directory sections changed.
  * Added support for RFC 5785.
  * Added support for GZip compression. Removed the UseGZfile option.
  * Added ECDSA support for TLS 1.0 and TLS 1.1.
  * Replaced UrlToolkit Expire option with ExpirePeriod in Directory section.
  * Replaced IgnoreDotHiawatha option with UseLocalConfig.
  * Removed the VolatileObject option.
  * Improved SQL injection detection.
  * mbed TLS updated to 2.2.0.
  * Small improvements.

 -- Hugo Leisink <hugo@leisink.net>  Wed, 25 Nov 2015 19:13:39 +0100

hiawatha (9.15) stable; urgency=low

  * Support for WebSockets via reverse proxy.
  * UNIX socket support for connections to WebSockets.
  * Responsive design for directory index and error message.
  * mbed TLS updated to 2.1.2.
  * Fixed mbed TLS linking in CMake configuration.
  * ListenBacklog option added.
  * Small bugfixes.

 -- Hugo Leisink <hugo@leisink.net>  Wed, 14 Oct 2015 20:46:07 +0200

hiawatha (9.14) stable; urgency=low

  * mbed TLS updated to 2.0.0.
  * Small bugfixes.
  * Bugfix: crash when sending very large request to FastCGI server.

 -- Hugo Leisink <hugo@leisink.net>  Wed, 26 Jul 2015 11:23:50 +0200

hiawatha (9.13) stable; urgency=low

  * Renamed SSLcertFile to TLScertFile.
  * Renamed RequireSSL to RequireTLS.
  * Renamed SSL_* CGI environment variables to TLS_*.
  * Renamed UrlToolkit option UseSSL to UseTLS.
  * Replaced MinSSLversion by MinTLSversion.
  * LogTimeouts option added.
  * Added 'skip directories' parameter to reverse proxy.
  * Failed logins sent to Hiawatha Monitor.
  * Small bugfix and improvements.

 -- Hugo Leisink <hugo@leisink.net>  Sun, 10 May 2015 09:47:41 +0200

hiawatha (9.12) stable; urgency=medium

  * PolarSSL 1.3.9 upgraded to mbed TLS 1.3.10.
  * MacOS X PreferencePane removed from MacOS X package.
  * Bugfix: memory leak in SSL library.
  * Small bugfix.

 -- Hugo Leisink <hugo@leisink.net>  Thu, 12 Feb 2015 22:39:50 +0100

hiawatha (9.11) stable; urgency=low

  * ChallengeClient option added.
  * UrlToolkit options TotalConnections and OmitRequestLog added.
  * Improvements to UrlToolkit and reverse proxy swap.
  * UrlToolkit rules are also applied to PUT and DELETE.
  * Small improvements.

 -- Hugo Leisink <hugo@leisink.net>  Sun, 18 Jan 2015 10:36:27 +0100

hiawatha (9.10) stable; urgency=low

  * Support for banning bad clients who connect via a proxy.
  * UrlToolkit option Do added. Changed how Call and Skip should be called.
  * General UrlToolkit improvements. See config/toolkit.conf for syntax.
  * Hiawatha now prefers reverse proxies with a scheme matching the one of
    the client connection. See config/toolkit.conf for syntax.
  * Hiawatha will now first process UrlToolkit rules before using ReverseProxy.
  * Small bugfixes and improvements.

 -- Hugo Leisink <hugo@leisink.net>  Sat,  3 Jan 2015 19:09:11 +0100

hiawatha (9.9) stable; urgency=low

  * HTTPAuthToCGI option added.
  * BanByCGI option added.
  * PolarSSL updated to version 1.3.9.
  * Improved SSL ciphersuite selections.
  * CAcertificates options added.
  * Dropped support for SSL3.0.
  * Small bugfixes and improvements.

 -- Hugo Leisink <hugo@leisink.net>  Sun,  7 Dec 2014 12:15:57 +0100

hiawatha (9.8) stable; urgency=low

  * Added support for websockets. WebSocket option added.
  * Added Red Hat package building script (extra/make_redhat_package).
    Thanks to Paul F. Bernal B.
  * SSL key and certificate checks added to wigwam.
  * Small bugfixes and improvements.

 -- Hugo Leisink <hugo@leisink.net>  Sat, 27 Sep 2014 14:13:21 +0200

hiawatha (9.7) stable; urgency=low

  * UseToolkit now possible in .hiawatha file at root of website.
  * Method option added to URL Toolkit.
  * SetResourceLimit option added.
  * ThreadKillRate option added.
  * Improved SQL injection detection.
  * Default value for DHsize set to 2048.
  * PolarSSL updated to version 1.3.8.
  * Memory allocation debugger module added.
  * Small bugfixes and improvements.
  * Bugfix: incorrect file hash printing by wigwam with directory as symlink.

 -- Hugo Leisink <hugo@leisink.net>  Thu, 21 Aug 2014 22:20:49 +0200

hiawatha (9.6) stable; urgency=medium

  * Logfile rotation for access logfiles.
  * HTTP Strict Transport Security header made optional for RequireSSL.
  * Support for chunked transfer encoded requests (not for PUT).
  * Support for improved server statistics in Hiawatha Monitor.
  * The Hiawatha Monitor is now supported without the need for XSLT.
  * PolarSSL updated to version 1.3.7.
  * A few bugfixes as reported by Coverity.
  * Small bugfixes.
  * Bugfix: SQL injection detection was broken since 8.6.
  * Bugfix: XSS detection didn't work for reverse proxy.

 -- Hugo Leisink <hugo@leisink.net>  Sat, 31 May 2014 20:07:55 +0200

hiawatha (9.5) stable; urgency=low

  * Added support for CGI statistics in Hiawatha Monitor.
  * MonitorRequests and MonitorStatsInterval option removed.
  * Added support for Origin HTTP header to prevent CSRF.
  * EnforceFirstHostname option added.
  * ScriptAlias option added.
  * PolarSSL updated to version 1.3.6.
  * Dropped support for PolarSSL 1.2.

 -- Hugo Leisink <hugo@leisink.net>  Wed, 23 Apr 2014 20:55:29 +0200

hiawatha (9.4) stable; urgency=low

  * Keep-Alive connections for reverse proxy made optional.
  * ErrorXSLTfile option added.
  * IgnoreDotHiawatha option added.
  * RandomHeader option added.
  * Dropped support for RC4.
  * PolarSSL updated to version 1.3.4.
  * Added support for Hyper Text Coffee Pot Control Protocol (RFC 2324).
  * Added SSL_CIPHER to CGI environment.
  * Added Public/Private to URL Toolkit expire option.
  * Small improvements.

 -- Hugo Leisink <hugo@leisink.net>  Sat, 22 Mar 2014 10:53:03 +0100

hiawatha (9.3.1) stable; urgency=low

  * Several bugfixes in reverse proxy.

 -- Hugo Leisink <hugo@leisink.net>  Sat,  7 Dec 2013 19:54:49 +0100

hiawatha (9.3) stable; urgency=low

  * PolarSSL updated to version 1.3.2.
  * Added support for Elliptic Curve Cryptography.
  * TunnelSSH option added.
  * AnonymizeIP option added. Thanks to Klemens Scholhorn.
  * Keep-alive connections for reverse proxy.
  * Small improvements.

 -- Hugo Leisink <hugo@leisink.net>  Tue,  5 Nov 2013 20:21:13 +0100

hiawatha (9.2) stable; urgency=low

  * Added support for compiling Hiawatha against the system's default
    version (>=1.2.0) of the PolarSSL library.
  * PolarSSL updated to version 1.2.8.
  * Small bugfixes (memory leaks in error situations).
  * Bugfix: virtual hostname selection for IPv6 with non-standard port.

 -- Hugo Leisink <hugo@leisink.net>  Sun, 23 Jun 2013 12:25:52 +0200

hiawatha (9.1) stable; urgency=low

  * FileHashes option added.
  * PolarSSL updated to version 1.2.7. Enabled ciphersuite selection based
    on protocol version.
  * Enabled accf_http support for FreeBSD. Thanks to Martin Tournoij.
  * Better handling of previous installed configuration files under MacOS X.
    Thanks to Sander Niemeijer.
  * ImageReferer option removed.
  * Added SSL_VERSION to CGI environment.
  * Bugfix: incorrect BanOnFlooding behavior.
  * Small improvements.

 -- Hugo Leisink <hugo@leisink.net>  Mon, 15 Apr 2013 17:56:48 +0200

hiawatha (9.0) stable; urgency=low

  * Clients handled via thread pool instead of creating threads on the fly.
  * ThreadPoolSize option added.
  * Header option added to URL Toolkit.
  * Improved client SSL certificate handling. Environment variables renamed.
  * PolarSSL updated to version 1.2.6.
  * Improved Reverse Proxy caching support for requests with URL parameters.
  * CacheMinFilesize option removed.
  * DenyBot option removed. Use URL Toolkit's Header option instead.
  * OldBrowser option removed from URL Toolkit. Use Header option instead.
  * Improved URL Toolkit rule testing in wigwam.
  * Small bugfixes and improvements.

 -- Hugo Leisink <hugo@leisink.net>  Thu, 28 Mar 2013 11:46:52 +0100

hiawatha (8.8.1) stable; urgency=medium

  * Bugfix: Incorrect size of buffer for poll() can lead to a crash
    when using Tomahawk.

 -- Hugo Leisink <hugo@leisink.net>  Tue,  5 Mar 2013 15:27:01 +0100

hiawatha (8.8) stable; urgency=low

  * Caching for Reverse Proxy. CacheRProxyExtensions option added.
  * Basic HTTP authentication now supports the glibc2 version of crypt().
  * Hostname in ImageReferer can now contain a wildcard.
  * DenyBody matching is now case insensitive.
  * PolarSSL updated to version 1.2.5.
  * Small improvements.

 -- Hugo Leisink <hugo@leisink.net>  Mon, 18 Feb 2013 22:05:46 +0100

hiawatha (8.7) stable; urgency=low

  * Added support for HTTP Strict Transport Security (RFC 6797). Integrated
    in RequireSSL option.
  * DHsize option added.
  * PolarSSL updated to version 1.2.3.
  * CloudFlare headers placed in environment variables.
  * Removed php-fcgi.
  * Small improvements.
  * Bugfix: slow page loading via Reverse Proxy.

 -- Hugo Leisink <hugo@leisink.net>  Wed,  9 Jan 2013 20:18:23 +0100

hiawatha (8.6) stable; urgency=low

  * PolarSSL updated to version 1.2. Added support for TLS 1.2 and
    secure renegotiation.
  * Added support for Server Name Indication.
  * MinSSLversion option added.
  * ServerRoot option removed.
  * Improved MacOS X package building script.
  * Marked php-fcgi as deprecated. Use php-fpm instead.
  * Small bugfixes and improvements.

 -- Hugo Leisink <hugo@leisink.net>  Wed, 31 Oct 2012 19:10:32 +0100

hiawatha (8.5) stable; urgency=low

  * Improved Reverse Proxy.
  * Changed error message style.
  * Renamed Command Channel to Tomahawk.
  * Return 403 instead of 401 upon correct password for HTTP
    authentication but user not in right group.
  * Small improvements.
  * Bugfix: replaced select() with poll() to prevent crashes in case of
    large amount of simultaneous connections. Thanks to Peter Bex.

 -- Hugo Leisink <hugo@leisink.net>  Sun,  9 Sep 2012 11:39:12 +0200

hiawatha (8.4) stable; urgency=low

  * MaxServerLoad option added.
  * PolarSSL updated to version 1.1.4.
  * Small bugfixes and improvements.
  * Bugfix: invalid reverse proxy request when URL parameters are present.

 -- Hugo Leisink <hugo@leisink.net>  Thu,  7 Jun 2012 20:07:46 +0200

hiawatha (8.3.2) stable; urgency=high

  * Bugfix: memory leak in SSL library.

 -- Hugo Leisink <hugo@leisink.net>  Tue, 29 May 2012 18:02:59 +0200

hiawatha (8.3.1) stable; urgency=low

  * Improved security for reverse proxy (works with PreventSQLi, etc).

 -- Hugo Leisink <hugo@leisink.net>  Mon, 28 May 2012 21:50:31 +0200

hiawatha (8.3) stable; urgency=low

  * ReverseProxy option added.
  * PolarSSL updated to version 1.1.3.

 -- Hugo Leisink <hugo@leisink.net>  Wed, 23 May 2012 18:11:56 +0200

hiawatha (8.2) stable; urgency=low

  * WebDAVapp option added. Enables support for WebDAV applications
    like ownCloud (http://owncloud.org/).
  * Removed support for the OPTIONS method.
  * AllowDotFiles option added.
  * Global forks setting in php-fcgi.conf moved to Server setting.
  * Small bugfixes and improvements.

 -- Hugo Leisink <hugo@leisink.net>  Tue,  1 May 2012 17:48:27 +0200

hiawatha (8.1) stable; urgency=low

  * BanOnInvalidURL option added.
  * PolarSSL updated to version 1.1.1.
  * Small improvements in Windows packaging script.
  * Bugfix: paths missing in default values and examples in manual pages.

 -- Hugo Leisink <hugo@leisink.net>  Sat, 25 Feb 2012 19:02:41 +0100

hiawatha (8.0) stable; urgency=low

  * Replaced Autoconf with CMake. Many thanks to Sander Niemeijer.
  * Replaced OpenSSL with PolarSSL. Many thanks to Paul Bakker.
  * AllowedCiphers and DHparameters options removed.
  * Added IE7 to URL Toolkit's OldBrowser list, removed IE5.
  * MaxUrlLength option added, can return 414 Request-URI Too Long.
  * Changed default value of TriggerOnCGIstatus to 'no'.
  * Equalized format of logfiles.
  * Extra checks added to php-fcgi.
  * Small improvements.

 -- Hugo Leisink <hugo@leisink.net>  Fri, 27 Jan 2012 12:06:10 +0100

hiawatha (7.8.2) stable; urgency=high

  * Improved SQL injection detection.
  * Bugfix: memory leak in PreventSQLi routine.
  * Bugfix: potential server freeze with 100% CPU in CGI output caching.

 -- Hugo Leisink <hugo@leisink.net>  Fri, 18 Nov 2011 06:51:07 +0100

hiawatha (7.8.1) stable; urgency=low

  * Small bugfixes and improvements.
  * Bugfix: null byte in HTTP header of cached CGI content.

 -- Hugo Leisink <hugo@leisink.net>  Wed,  9 Nov 2011 17:21:52 +0100

hiawatha (7.8) stable; urgency=low

  * Control CGI output cache via X-Hiawatha-Cache and X-Hiawatha-Cache-Remove
    CGI headers. See the CGI OUTPUT CACHE section in the manual page.
  * BanOnWrongPassword now also triggers on wrong username.
  * Small improvements.
  * Bugfix: timeout issue with large POST requests on SSL connections.

 -- Hugo Leisink <hugo@leisink.net>  Mon, 31 Oct 2011 21:27:18 +0100

hiawatha (7.7) stable; urgency=low

  * First parameter of Alias can now contain subdirectories.
  * Improved stability for connections with SSL client authentication.
  * Bugfix: BanOnFlooding was broken.

 -- Hugo Leisink <hugo@leisink.net>  Tue,  4 Oct 2011 19:48:30 +0200

hiawatha (7.6) stable; urgency=low

  * PreventSQLi option rewritten.

 -- Hugo Leisink <hugo@leisink.net>  Sun, 21 Aug 2011 08:06:21 +0200

hiawatha (7.5) stable; urgency=low

  * OldBrowser option added to URL Toolkit.
  * Improved mimetype configuration.
  * Do-not-track HTTP header support.
  * Password file entries can now be created with Wigwam.
  * Small bugfixes and improvements.
  * Bugfix: sent one byte too few for Range -XX.
  * Bugfix: possible crash when using PreventSQLi.

 -- Hugo Leisink <hugo@leisink.net>  Sat, 28 May 2011 15:39:13 +0200

hiawatha (7.4.1) stable; urgency=high

  * Bugfix: integer overflow in fetch_request() which could
    lead to a server crash.

 -- Hugo Leisink <hugo@leisink.net>  Sat, 26 Feb 2011 10:32:24 +0100

hiawatha (7.4) stable; urgency=medium

  * Connections per IP added to RequestLimitMask.
  * NoExtensionAs made a per-host setting.
  * Small bugfixes and improvements.
  * Bugfix: usage of HideProxy caused Hiawatha to refuse new connections
    after ConnectionsTotal connections.
  * Bugfix: memory leak in XSLT module.

 -- Hugo Leisink <hugo@leisink.net>  Mon,  8 Nov 2010 20:58:54 +0100

hiawatha (7.3) stable; urgency=low

  * RequestLimitMask option added.
  * URL parameters for ErrorHandler.
  * Support for Haiku OS.
  * Small security bugfixes.

 -- Hugo Leisink <hugo@leisink.net>  Sun,  6 Jun 2010 23:18:37 +0200

hiawatha (7.2) stable; urgency=low

  * URL Toolkit code restructured.
  * UseSSL option added to URL Toolkit.
  * Digest HTTP authentication works with htdigest(1) created password files.
  * Small improvements.

 -- Hugo Leisink <hugo@leisink.net>  Wed, 21 Apr 2010 18:12:37 +0200

hiawatha (7.1) stable; urgency=low

  * Small bugfixes.
  * Bugfix: deny access and redirect result via URL Toolkit subroutine.
  * Bugfix: broken flooding protection.

 -- Hugo Leisink <hugo@leisink.net>  Sun, 28 Mar 2010 10:39:12 +0200

hiawatha (7.0) stable; urgency=low

  * Remote Monitoring support. MonitorServer, MonitorRequests and
    MonitorStatsInterval options added.
  * IPv6 support for Windows version, due to IPv6 support in Cygwin 1.7.
  * XSLT support turned on by default.
  * All directory listings are done via XSLT. The internal index layout has
    been removed. IndexStyle option removed.
  * ServerRoot option has been made available via configure parameter.
  * Small improvements.

 -- Hugo Leisink <hugo@leisink.net>  Fri, 12 Feb 2010 14:13:09 +0100

hiawatha (6.19) stable; urgency=low

  * Expire option added to URL Toolkit.
  * HideProxy option added.
  * UNIX socket support for connections to FastCGI daemons.
  * ExploitLogfile option added.
  * Small bugfixes.

 -- Hugo Leisink <hugo@leisink.net>  Sun,  6 Dec 2009 21:25:41 +0100

hiawatha (6.18) stable; urgency=low

  * DenyBody and BanOnDeniedBody options added.
  * PreventCMDi and BanOnCMDi options removed. DenyBody and URL Toolkit offer
    better functionality.
  * Ban option added to URL Toolkit.
  * UseGZfile now first looks for .gz file instead of after requested file
    does not exist.
  * Changed duplicate hostnames in configuration from blocking error to
    warning in Wigwam.
  * Small bugfixes.

 -- Hugo Leisink <hugo@leisink.net>  Sun, 15 Nov 2009 20:19:57 +0100

hiawatha (6.17.1) stable; urgency=high

  * Bugfix: possible crash due to bug in log.c.

 -- Hugo Leisink <hugo@leisink.net>  Sat,  5 Sep 2009 08:45:18 +0200

hiawatha (6.17) stable; urgency=low

  * Directory index via XSLT.
  * Small bugfixes and improvements.
  * Bugfix: incorrect SCRIPT_NAME value with PathInfo.

 -- Hugo Leisink <hugo@leisink.net>  Sun, 30 Aug 2009 20:04:22 +0200

hiawatha (6.16) stable; urgency=medium

  * Main configuration file httpd.conf renamed to hiawatha.conf.
  * Improved error detecting and logging in php-fcgi.
  * RunOnDownload option added.
  * Small bugfixes and improvements.
  * Bugfix: repeated PIDs in php-fcgi.pid with multiple servers.
  * Bugfix: incorrect extended log format.
  * Bugfix: crash on too long StartFile in .hiawatha file.

 -- Hugo Leisink <hugo@leisink.net>  Sun, 26 Jul 2009 18:13:37 +0200

hiawatha (6.15) stable; urgency=low

  * Basic SSI support.
  * TimeForCGI option per directory.
  * SocketSendTimeout option added.
  * Small improvements.

 -- Hugo Leisink <hugo@leisink.net>  Sun,  5 Jul 2009 17:20:53 +0200

hiawatha (6.14.1) stable; urgency=low

  * Bugfix: Wigwam updated with UseFastCGI change.

 -- Hugo Leisink <hugo@leisink.net>  Sun,  7 Jun 2009 23:41:07 +0200

hiawatha (6.14) stable; urgency=medium

  * Platform independent read-timeout handlers.
  * RequiredCA option added.
  * UseSSL option removed, ServerKey option renamed to SSLcertFile and made
    available only in Binding section.
  * FastCGI option renamed to UseFastCGI.
  * Small bugfixes and improvements.
  * Bugfix: fork-mutex issue when executing CGI.

 -- Hugo Leisink <hugo@leisink.net>  Wed,  3 Jun 2009 19:50:37 +0200

hiawatha (6.13) stable; urgency=low

  * LSB style header added to init script.
  * SSL initialization improved for cross compiling.
  * Change in signal handling (HUP and USR2 signal).
  * Small bugfixes and improvements.
  * Bugfix: incorrect MD5 hashing on 64bit machines.

 -- Hugo Leisink <hugo@leisink.net>  Wed,  6 May 2009 21:33:49 +0200

hiawatha (6.12) stable; urgency=low

  * Compile errors under the latest Ubuntu release fixed.
  * Small bugfixes and improvements.

 -- Hugo Leisink <hugo@leisink.net>  Sun, 29 Mar 2009 13:27:05 +0200

hiawatha (6.11) stable; urgency=low

  * Duplicate hostname check included in Wigwam.
  * All HTTP headers starting with X- are added to CGI environment and
    set as XSLT parameter.
  * Non-present HTTP/CGI variable set as empty XSLT parameter.
  * Small bugfixes and improvements.
  * Bugfix: URL Toolkit's FastCGI setting issues.

 -- Hugo Leisink <hugo@leisink.net>  Mon, 29 Dec 2008 08:57:42 +0100

hiawatha (6.10) stable; urgency=low

  * Prevention of cross-site request forgery. PreventCSRF option added.
  * A start and stop preference pane has been added to the MacOS X package.
  * A new dedicated website for Hiawatha has been launched. Please, visit
    https://www.hiawatha-webserver.org/. The welcome webpage inside the package
    has been updated to match the new design.
  * Small bugfixes and improvements.

 -- Hugo Leisink <hugo@leisink.net>  Wed, 29 Oct 2008 21:48:21 +0100

hiawatha (6.9) stable; urgency=low

  * NoExtensionAs option added.
  * Tool added to the Windows package to start Hiawatha as a service under
    Windows (see Installation.txt in Windows package for more information).
  * Small bugfixes and improvements.
  * Bugfix: URL encoding of links in directory listing.

 -- Hugo Leisink <hugo@leisink.net>  Wed, 24 Sep 2008 19:12:45 +0200

hiawatha (6.8) stable; urgency=low

  * XSLT parameter support.
  * 'URL rewriting' has been renamed to 'URL Toolkit' (because rewriting
    is just one of the four options of this feature).
  * FastCGI option added to URL Toolkit.
  * WaitForCGI option added.
  * Small bugfixes and improvements.

 -- Hugo Leisink <hugo@leisink.net>  Tue, 22 Jul 2008 09:30:12 +0200

hiawatha (6.7) stable; urgency=low

  * BanOnWrongPassword option added.
  * Workaround to handle non-compliant CGI headers.
  * Updated Debian package building files.
  * Small bugfixes and improvements.

 -- Hugo Leisink <hugo@leisink.net>  Wed, 28 May 2008 22:06:36 +0200

hiawatha (6.6) stable; urgency=medium

  * XSLT support (compile with --enable-xslt).
  * Bugfix: possible crash when using HTTPS (due to bug in OpenSSL).

 -- Hugo Leisink <hugo@leisink.net>  Mon, 28 Apr 2008 19:30:44 +0200

hiawatha (6.5) stable; urgency=medium

  * Small bugfixes and improvements.
  * Bugfix: integer overflow in str2int().
  * Bugfix: compile error with --disable-ssl.

 -- Hugo Leisink <hugo@leisink.net>  Sat,  8 Mar 2008 08:12:41 +0100

hiawatha (6.4) stable; urgency=medium

  * SSL memory leak fixed.
  * Skip, Redirect and RequestURI options added to URL rewriting.
  * Old format of ConnectTo is no longer valid.
  * Small bugfixes and improvements.

 -- Hugo Leisink <hugo@leisink.net>  Sun, 10 Feb 2008 08:54:01 +0100

hiawatha (6.3) stable; urgency=low

  * Release of stdin, stdout and stderr on startup.
  * Small improvements.

 -- Hugo Leisink <hugo@leisink.net>  Mon, 21 Jan 2008 20:51:18 +0100

hiawatha (6.2) stable; urgency=medium

  * Moved TimeForCGI from 'server settings' to virtual host section.
  * RunOnAlter option added.
  * Improved error logging.
  * URL rewriting disabled for PUT and DELETE requests.
  * Path corrections in manpages via autoconf.
  * Workaround: dot at end of filename in Windows version.
  * Bugfix: digest HTTP authentication was broken when using GET data.

 -- Hugo Leisink <hugo@leisink.net>  Thu, 13 Dec 2007 08:21:10 +0100

hiawatha (6.1) stable; urgency=low

  * Format of ConnectTo changed. Old format will be valid for a few
    more releases.
  * Changed some CGI environment variables after URL rewriting.
  * Some URL rewrite checks included in Wigwam.
  * TriggerOnCGIstatus option added.
  * RequireResolveIP option removed.
  * Bugfix: POST data larger then 64kB via FastCGI.

 -- Hugo Leisink <hugo@leisink.net>  Sun, 11 Nov 2007 09:45:08 +0100

hiawatha (6.0) stable; urgency=low

  * IPv6 support.
  * Delimiters in php-fcgi.conf en cgi-wrapper.conf changed to ';'.
  * Format of AccessList, AlterList, BanlistMask, ConnectTo and
    LogfileMask changed (colon changed to space because of IPv6).
  * Small bugfixes and improvements.

 -- Hugo Leisink <hugo@leisink.net>  Fri, 26 Oct 2007 18:13:05 +0200

hiawatha (5.14) stable; urgency=low

  * Improved logfile handling.
  * More checks included in Wigwam.
  * Small improvements.
  * Bugfix: memory issue in Wigwam.

 -- Hugo Leisink <hugo@leisink.net>  Sat, 13 Oct 2007 12:11:37 +0200

hiawatha (5.13) stable; urgency=low

  * DenyAccess option added to URL rewriting.
  * Path 'aliases' (set C: = /cygdrive/c) and usage of forward slashes
    no longer necessary in configuration file of the Windows version.
  * SCRIPT_URL logged as URL in case of URL rewrite.
  * Cookies no longer present in logfiles.
  * Optimizations for compiling under Solaris. See the INSTALL file for
    more information (Thanks to Richard Barrington).
  * Some dependency fixes.
  * CGI zombies under OpenBSD fixed.
  * Pthread issue under OpenBSD fixed (Thanks to Kurt Miller).
  * Small bugfixes and improvements.
  * Bugfix: POST data larger then 64kB via FastCGI.

 -- Hugo Leisink <hugo@leisink.net>  Thu, 27 Sep 2007 17:34:14 +0200

hiawatha (5.12) stable; urgency=medium

  * URL rewriting.
  * Small bugfixes.
  * Bugfix: possible crash (non-exploitable) on too large request.

 -- Hugo Leisink <hugo@leisink.net>  Sun, 26 Aug 2007 15:35:44 +0200

hiawatha (5.11) stable; urgency=low

  * Made some changes to the ErrorHandler behaviour.
  * Uploading (PUT) goes directly to disk, instead of buffering in memory.
  * Option MaxUploadSize added.
  * 201 Created.
  * 411 Length Required.
  * Small improvements.
  * Bugfix: two bugs in the parsing of CGI HTTP headers.
  * Bugfix: Hiawatha for Windows returned 403 for CGI because of Cygwin
    file access rights.
  * Bugfix: setenv in php-fcgi was not working.
  * Bugfix: 404 for non-existing local file and remote FastCGI server
    and non-gzip content-encoding.

 -- Hugo Leisink <hugo@leisink.net>  Tue,  7 Aug 2007 17:26:21 +0200

hiawatha (5.10) stable; urgency=low

  * Improved CGI support for Windows version (Cygwin).
  * Throttle configuration merged into httpd.conf.
  * EnablePathInfo option added.
  * Workaround for syntax-bug in php-fcgi.conf (comma in GIDs conflicts
    with comma before PHP configuration file).
  * Improved ErrorHandler.
  * Small improvements.
  * Bugfix: possible crash when using load-balanced FastCGI.

 -- Hugo Leisink <hugo@leisink.net>  Thu,  5 Jul 2007 22:08:20 +0200

hiawatha (5.9) stable; urgency=medium

  * PUT and DELETE method implemented.
  * 204 No Content.
  * Options EnableAlter, AlterGroup, AlterList and AlterMode added.
  * Options PasswordFile and RequiredGroup have been changed.
  * Better handling of URL encoded characters.
  * Improved SQL/command injection and XSS prevention.
  * Autoconf improvements (Thanks to Sander Niemeijer, again).
  * Small bugfixes and improvements.
  * Bugfix: alias in directory index also appeared in subdirectories.
  * Bugfix: ranges were ignored while reading from cache.
  * Bugfix: digest HTTP authentication failed when a comma was present
    in the URL.
  * Bugfix: small memory leak when reading a .hiawatha file.

 -- Hugo Leisink <hugo@leisink.net>  Sat, 16 Jun 2007 16:03:14 +0200

hiawatha (5.8) stable; urgency=low

  * Source-plugin has been removed. It's obsolete because of FastCGI.
  * Entropy fix during SSL initialization if needed.
  * UserDirectory option added.
  * More error logging for Hiawatha and the CGI-wrapper.
  * Added OpenSSL exception to the license file and libssl.c.
  * Bugfixes and small improvements.

 -- Hugo Leisink <hugo@leisink.net>  Wed, 25 Apr 2007 15:19:40 +0200

hiawatha (5.7) stable; urgency=medium

  * RequireResolveIP option added.
  * KillTimedoutCGI option added.
  * Aliases added to directory index.
  * Extended Command Channel status output.
  * Configurationfiles read in alfabetic order when including a directory.
  * More error logging.
  * (Fast)CGI code improvement.
  * Small bugfixes and improvements.
  * Bugfix: minor memory issue fixed in show_index().
  * Bugfix: possible webserver crash due to bug in log_error().

 -- Hugo Leisink <hugo@leisink.net>  Sun,  4 Mar 2007 08:43:28 +0100

hiawatha (5.6) stable; urgency=low

  * Chrooted FastCGI server support.
  * Configuration reading routine rewritten. Angle bracket sections
    are no longer available. Only curly bracket sections can be used.
  * An error in a .hiawatha file results in a 500. An errormessage
    will be written to the ErrorLogfile.
  * Command Channel improved.
  * AllowedCiphers option added.
  * DHparameters option added.
  * CGIwrapId option renamed to WrapCGI.
  * FCGIserverId option renamed to FastCGIid.
  * Small bugfixes and improvements.

 -- Hugo Leisink <hugo@leisink.net>  Mon, 12 Feb 2007 21:16:19 +0100

hiawatha (5.5) stable; urgency=low

  * Segmentation fault handler (just in case). Logs an alert to syslog.
  * An 'include' configuration option can now handle a directory.
  * CGI-wrapper logs errors to ErrorLogfile.
  * Commandline options -k and -v added.
  * LogFormat option added.
  * UseGZfile option added.
  * Alternative strcasecmp() en strncasecmp().
  * 'cgi_wrapper' renamed to 'cgi-wrapper'.
  * 'fcgi-server' replaced by 'php-fcgi'.
  * 'newroot' installed via autotools.
  * Complete code review and rewrites of 'old code'.
  * Small bugfixes and improvements.

 -- Hugo Leisink <hugo@leisink.net>  Sun, 21 Jan 2007 12:56:12 +0100

hiawatha (5.4) stable; urgency=low

  * Alternative setenv() en unsetenv() (for HP-UX and Solaris).
  * Commandline options -c, -d and -h added.
  * Faster flooding-check.
  * Proper exit-codes when an error occurs.
  * Bugfix in default_config() which made it fail to run on OpenBSD.
  * Small bugfixes and improvements.

 -- Hugo Leisink <hugo@leisink.net>  Fri, 29 Dec 2006 01:42:38 +0100

hiawatha (5.3) stable; urgency=low

  * Handling of not-available FastCGI servers.
  * Large file support.
  * Cache speed improvement.
  * Total-connections-counter adjusted in case of ReconnectDelay.
  * StartFile option now available inside a Directory section.
  * 'newroot' and 'fcgi-server' scripts added to the Debian package
    and the FreeBSD Makefile.
  * CacheMinFilesize option added.
  * Alternative clearenv() en strcasestr().
  * Small bugfixes in the cache module.

 -- Hugo Leisink <hugo@leisink.net>  Sun, 17 Dec 2006 11:52:26 +0100

hiawatha (5.2) stable; urgency=low

  * Multiple, load-balanced FastCGI server support.
  * Digest HTTP authentication.
  * Improved error checking by Wigwam.
  * Included FreeBSD port files.

 -- Hugo Leisink <hugo@leisink.net>  Sat, 25 Nov 2006 09:37:44 +0100

hiawatha (5.1) stable; urgency=low

  * BindingId added to CGI environment (SERVER_BINDING).
  * Improved error checking by Wigwam.
  * Small improvements (source dependencies)
  * Bugfix: BindingId instead of Binding_Id

 -- Hugo Leisink <hugo@leisink.net>  Wed,  8 Nov 2006 22:07:41 +0100

hiawatha (5.0) stable; urgency=low

  * FastCGI support (Responder role only).
  * Configurationfile checker (Wigwam).
  * Internal file caching. CacheSize and CacheMaxFilesize options added
    (Compile with --disable-cache to disable this feature).
  * Start/stop and install script for FreeBSD (see freebsd/ in source package).
  * PIDfile option added.
  * Name in a binding section renamed to BindingId.
  * Small bugfixes.
  * Bugfix: directory index with no keep-alive for HTTP/1.0 proxies.

 -- Hugo Leisink <hugo@leisink.net>  Thu, 26 Oct 2006 18:31:57 +0100

hiawatha (4.3.2) stable; urgency=medium

  * Bugfix: client/time information missing in unbanned-logmessage.

 -- Hugo Leisink <hugo@leisink.net>  Tue,  6 Jun 2006 21:10:55 +0200

hiawatha (4.3.1) stable; urgency=high

  * Bugfix: HTTP authentication was broken.

 -- Hugo Leisink <hugo@leisink.net>  Mon, 15 May 2006 10:12:55 +0200

hiawatha (4.3) stable; urgency=low

  * Speed improvement (real improvement for static content).
  * Reason for 403 HTTP error added to access logfile (not for wrapped CGIs).
  * X-Forwarded-For header field also used for AccessList.
  * Code cleanup: Uniform variablename format.
  * Small bugfixes.
  * Bugfix: removed double Content-Type for HTTP error messages.

 -- Hugo Leisink <hugo@leisink.net>  Thu, 23 Feb 2006 19:57:14 +0100

hiawatha (4.2) stable; urgency=low

  * Seperate keyfile for every SSL binding.
  * ErrorLogfile option added.
  * LogFile option renamed to AccessLogfile.
  * Prevention of command injection. PreventCMDi and BanOnCMDi options added.
  * Separate manualpage for the CGI-wrapper: cgi_wrapper(1).

 -- Hugo Leisink <hugo@leisink.net>  Thu, 23 Feb 2006 19:57:14 +0100

hiawatha (4.1) stable; urgency=low

  * Chroot functionality for wrapped CGIs.
  * New section boundaries (section{...}).
  * Small bugfixes.
  * Bugfix: fixed ImageReferer for HTTPS connections.
  * Bugfix: directories with the beginning of its name equal to an Alias now
    accessible again.

 -- Hugo Leisink <hugo@leisink.net>  Sun, 22 Jan 2006 16:31:24 +0100

hiawatha (4.0) stable; urgency=low

  * BindHTTP and BindHTTPS options replaced by Binding sections.
  * CGI-wrapper replaced the HostId options. See the CGI-WRAPPER section in
    the manualpage for more information.
  * TimeForRequest option improved.
  * ServerId option improved.
  * BanOnTimeout option added.
  * ReconnectDelay option added.
  * Improved FollowSymlink check: symlinks are always followed if they stay
    inside the webroot.
  * Number of bytes sent per request added to the requestlog.
  * Configuration-reload removed. Gave to much trouble.
  * Customizable stylesheet for directory listings. IndexStyle option added.
  * New layout for the errormessages.
  * Small bugfixes.

 -- Hugo Leisink <hugo@leisink.net>  Tue, 18 Dec 2005 21:04:37 +0100

hiawatha (3.7) stable; urgency=low

  * SSLv2 has been removed from HTTPS. Only SSLv3 en TLSv1 are available.
  * HomedirSource option added.
  * Multiple presence of BindHTTP, BindHTTPS, AccessList, BanlistMask
    and LogfileMask in configurationfile now allowed.
  * get_hostrecord() rewritten: the wildcard in the Hostname now also matches
    the domainname. Example: 'Hostname = www.domainname.com, *.domainname.com'
    now also matches 'http://domainname.com/'.
  * RequireBinding option renamed to RequiredBinding. RequireBinding has become
    a temporary alias.
  * TRACE method implemented. EnableTRACE option added.
  * Small bugfixes and improvements.

 -- Hugo Leisink <hugo@leisink.net>  Tue, 12 Nov 2005 22:36:06 +0100

hiawatha (3.6.1) stable; urgency=medium

  * HTTP_GENERATED_ERROR environment variable added for ErrorHandler.
  * ErrorHandler from a Virtual Host ignored when handling a userwebsite.
  * Bugfix: gzip Content-Encoding was broken.
  * Bugfix: logfile got flooded with warnings in case of a configuration reload
    and an error in the configurationfile.

 -- Hugo Leisink <hugo@leisink.net>  Tue, 23 Aug 2005 08:45:43 +0200

hiawatha (3.6) stable; urgency=medium

  * Prevention of SQL injection. PreventSQLi and BanOnSQLi options added.
  * Prevention of cross-site scripting. PreventXSS option added.
  * Alias option added.
  * FollowSymlinks option added.
  * Use of variables in configurationfile via 'set'.
  * Path option changed, PathMatch option removed.
  * Removal of dangerous characters (ASCII-values 0..31) from the URL.
  * Manualpage updated.
  * Improved Debian package.
  * Small bugfixes and improvements.
  * Bugfix: filethrottling and UploadSpeed were broken.

 -- Hugo Leisink <hugo@leisink.net>  Sun, 14 Aug 2005 18:43:57 +0200

hiawatha (3.5) stable; urgency=low

  * HTTP_CLIENT_IP and HTTP_VIA variable passed thru to CGI programs.
  * Case-insensitive HTTP-header matching.
  * Small bugfixes.

 -- Hugo Leisink <hugo@leisink.net>  Sat, 16 Apr 2005 22:31:14 +0100

hiawatha (3.4) stable; urgency=low

  * Specify the returncode of an ErrorHandler.
  * DenyBot option added.
  * BindHTTP and BindHTTPS options added (BindAddress option has been removed).
  * ServerPort and SSLPort have become an alias for BindHTTP and BindHTTPS.
  * RequireBinding option added.
  * CGIextension and CGIhandler options updated.
  * Source dependencies re-organized.
  * BSD autoconf errors fixed (Thanks to Sander Niemeijer).

 -- Hugo Leisink <hugo@leisink.net>  Sun, 23 Jan 2005 22:36:13 +0100

hiawatha (3.3) stable; urgency=low

  * CGIhandler option added (PHPextension, PHPprogram and ExecutePHP options
    have been removed).
  * Support for HTTP/1.0 proxies (No chunked Transfer-Encoding, so no
    keep-alive connections for CGI).
  * Username of HTTP authentication logged.
  * Escape characters removed from logfile.
  * BanlistMask option added.
  * LogAccess option renamed to LogfileMask.
  * HTTP pipelining support.
  * Bugfix: GarbageLogfile was not created on startup.
  * Bugfix: removed double Content-Type for CGI ErrorHandler.

 -- Hugo Leisink <hugo@leisink.net>  Fri, 26 Nov 2004 00:16:40 +0100

hiawatha (3.2) stable; urgency=medium

  * Gentoo ebuild script (see gentoo/ in sourcepackage).
  * Bugfix: incorrect Chunked Transfer-Encoding.
  * Bugfix: wrong hostname on 301.

 -- Hugo Leisink <hugo@leisink.net>  Wed,  3 Nov 2004 18:51:52 +0100

hiawatha (3.1) stable; urgency=low

  * Small bugfixes and improvements.
  * Start and stop script (extra/hiawatha).
  * Command Channel made optional.
  * ServerString moved from host to main section in the configuration file.
  * Compile errors fixed (under Cygwin for example).
  * Bugfix: SERVER_PORT was set to ServerPort instead of SSLPort on HTTPS
    connections.
  * Bugfix: 301 via HTTPS used ServerPort instead of SSLPort.

 -- Hugo Leisink <hugo@leisink.net>  Mon, 20 Sep 2004 00:12:30 +0200

hiawatha (3.0) stable; urgency=low

  * SSL support: SSLPort, ServerKey and RequireSSL option added.
    (Many thanks to Denis de Leeuw Duarte. Compile with --disable-ssl
    to disable this feature).
  * SetEnvir option added.
  * RequiredGroup option added.
  * Case-insensitive configuration options.
  * Directory independent installation support.
    (Many thanks to Sander Niemeijer).

 -- Hugo Leisink <hugo@leisink.net>  Wed,  1 Sep 2004 23:54:46 +0200

hiawatha (2.8) stable; urgency=low

  * gzip Content-Encoding support (see manpage for more information).
  * BanOnMaxReqSize option added.
  * Some 400 and 413 returncode fixes.
  * Garbage log for 400.
  * Faster restart.
  * Configuration reload stable (USR1 signal).
  * Small bugfixes and improvements.

 -- Hugo Leisink <hugo@leisink.net>  Thu, 26 Aug 2004 18:28:17 +0200

hiawatha (2.7) stable; urgency=low

  * RequestBuffer option added.
  * Binary upload support.
  * AccessList option improved with 'pwd'.
  * Bugfix: incorrect Content-Length for HTTP code screens.

 -- Hugo Leisink <hugo@leisink.net>  Wed, 18 Aug 2004 12:32:40 +0200

hiawatha (2.6) stable; urgency=low

  * log.c rewritten.
  * Connect attempts during ban counted (to prefent long logfiles).
  * Bugfix: netmask 0 for AccessList didn't work.
  * Bugfix: Directory record ended configfile.

 -- Hugo Leisink <hugo@leisink.net>  Fri,  6 Aug 2004 15:37:46 +0200

hiawatha (2.5) stable; urgency=high

  * Range header field (single range support).
  * 206 Partial Content.
  * 416 Requested Range Not Satisfiable.
  * Date header field.
  * Modified-Since header field.
  * Bugfix: memory-leak fixed (free(error_line) in target.c).
  * Bugfix: thread-record problem fixed.

 -- Hugo Leisink <hugo@leisink.net>  Mon, 26 Jul 2004 09:09:18 +0200

hiawatha (2.4.1) stable; urgency=medium

  * Bugfix: use of <Directory> without UploadSpeed always resulted in a 503.

 -- Hugo Leisink <hugo@leisink.net>  Mon, 24 May 2004 13:38:06 +0200

hiawatha (2.4) stable; urgency=high

  * 503 Service Unavailable.
  * Access option removed.
  * AccessList option added.
  * AccessLog option added.
  * BindAddresses option added.
  * GarbageLogfile option added.
  * ImageReferer option added.
  * PathMatch option added.
  * UploadSpeed option extended.
  * Global change: extention -> extension.
  * exePHP/CGI option renamed to ExecutePHP/CGI.
  * Bugfix: only the first Directory record could be used.
  * Bugfix: If-Modified-Since time converted to GMT.
  * Bugfix: filedescriptor to .hiawatha left open.

 -- Hugo Leisink <hugo@leisink.net>  Fri, 16 Apr 2004 23:29:09 +0100

hiawatha (2.3.2) stable; urgency=low

  * Include option added.
  * Log requestresult code.
  * Code improvement.

 -- Hugo Leisink <hugo@leisink.net>  Sun, 28 Mar 2004 23:03:09 +0100

hiawatha (2.3.1) stable; urgency=low

  * Extra CGI environment variables.
  * Bugfix: incorrect Content-Type for multipart/form-data CGI data.
  * Bugfix: pidfile problem.

 -- Hugo Leisink <hugo@leisink.net>  Sun, 28 Mar 2004 12:33:06 +0100

hiawatha (2.3) stable; urgency=low

  * OPTIONS method improved.
  * A .hiawatha configurationfile will also be active in all the
    subdirectories.
  * CGI errors are logged to the SystemLogfile.
  * PHPextension option added.
  * ServerName option renamed to Hostname.
  * ReconnectDelay option renamed to BanOnMaxPerIP.
  * BanOnGarbage option added.
  * BanOnFlooding option added.
  * KickOnBan option added.
  * Manualpage updated.
  * Small bugfixes.

 -- Hugo Leisink <hugo@leisink.net>  Wed, 24 Mar 2004 20:10:17 +0100

hiawatha (2.2) stable; urgency=low

  * Improved directory listing (ShowIndex) and errorcode layout.
  * 405 response for PUT, DELETE, TRACE and CONNECT methods changed to 501
    Method Not Implemented.
  * POST request for a non CGI script results in a 405.
  * If-Modified-Since and If-Unmodigied-Since header fields.
  * 304 Not Modified.
  * 408 Request Timeout.
  * 412 Precondition Failed.

 -- Hugo Leisink <hugo@leisink.net>  Wed, 17 Mar 2004 20:25:50 +0100

hiawatha (2.1.1) stable; urgency=high

  * Bugfix: Basic HTTP authentication fixed. Also full path for
    PasswordFile allowed in chroot environment.

 -- Hugo Leisink <hugo@leisink.net>  Sun, 14 Mar 2004 11:58:56 +0100

hiawatha (2.1) stable; urgency=high

  * Command Channel (compile with --enable-command).
  * UserWebsite option added. (UserDirectory option removed, userwebsites.conf
    added to /etc/hiawatha).
  * UploadSpeed option for Directory sections added.
  * Improved error checking.
  * Traffic throttling for CGI scripts.
  * SystemLogfile option added.
  * Small bugfixes.
  * Bugfix: CONTENT_LENGTH was set incorrectly for POST requests.
  * Bugfix: reloading throttleconfiguration.
  * Bugfix: zombie CGI scripts. A kill (9) signal is send to all CGI processes
    after finishing. Just to be sure. :)

 -- Hugo Leisink <hugo@leisink.net>  Thu, 11 Mar 2004 18:11:26 +0100

hiawatha (2.0) stable; urgency=low

  * Multi-threading instead of forking
    (Many thanks to Sander Niemeijer).
  * Configuration reloading (USR1 signal).
  * Disconnect all clients (USR2 signal).
  * Mimetype and throttletype checking case unsensitive.
  * Improved URI checking.
  * run_script() rewritten: faster and bugfix (also using select()).
  * ServerId option added.
  * UserId and GroupId option combined to HostId.
  * Access option for Directory sections added.
  * Some code improvements.
  * Small bugfixes.

 -- Hugo Leisink <hugo@leisink.net>  Sun,  7 Mar 2004 14:51:27 +0100

hiawatha (1.7) stable; urgency=low

  * nanny_thread() removed. select() timeout used to check childs.
  * fetch_request() rewritten: it's much faster now (using select()).
  * RootDirectory option renamed to WebsiteRoot.
  * ServerRoot option added (Hiawatha will chroot() to that directory).

 -- Hugo Leisink <hugo@leisink.net>  Sat, 24 Feb 2004 14:06:53 +0100

hiawatha (1.6.1) stable; urgency=medium

  * Source-plugin support (compile with --enable-plugin).
  * Bugfix: problem with reading directory configurationfile (.hiawatha).
  * Bugfix: several realloc() fixes.
  * Bugfix: config->directory set to NULL on init.

 -- Hugo Leisink <hugo@leisink.net>  Tue, 26 Jan 2004 10:13:26 +0100

hiawatha (1.6) stable; urgency=low

  * URL checked for special characters (%20 = ' ', etc).
  * Remarks on every line in configuration file allowed.
  * Added some MIME-types.

 -- Hugo Leisink <hugo@leisink.net>  Fri, 19 Dec 2003 13:23:08 +0100

hiawatha (1.5.1) stable; urgency=high

  * ServerString option added.
  * Bugfix: CGI server hang-up bug fixed.

 -- Hugo Leisink <hugo@leisink.net>  Mon, 15 Sep 2003 11:13:12 +0100

hiawatha (1.5) stable; urgency=low

  * Improved 301: first ServerName may now contain a wildcard.
  * 302 Found (when a CGI script prints Location).
  * 413 Request Entity Too Large.
  * CGI scripts can now output binary data.
  * Automake script (Many thanks to Sander Niemeijer and Denis de Leeuw
    Duarte). Compilation tested on FreeBSD and MacOS X.
  * Small bugfixes.

 -- Hugo Leisink <hugo@leisink.net>  Sun, 17 Aug 2003 14:13:17 +0100

hiawatha (1.4) stable; urgency=low

  * Multiple ServerName options.
  * Wildcard allowed in ServerName.
  * Ownership logfiles set to UserId:GroupId from configurationfile.
  * Small bugfixes.

 -- Hugo Leisink <hugo@leisink.net>  Tue, 22 Jul 2003 09:44:12 +0100

hiawatha (1.3) stable; urgency=low

  * Directory settings support.
  * Flooding protection.
  * Volatile object support.
  * Bugfixes: some potential segmentation faults.

 -- Hugo Leisink <hugo@leisink.net>  Thu, 17 Oct 2002 20:40:00 +0100

hiawatha (1.2) stable; urgency=low

  * <VirtualHost> settings.
  * Check for errors in configurationfile.
  * Manpage updated.

 -- Hugo Leisink <hugo@leisink.net>  Sat, 28 Sep 2002 18:13:21 +0100

hiawatha (1.1.1) stable; urgency=high

  * Bugfix: server lock-up for POST request with Content-Length = 0.

 -- Hugo Leisink <hugo@leisink.net>  Thu, 26 Sep 2002 10:46:55 +0100

hiawatha (1.1) stable; urgency=low

  * Traffic throttling.

 -- Hugo Leisink <hugo@leisink.net>  Sat, 21 Sep 2002 23:04:19 +0100

hiawatha (1.0) stable; urgency=low

  * 405 Method not allowed.
  * 505 HTTP version not supported.
  * Logrotate script added to the package.
  * Bugfix: no Content-Type for directorylisting.
  * Bugfix: chunks didn't end with CRLF.
  * Bugfix: a PHP script couldn't be used as an ErrorHandler.
  * Bugfix: logfile problem.
  * Bugfix: StartFile from .hiawatha didn't work.

 -- Hugo Leisink <hugo@leisink.net>  Thu, 17 Sep 2002 18:12:35 +0100

hiawatha (1.0b) stable; urgency=low

  * Basic HTTP authentication.
  * 401 Unauthorized.
  * Support for PHP.
  * Chunked Transfer-encoding.
  * Directorylisting in HTML for directories without a startfile.
  * Main request-handling routine splitted in seperate functions.
  * parse_request() rewritten.
  * Some minor bugfixes.
  * Bugfix: setuid() security issue fixed.

 -- Hugo Leisink <hugo@leisink.net>  Thu, 16 Sep 2002 23:21:26 +0100

hiawatha (0.9) stable; urgency=low

  * Keep-alive connections.
  * Some minor bugfixes.

 -- Hugo Leisink <hugo@leisink.net>  Thu,  5 Sep 2002 19:36:04 +0100

hiawatha (0.8) stable; urgency=low

  * Size HTTP request limited to 64 kilobytes.
  * Better Content-Length handling for incoming HTTP requests.
  * Number of connections per IP address can be limited.
  * Filelock on logfile.
  * More actions are being logged.
  * Manpage added to the package.
  * Finally got rid of the root group. :)
  * User configurationfile.
  * Some minor bugfixes.
  * Bugfix: When the ErrorHandler was set a 301 error was not returned
    correctly.

 -- Hugo Leisink <hugo@leisink.net>  Fri, 28 Jun 2002 11:55:26 +0100

hiawatha (0.7.1) stable; urgency=low

  * Bugfix: the local IP address was logged instead of the remote IP address.
  * Bugfix: when CGI was disabled and the ErrorHandler was needed, the server
    crashed.

 -- Hugo Leisink <hugo@leisink.net>  Wed, 19 Jun 2002 11:55:26 +0100

hiawatha (0.7) stable; urgency=low

  * StartFile added to the configurationfile.
  * ErrorHandler added to the configurationfile.
  * The number of total connections can be limited.
  * The runtime for a CGI process can be limited.
  * Cookie support.
  * HTTP_USER_AGENT, HTTP_X_FORWARDED_FOR and HTTP_REFERER variables are passed
    thru to a CGI script.
  * Bugfix: the zombie problem has been fixed.
  * Bugfix: child quits when client disconnects.

 -- Hugo Leisink <hugo@leisink.net>  Wed, 19 Jun 2002 10:33:41 +0100

hiawatha (0.6) stable; urgency=low

  * 400 Bad request.
  * HEAD method implemented.
  * POST method implemented.
  * OPTIONS method implemented.
  * User directories.
  * Improved security.

 -- Hugo Leisink <hugo@leisink.net>  Sat, 18 May 2002 13:57:50 +0100

hiawatha (0.5) stable; urgency=low

  * Content-Type header field (Mimetypes).
  * Logfile.

 -- Hugo Leisink <hugo@leisink.net>  Thu, 16 May 2002 12:41:28 +0100

hiawatha (0.4) stable; urgency=low

  * Server can execute scripts.
  * Server information in header.
  * 403 Forbidden.
  * 500 Internal server error.

 -- Hugo Leisink <hugo@leisink.net>  Thu, 18 May 2002 13:57:50 +0100

hiawatha (0.3) stable; urgency=low

  * 200 OK.
  * 301 Redirect.
  * 404 File not found.

 -- Hugo Leisink <hugo@leisink.net>  Sat, 27 Apr 2002 17:21:42 +0100

hiawatha (0.2) stable; urgency=low

  * Configurationfile (/etc/hiawatha.conf).

 -- Hugo Leisink <hugo@leisink.net>  Sat, 20 Apr 2002 18:48:09 +0100

hiawatha (0.1) stable; urgency=low

  * Initial release.
  * GET method implemented.

 -- Hugo Leisink <hugo@leisink.net>  Sun, 27 Jan 2002 12:06:10 +0100
