summaryrefslogtreecommitdiffstats
path: root/usr.sbin/httpd/server_http.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Replace the static env variables with a single global variable.rzalamena2016-08-261-8/+3
| | | | ok reyk@
* According to RFC 7231 4.3.7, OPTIONS may have body. "Although thisreyk2016-07-271-2/+2
| | | | | | | | | specification does not define any use for such a payload, future extensions to HTTP might use the OPTIONS body to make more detailed queries about the target resource." The future has arrived. Found and tested by Michael Lechtermann OK benno@
* Return "400 Bad Request" instead of "500 Server Internal Error" forkrw2016-05-271-3/+5
| | | | | | | | | requests lacking "HTTP/<version>". This makes it more obvious that httpd(8) does not attempt to support HTTP v0.9 (circa 1991), when "GET <url>\r\n" was valid. ok millert@ florian@
* makes sure the value of the asprintf buffer is zeroed on errorjung2016-05-221-3/+7
| | | | | | from Hiltjo Posthuma "do." deraadt
* Set content charset for auto index generated page.florian2016-03-081-1/+3
| | | | | Pointed out and diff by dhill, thanks! Tweaks and same change for error documents by me.
* Back out previous; requested by jung@tim2016-02-111-7/+7
|
* Include the server port number in the common and combined logs. This is usefultim2016-02-111-7/+7
| | | | | | to distinguish between http and https requests. OK florian@ reyk@ a while ago
* No need to check for NULL before free().mmcc2015-12-071-3/+2
|
* Remove unnecessary NULL checks before free().reyk2015-12-031-21/+13
| | | | From Jan Schreiber
* Plug a leak.sunil2015-10-131-1/+2
| | | | Ok gilles@, reyk@
* Pass unsigned chars to ctype functions.reyk2015-10-131-2/+2
| | | | From Michael McConville
* Fix a regression that was introduced with server.c r1.64: Do NOT freereyk2015-09-071-2/+2
| | | | | | | | | | srv_conf->auth in serverconfig_free() because it was not allocated in config_getserver() but assigned as a reference by id from a global list that is maintained independently. This fixes a potential double-free. This fix also makes srv_conf->auth "const" to emphasize that the read-only auth pointer was not allocated here. OK jsing@
* The WebDAV MOVE method was not included in the switch statementreyk2015-08-211-1/+2
| | | | | | | handling the HTTP methods in server_http.c which resulted in a 405 method not allowed error when trying to use it. Fix by jaminh on github
* Change httpd(8) to use C99-style fixed-width integers (uintN_t insteadreyk2015-08-201-7/+7
| | | | | | | | | | | | | | | | of u_intN_t) and replace u_int with unsigned int. Mixing both variants is a bad style and most contributors seem to prefer this style; it also helps us to get used to it, portability, and standardization. Theoretically no binary change, except one in practice: httpd.o has a different checksum because gcc with -O2 pads/optimizes "struct privsep" differently when using "unsigned int" instead "u_int" for the affected members. "u_int" is just a typedef of "unsigned int", -O0 doesn't build the difference and clang with -O2 doesn't do it either - it is just another curiosity from gcc-land. OK semarie@
* repair hsts header output, wrong format strings caused brokenbenno2015-07-311-3/+3
| | | | | | | | | | Strict-Transport-Security headers. Add __format__ attribute to kv_set() and kv_setkey() to make it easier to spot such problems. Found by and fix from Donovan Watteau <tsoomi -AT- gmail -DOT- com>, thanks for your help. ok deraadt@
* backout the previous: it broke wordpress somehow.reyk2015-07-291-2/+1
| | | | | | we need more care to find a proper fix for the fastcgi headers. acknowledged by deraadt@
* Read fcgi response records until we have the whole http header and canflorian2015-07-291-1/+2
| | | | | | parse it. Otherwise http headers can leak into the body. Pointed out by Jean-Philippe Ouellet on bugs@ Thanks! OK reyk, commit ASAP deraadt@
* The realm in authenticate directive of config file isn't escaped for '"' char.semarie2015-07-231-3/+10
| | | | | | The diff corrects this problem by using VIS_DQ. ok reyk@ florian@
* For the completeness of HSTS, add the non-standard preload option.reyk2015-07-191-7/+11
| | | | OK florian@
* Allow to change the default media type globally or per-location,reyk2015-07-181-5/+4
| | | | | | eg. default type text/html. OK florian@
* Implement HTTP Strict Transport Security (HSTS).florian2015-07-181-4/+26
| | | | Input & OK reyk
* spacingreyk2015-07-161-5/+5
|
* Escape the message in server_log() as well.reyk2015-07-151-7/+6
| | | | OK benno@
* For some values like the User-Agent, use vis(3) instead of url_encode().reyk2015-07-151-18/+19
| | | | | | This makes the output more readable and matches Apache's log encoding. OK sthen@ brynet@
* Simplify the error path of the previous commit: by using ret = -1 byreyk2015-07-151-37/+15
| | | | | | | | default and only setting it to 0 on success, we don't have to set it in each error case. While here, also remove two superfluous NULL checks (as pointed out by semarie). OK semarie@
* httpd don't sanitize variables before putting them in logs. It is possible forsemarie2015-07-151-20/+101
| | | | | | | an attacker to push arbitaries characters in logs (newline for forging entries, or some control escaping interpreted by terminal emulator). OK reyk@
* escape the matched substrings before using it in expansion.semarie2015-06-231-3/+6
| | | | ok reyk@
* Add initial support for pattern matching using Lua's pattern matching code.reyk2015-06-231-12/+61
| | | | | | With important help on the pattern matcher from semarie@ OK semarie@
* After the last change, we also have to url_encode $SERVER_NAME andreyk2015-06-221-9/+16
| | | | | | $REMOTE_USER before using them in the Location. From Sebastien Marie (semarie)
* When encoding the Location url, only encode the query and pathreyk2015-06-211-22/+37
| | | | | | | | elements from the user input and not the constants from the configuration. This makes it possible to specify chars like '?' in the uri. OK Sebastien Marie
* Use off_t instead of size_t to pass file size and print it using %lld whenkettenis2015-05-201-3/+3
| | | | | | | constructing the Content-Length header field. Should fix some, but probably not all, problems with serving files bigger than 2G on 32-bit architectures. ok reyk@, florian@
* Implement byte ranges.florian2015-05-031-1/+8
| | | | | From Sunil Nimmagadda <sunil At nimmagadda DOT net> OK benno@
* Regis Leroy reported that httpd does not strictly accept CRLF forjsg2015-04-181-5/+6
| | | | | | | | | | newlines which could lead to http response splitting/smuggling if a badly behaved proxy is in front of httpd. Switch from evbuffer_readline() to evbuffer_readln() with EVBUFFER_EOL_CRLF_STRICT to avoid this. ok florian@
* Revert previous as this breaks stuff.florian2015-04-091-6/+1
| | | | | I fscked up the testing, sorry! Found the hard way by jsg@
* Do not silently accept multiple Content-Length headers.florian2015-04-081-1/+6
| | | | | | Pointed out by Regis Leroy (regis.leroy AT makina-corpus DOT com), thanks! Tweak and OK reyk@
* Allow to specify CGI variables as macros in redirection strings, eg.reyk2015-02-231-3/+107
| | | | | | block return 301 "http://www.example.com/$REQUEST_URI" OK tedu@ florian@
* spacingreyk2015-02-081-2/+3
|
* spacingreyk2015-02-071-11/+12
|
* Add support for blocking, dropping, and redirecting requests.reyk2015-02-071-2/+11
| | | | OK florian@
* Fix log options in locations.reyk2015-02-061-4/+4
| | | | | Reported and tested by Markus Bergkvist OK florian@
* Fix potential NULL pointer dereference.reyk2015-02-051-5/+6
|
* httpd is based on relayd and had included many headers that are onlyreyk2015-01-211-11/+3
| | | | | | | | | needed by its ancestor. jsg@, include-what-you-use, and some manual review helped to cleanup the headers (take iwyu with a grain of salt). Based on common practice, httpd.h now also includes the necessary headers for itself. OK florian@
* Log the remote user in the access.log.florian2015-01-191-8/+10
| | | | Pointed out by, tweak & OK reyk@
* s/clt_fcgi_remote_user/clt_remote_user/florian2015-01-191-7/+7
| | | | OK reyk@
* Decouple auth parameters from struct server_config into struct auth.reyk2015-01-191-3/+4
| | | | OK florian@
* First stab at implementing basic auth.florian2015-01-181-2/+97
| | | | | | | | Currently the htpasswd file needs to be in the chroot; will hopefully improved soonish. Based on a diff from Oscar Linderholm many months ago but turned into a complete rewrite. input/OK reyk@
* Replace <sys/param.h> with <limits.h> and other less dirty headers wherederaadt2015-01-161-4/+5
| | | | | | | | | possible. Annotate <sys/param.h> lines with their current reasons. Switch to PATH_MAX, NGROUPS_MAX, HOST_NAME_MAX+1, LOGIN_NAME_MAX, etc. Change MIN() and MAX() to local definitions of MINIMUM() and MAXIMUM() where sensible to avoid pulling in the pollution. These are the files confirmed through binary verification. ok guenther, millert, doug (helped with the verification protocol)
* bump copyright yearreyk2015-01-131-2/+2
|
* I missed one goto abort instead of free(line).reyk2015-01-061-3/+2
| | | | Found by Fabian Raetz at gmail
* Instead of calling free(line) in each error case, call it once in fail:.reyk2015-01-061-22/+13
| | | | From Fabian Raetz at gmail
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.