summaryrefslogtreecommitdiffstats
path: root/usr.sbin/httpd (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Use the simpler HTML5 idiom to declare charset in autogenerated pages.bentley2020-05-222-6/+4
| | | | | | | This came from a suggestion by Andras Farkas to replace use of XHTML self-closing tags. ok cwen@ danj@ florian@
* httpd: add a "dark mode" in directory listings and error pagescwen2020-05-182-4/+11
| | | | | | | | | | | | | Introduce a new "dark mode" for httpd(8) directory listings and error pages, using the prefers-color-scheme css function. It uses the colorscheme already used in OpenBSD project websites. This version will only be displayed if the user's browser specifically sends a "prefer darker themes if available" request. Input from florian@, danj@ and clematis. OK florian@, danj@ (on a previous version with the wrong background color)
* list example files in FILES with a short description: generally, "Examplejmc2020-05-161-2/+7
| | | | | | | configuration file.", but occasionally something else fit better; at the same time, try to make the format for FILES more consistent; original diff from clematis
* replace examples of "Ic arg Ic arg" with "Ic arg arg" and stop the spread;jmc2020-04-231-3/+3
|
* httpd: allow $REQUEST_SCHEME in redirect targets, ok jung@ florian@sthen2020-02-252-4/+17
| | | | | | | | | Sometimes you want to redirect a request to another site but maintaining the same type of connection (http or https) as the original request. Allow a $REQUEST_SCHEME variable to be used in redirect locations to allow this, e.g. location "/cgi-bin/foobar*" { block return 302 "$REQUEST_SCHEME://foobar.example.org$REQUEST_URI" }
* Implement "strip" option for fastcgi to be able to have multiple chrootsflorian2020-02-094-8/+23
| | | | | | under /var/www for FastCGI servers. From Nazar Zhuk (nazar AT zhuk DOT online), thanks! Ok benno
* Pick the value for "max requests number" from the correct server {}benno2020-01-141-8/+8
| | | | | | | | | | | | section in the config, by moving the code down where the Host: header has been read and the correct server configuration selected. Note that it may not be that useful to have this option per server, because it is valid to send requests with different Host: headers over the same tcp connection. problem noted and diff from Tracey Emery, thanks! ok florian@
* remove useless NULL check, it's checked 7 lines further up.benno2019-11-041-4/+1
| | | | found by Clemens Goessnitzer, ok and prodded by florian@
* Do not log "(null)" in debug logging.florian2019-10-221-2/+3
| | | | OK deraadt
* httpd(8) sent a 408 response every time a connection request timeoutflorian2019-10-141-2/+5
| | | | | | | | | | | | | | | | was reached. This is not what other servers are doing, it leads to ugly log messages and might confuse some clients. benno@ analyzed that the correct behavior is (probably) to send a 408 when we are in the middle of receiving headers and time out there and just close the connection in all other cases. In particular, if a connection gets opened and no request is received at all just close the connection. If a connection is set to keep-alive and a request was handled and no further request is coming in just close the connection. The later is the usual cause for spurious log messages and client confusion. Reported over the years by many. Input, explanations and OK benno
* When system calls indicate an error they return -1, not some arbitraryderaadt2019-06-282-5/+5
| | | | | | value < 0. errno is only updated in this case. Change all (most?) callers of syscalls to follow this better, and let's see if this strictness helps us in the future.
* The QUERY_STRING macro is not actually URL encoded, so fix the manual.tb2019-05-082-5/+19
| | | | | | | | Add a QUERY_STRING_ENC macro that is URL encoded. Patch from Tim Baumgartner ok reyk
* Set the REQUEST_URI CGI variable to the requested URI and query stringtb2019-05-083-15/+22
| | | | | | | | instead of the rewritten path and query string. Patch from Tim Baumgard, reminded by Mischa Peters. ok benno, reyk
* spacingreyk2019-05-085-15/+16
|
* Add a "forwarded" log format that extends the "combined" log formattb2019-05-034-12/+64
| | | | | | | | | | | by including the contents of the X-Forwarded-For and X-Forwarded-Port headers. If httpd(8) runs behind a proxy like relayd(8), this allows tracking the origin of the requests. The format is compatible with log analyzers such as GoAccess and Webalizer. Patch from Bruno Flueckiger ok benno, reyk
* Avoid opening log files on "no log"kn2019-05-021-2/+2
| | | | | | | | When not logging anything, do not open files in the first place. This prevents startup failures on configurations where the log/ directory is missing but logging is disabled anyway. OK aja solene reyk
* document where multiline {} is applicable;jmc2019-04-161-3/+10
| | | | | | | lack of documentation and original diff provided by alfred morgan; benno helped me track down the applicable options; ok benno
* reference the /etc/examples files for httpd and acme-client. started from a threadjmc2019-03-121-2/+11
| | | | | | | by alfred morgan, who wanted a tls example in the man page. florian noted that they exist already in /etc/examples; ok florian
* httpd(8): add support for setting custom FastCGI parameters.pirofti2019-02-196-10/+180
| | | | | | | | | | | | This commit extends the existing grammar by adding the param option to the fastcgi directive: fastcgi param name value. Example usage: fastcgi param VAR1 hello fastcgi param VAR2 world With help and OK florian@ Rogue manpage bits, feel free to modify them.
* (unsigned) means (unsigned int) which on ptrdiff_t or size_t or otherderaadt2019-02-131-3/+3
| | | | | | larger types really is a range reduction... Almost any cast to (unsigned) is a bug. ok millert tb benno
* log X509 peer's cert subject name when tls client authentication is used,benno2019-02-101-2/+9
| | | | | | in the same way as the http authenticated username is loged. From Karel Gardas, gardask at gmail dot com, Thanks! ok florian@
* Improve fastcgi socket documentation and mention that TCP is supported inflorian2019-02-081-3/+12
| | | | | | | addition to UNIX domain sockets. Prompted by a mail from Daniel Gracia ( paladdin AT gmail ) pointing out that we are not documenting TCP support at all, thanks! Prodding by and with jmc@
* Allow httpd(8) to start when TLS is configured but a cert is not yetflorian2019-01-082-17/+22
| | | | | | | | | | | | | available. Assuming a httpd.conf based on /etc/examples/httpd.conf, httpd(8) will only listen on port 80 and serve the acme-challenge directory for acme-client(1). The workflow to get a certificate then becomes acme-client -vAD example.com && rcctl reload httpd Without the need to edit the httpd.conf yet again. Once the cert is in place and httpd is reloaded it starts to serve on port 443. Idea, tweaks & OK deraadt, OK benno
* Check maxrequestbody when we found the right server / location.florian2018-12-041-7/+7
| | | | | | Very patiently pointed out repeatedly by Tracey Emery ( tracey AT traceyemery.net ), thanks! OK benno
* isalpha(3) requires an unsigned char value (or -1).guenther2018-11-041-2/+2
| | | | from Hiltjo Posthuma (hiltjo(at)codemadness.org)
* - odd condition/test in PF lexersashan2018-11-011-2/+3
| | | | | | | | | | | | | | (and other lexers too) This commit rectifies earlier change: in the lex... even inside quotes, a \ followed by space or tab should expand to space or tab, and a \ followed by newline should be ignored (as a line continuation). compatible with the needs of hoststated (which has the most strict quoted string requirements), and ifstated (where one commonly does line continuations in strings). OK deraadt@, OK millert@
* Omit HSTS headers over unencrypted connections, per RFC 6797.bentley2018-10-152-5/+8
| | | | ok florian@
* Backout my previous commit:benno2018-10-113-18/+9
| | | | | | | | | | | | | | | date: 2018/10/01 19:24:09; author: benno; state: Exp; lines: +7 -1; commitid: 0O8fyHPNvPd8rvYU; Only send 408 Timeout responses when we have seen at least part of a request. Without a request, just close the connection when we hit request timeout. Prompted by a bug report from Nikola Kolev, thanks. ok reyk@ and some suggestions from claudio@ and bluhm@ Mark Patruck (mark AT wrapped DOT cx) found a problem with it, thanks for the report. ok reyk@ bluhm@ sthen@ deraadt@
* Only send 408 Timeout responses when we have seen at least part of abenno2018-10-013-9/+18
| | | | | | | request. Without a request, just close the connection when we hit request timeout. Prompted by a bug report from Nikola Kolev, thanks. ok reyk@ and some suggestions from claudio@ and bluhm@
* During the fork+exec implementation, daemon(3) was moved afterbluhm2018-09-093-9/+20
| | | | | | | proc_init(). As a consequence httpd(8) and relayd(8) child processes did not detach from the terminal anymore. Dup /dev/null to the stdio file descriptors in the children. OK benno@
* Do not send a Content-Length header for 1xx and 204 status codes sinceflorian2018-09-071-4/+18
| | | | | | | | RFC 7230 states that a server MUST NOT do so. At least relayd chokes on this. Pointed out & diff by Carlin Bingham (cb AT walcyrge.org), thanks! OK benno
* replace malloc()+strlcpy() with strndup() in cmdline_symset().miko2018-09-071-9/+4
| | | | "looks good" gilles@ halex@
* double the allowed length for the 'tls ciphers' optionjasper2018-08-191-2/+2
| | | | | | | for example now it can hold the recommended cipher list from the mozilla ssl config generator rather than failing with a "ciphers too long" error. ok benno@ sthen@ tb@
* Do for most running out of memory err() what was done for most runningkrw2018-07-111-4/+4
| | | | | | | | out of memory log_warn(). i.e. ("%s", __func__) instead of manual function names and redundant verbiage about which wrapper detected the out of memory condition. ok henning@
* No need to mention which memory allocation entry point failed (malloc,krw2018-07-091-4/+4
| | | | | | | | | calloc or strdup), we just need to log that we ran out of memory in a particular function. Recommended by florian@ and deraadt@ ok benno@ henning@ tb@
* Add support for simple one-off internal rewrites.reyk2018-06-205-18/+110
| | | | | | | | | | | | For example: location match "/page/(%d+)/.*" { request rewrite "/static/index.php?id=%1&$QUERY_STRING" } Requested by many. Ok benno@
* remove the SECTIONS header, since a one line DESCRIPTION is a bit silly;jmc2018-06-181-4/+4
| | | | | | | use a more general text for the sections, and avoid the catchup issue that was trying to document how many there were; ok benno rob
* Something went wrong - the strip option was documented twice.reyk2018-06-151-7/+2
| | | | Found by Mischa Peters, thanks
* Fix 304 Not Modified response: don't send a body, use the correct MIME type.reyk2018-06-152-8/+14
| | | | | | | | Reported by Hidvegi Gabor gaborca websivision hu Fix found by anton@ OK anton@
* one too many .El;jmc2018-06-131-2/+1
|
* Rename httpd.conf "root strip" option to "request strip".reyk2018-06-132-8/+25
| | | | | | | | | | "root strip" was semantically incorrect and did cause some confusion as it never stripped the root but the client's request path. Discussed with many. Heads up: this is a grammar change that also affects acme-client(1) configurations (see current.html). OK claudio@
* The http_query is already url_encoded; don't encode it twice.reyk2018-06-112-26/+11
| | | | | | | | | | This fixes a bug in the macros and log file handler that double-encoded the query. This does not change FCGI as it was already handling the query correctly. Additional verification of the QUERY_STRING should be implemented as well. OK claudio@
* Sorry, forgot a whitespace.denis2018-06-111-2/+2
| | | | Spotted by benno@
* Fix an off-by-one line count when using include statements.denis2018-06-111-48/+80
| | | | | | Thanks to otto@ for the initial diff. OK benno@
* Set the port.op value when parsing the httpd.conf port value.bluhm2018-05-231-1/+3
| | | | | | Otherwise the default port for http or https may used depending on uninitialized memory. Fixes regress on i386. OK reyk@
* Forgot to revert another "port 80"reyk2018-05-231-3/+3
| | | | Pointed out by jmc@
* Add support for client certificate authentication to httpd.jsing2018-05-196-9/+197
| | | | | | | | From Jack Burton <jack at saosce dot com dot au> - thanks! Also tested by Jan Klemkow <j.klemkow at wemelug dot de>. ok beck@ reyk@
* Move LISTEN ON {} code into a function listen_on().reyk2018-05-181-64/+74
| | | | No functional change, but it makes it easier to deal with the grammar.
* Revert manpage description as wellreyk2018-05-181-6/+3
|
* Revert previous: it introduced a shift/reduce conflict in the grammar.reyk2018-05-182-18/+7
|
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.