summaryrefslogtreecommitdiffstats
path: root/usr.sbin/httpd/server_http.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* The realm in authenticate directive of config file isn't escaped for '"' char.semarie2015-07-231-3/+10
| | | | | | The diff corrects this problem by using VIS_DQ. ok reyk@ florian@
* For the completeness of HSTS, add the non-standard preload option.reyk2015-07-191-7/+11
| | | | OK florian@
* Allow to change the default media type globally or per-location,reyk2015-07-181-5/+4
| | | | | | eg. default type text/html. OK florian@
* Implement HTTP Strict Transport Security (HSTS).florian2015-07-181-4/+26
| | | | Input & OK reyk
* spacingreyk2015-07-161-5/+5
|
* Escape the message in server_log() as well.reyk2015-07-151-7/+6
| | | | OK benno@
* For some values like the User-Agent, use vis(3) instead of url_encode().reyk2015-07-151-18/+19
| | | | | | This makes the output more readable and matches Apache's log encoding. OK sthen@ brynet@
* Simplify the error path of the previous commit: by using ret = -1 byreyk2015-07-151-37/+15
| | | | | | | | default and only setting it to 0 on success, we don't have to set it in each error case. While here, also remove two superfluous NULL checks (as pointed out by semarie). OK semarie@
* httpd don't sanitize variables before putting them in logs. It is possible forsemarie2015-07-151-20/+101
| | | | | | | an attacker to push arbitaries characters in logs (newline for forging entries, or some control escaping interpreted by terminal emulator). OK reyk@
* escape the matched substrings before using it in expansion.semarie2015-06-231-3/+6
| | | | ok reyk@
* Add initial support for pattern matching using Lua's pattern matching code.reyk2015-06-231-12/+61
| | | | | | With important help on the pattern matcher from semarie@ OK semarie@
* After the last change, we also have to url_encode $SERVER_NAME andreyk2015-06-221-9/+16
| | | | | | $REMOTE_USER before using them in the Location. From Sebastien Marie (semarie)
* When encoding the Location url, only encode the query and pathreyk2015-06-211-22/+37
| | | | | | | | elements from the user input and not the constants from the configuration. This makes it possible to specify chars like '?' in the uri. OK Sebastien Marie
* Use off_t instead of size_t to pass file size and print it using %lld whenkettenis2015-05-201-3/+3
| | | | | | | constructing the Content-Length header field. Should fix some, but probably not all, problems with serving files bigger than 2G on 32-bit architectures. ok reyk@, florian@
* Implement byte ranges.florian2015-05-031-1/+8
| | | | | From Sunil Nimmagadda <sunil At nimmagadda DOT net> OK benno@
* Regis Leroy reported that httpd does not strictly accept CRLF forjsg2015-04-181-5/+6
| | | | | | | | | | newlines which could lead to http response splitting/smuggling if a badly behaved proxy is in front of httpd. Switch from evbuffer_readline() to evbuffer_readln() with EVBUFFER_EOL_CRLF_STRICT to avoid this. ok florian@
* Revert previous as this breaks stuff.florian2015-04-091-6/+1
| | | | | I fscked up the testing, sorry! Found the hard way by jsg@
* Do not silently accept multiple Content-Length headers.florian2015-04-081-1/+6
| | | | | | Pointed out by Regis Leroy (regis.leroy AT makina-corpus DOT com), thanks! Tweak and OK reyk@
* Allow to specify CGI variables as macros in redirection strings, eg.reyk2015-02-231-3/+107
| | | | | | block return 301 "http://www.example.com/$REQUEST_URI" OK tedu@ florian@
* spacingreyk2015-02-081-2/+3
|
* spacingreyk2015-02-071-11/+12
|
* Add support for blocking, dropping, and redirecting requests.reyk2015-02-071-2/+11
| | | | OK florian@
* Fix log options in locations.reyk2015-02-061-4/+4
| | | | | Reported and tested by Markus Bergkvist OK florian@
* Fix potential NULL pointer dereference.reyk2015-02-051-5/+6
|
* httpd is based on relayd and had included many headers that are onlyreyk2015-01-211-11/+3
| | | | | | | | | needed by its ancestor. jsg@, include-what-you-use, and some manual review helped to cleanup the headers (take iwyu with a grain of salt). Based on common practice, httpd.h now also includes the necessary headers for itself. OK florian@
* Log the remote user in the access.log.florian2015-01-191-8/+10
| | | | Pointed out by, tweak & OK reyk@
* s/clt_fcgi_remote_user/clt_remote_user/florian2015-01-191-7/+7
| | | | OK reyk@
* Decouple auth parameters from struct server_config into struct auth.reyk2015-01-191-3/+4
| | | | OK florian@
* First stab at implementing basic auth.florian2015-01-181-2/+97
| | | | | | | | Currently the htpasswd file needs to be in the chroot; will hopefully improved soonish. Based on a diff from Oscar Linderholm many months ago but turned into a complete rewrite. input/OK reyk@
* Replace <sys/param.h> with <limits.h> and other less dirty headers wherederaadt2015-01-161-4/+5
| | | | | | | | | possible. Annotate <sys/param.h> lines with their current reasons. Switch to PATH_MAX, NGROUPS_MAX, HOST_NAME_MAX+1, LOGIN_NAME_MAX, etc. Change MIN() and MAX() to local definitions of MINIMUM() and MAXIMUM() where sensible to avoid pulling in the pollution. These are the files confirmed through binary verification. ok guenther, millert, doug (helped with the verification protocol)
* bump copyright yearreyk2015-01-131-2/+2
|
* I missed one goto abort instead of free(line).reyk2015-01-061-3/+2
| | | | Found by Fabian Raetz at gmail
* Instead of calling free(line) in each error case, call it once in fail:.reyk2015-01-061-22/+13
| | | | From Fabian Raetz at gmail
* Return "400 Bad Request" instead of "500 Internal Server Error" forreyk2015-01-061-3/+5
| | | | | | unknown/invalid HTTP requests. From Fabian Raetz at gmail
* add new url stripping option:chrisz2015-01-041-1/+16
| | | | | | | | | | strip number Strip number path components from the beginning of the request URI before looking up the stripped-down URI at the document root. reviewed with much patience and OK by reyk@
* Use the HTML5 doctype for error and auto index pages because it isreyk2015-01-011-3/+2
| | | | | | | | shorter, newer, and the recommendation. From James Jerkins. Exclude the charset for now because it is not explicitly handled by httpd. OK validator.w3.org (This document was successfully checked as HTML5!)
* Stop pulling in <arpa/inet.h> or <arpa/nameser.h> when unnecessary.guenther2014-12-211-2/+1
| | | | | | *Do* pull it in when in_{port,addr}_h is needed and <netinet/in.h> isn't. ok reyk@
* Do not send an error body in a HEAD request answer.florian2014-12-081-17/+25
| | | | | From Bertrand Janin (b at janin dot com), thanks! OK reyk@
* stop viral header propagation. none of this code uses sys/hash.htedu2014-12-041-2/+1
| | | | from Max Fillinger
* Remove unnecessary netinet/in_systm.h include.lteo2014-10-251-2/+1
| | | | ok millert@
* URL-decode the request path.reyk2014-10-221-1/+2
| | | | | Tested by ajacoutot@ and others OK doug@
* Rework the error message a little bit: Do not send details of thereyk2014-10-211-10/+14
| | | | | | | | | error. Traditionally, web servers responsed with the request path on 40x errors which could be abused to inject JavaScript etc. Instead of sanitizing the path, we just don't reprint it. Also modify the style a little bit but keep Comic Sans. With input from Jonas Lindemann and doug@
* whitespace spotted while studying the codederaadt2014-09-291-3/+3
|
* Make the HTTP version mandatory and abort if it is missing in the request.reyk2014-09-151-6/+8
|
* Handle different possible variations of the Host header (eg.reyk2014-09-101-6/+65
| | | | | | | | | | www.example.com, www.example.com:80, [2001:db8::1], [2001:db8::1]:80). The port is optional and is typically used on non-default ports. If the server name is a plain IPv6 address, it is commonly specified in square brackets. Makes ajacoutot@ happy OK florian@
* Add various RFC-based WebDAV methods to the list of accepted HTTP methods.reyk2014-09-051-6/+29
| | | | | | This fixes (Fast)CGI-based WebDAV and CalDAV (calendar) servers with httpd. ok benno@ stsp@
* Remove a limitation that only allowed to specify a server name once.reyk2014-09-051-1/+13
| | | | | | | | | The key has been changed to server name + address + port and now it is possible to use the same server name for multiple servers with different addresses, eg. http://www.example.com and https://www.example.com/. OK doug@ florian@
* Use two instead of one http descriptor for request and response.reyk2014-08-291-30/+48
| | | | OK chrisz@
* Add Last-Modified: HTTP header.chrisz2014-08-211-12/+18
| | | | OK reyk@
* When opening directories, re-match the location after the index filereyk2014-08-081-10/+23
| | | | | | | has been appended. This allows to use a fastcgi target as the default index, for example index.php. OK florian@
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.