summaryrefslogtreecommitdiff
path: root/usr.sbin/httpd/parse.y
AgeCommit message (Collapse)Author
2021-04-10Do not compare TLS config params for non-TLS servers. This allows toClaudio Jeker
mix 'listen * port 80' and 'listen * tls port 443' in one server block. Also the last argument of server_tls_cmp - match_keypair - is always 0 so remove this code. OK florian@ tb@ some long time ago
2021-01-22fix a memory leak, found by rob@ in relayd.Sebastian Benoit
ok tb@
2021-01-18Fix httpd example configTheo Buehler
A server configuration yields multiple struct server_config in the env->sc_servers queue: an actual server ("parent") and one for each location directive in httpd.conf. In parent_configure(), the parents are configured first, then the corresponding locations. parse.y r1.118 kills the parent if an error is encountered on loading the TLS keypairs but leaves the locations in the sc_servers queue. When running the default config without TLS keys already in place, this then leads to the self-explanatory "invalid location" error message. Its intention is to indicates the unexpected situation that config_setserver() encounters a location without an associated server. Fix this by not only destroying the parent but also removing all of its locations. ok jsing
2020-12-30getifaddrs() can return entries where ifa_addr is NULL. Check for thisSebastian Benoit
before accessing anything in ifa_addr. ok claudio@
2020-11-20remove an unused structJoerg Jung
from Edgar Pettijohn ok kn
2020-10-29Add location (found|not found) option to test for resource path existence.denis
Diff by Matthias Pressfreund <mpfr @ fn de>. Thanks.
2020-10-26Do not allow duplicate "location" directive.denis
Found and fix by Matthias Pressfreund <mpfr @ fn de>. Thanks.
2020-10-11Handle absence of TLS certs while parsing the configTheo Buehler
There is a soft fail mechanism to handle missing certs for seamless interaction with acme-client. Move this to the config parser. This is simpler than server.c r1.117 and avoids a crash due to listening on port 443 without having set up the TLS context first. More precisely, the crash happens if a server with missing certificate is visited via https in a configuration where there is a second server with valid certificate and key. From Joshua Sing (joshua at hypera dot dev) ok benno
2020-08-26Set fastcgi socket default on server and location.Florian Obser
This allows "fastcgi" directly inside of a server directive without giving specifying socket. OK tracey
2020-08-25check that fcgiport string value is within rangetracey
remove redundant error message tweaks and ok florian@
2020-08-24Add support for non-localhost fastcgi sockets.tracey
Lots of review time kn@ Lots of review time, tweaks, and ok florian@
2020-02-09Implement "strip" option for fastcgi to be able to have multiple chrootsFlorian Obser
under /var/www for FastCGI servers. From Nazar Zhuk (nazar AT zhuk DOT online), thanks! Ok benno
2019-06-28When system calls indicate an error they return -1, not some arbitraryTheo de Raadt
value < 0. errno is only updated in this case. Change all (most?) callers of syscalls to follow this better, and let's see if this strictness helps us in the future.
2019-05-08spacingReyk Floeter
2019-05-03Add a "forwarded" log format that extends the "combined" log formatTheo Buehler
by including the contents of the X-Forwarded-For and X-Forwarded-Port headers. If httpd(8) runs behind a proxy like relayd(8), this allows tracking the origin of the requests. The format is compatible with log analyzers such as GoAccess and Webalizer. Patch from Bruno Flueckiger ok benno, reyk
2019-02-19httpd(8): add support for setting custom FastCGI parameters.Paul Irofti
This commit extends the existing grammar by adding the param option to the fastcgi directive: fastcgi param name value. Example usage: fastcgi param VAR1 hello fastcgi param VAR2 world With help and OK florian@ Rogue manpage bits, feel free to modify them.
2019-02-13(unsigned) means (unsigned int) which on ptrdiff_t or size_t or otherTheo de Raadt
larger types really is a range reduction... Almost any cast to (unsigned) is a bug. ok millert tb benno
2019-01-08Allow httpd(8) to start when TLS is configured but a cert is not yetFlorian Obser
available. Assuming a httpd.conf based on /etc/examples/httpd.conf, httpd(8) will only listen on port 80 and serve the acme-challenge directory for acme-client(1). The workflow to get a certificate then becomes acme-client -vAD example.com && rcctl reload httpd Without the need to edit the httpd.conf yet again. Once the cert is in place and httpd is reloaded it starts to serve on port 443. Idea, tweaks & OK deraadt, OK benno
2018-11-01- odd condition/test in PF lexerAlexandr Nedvedicky
(and other lexers too) This commit rectifies earlier change: in the lex... even inside quotes, a \ followed by space or tab should expand to space or tab, and a \ followed by newline should be ignored (as a line continuation). compatible with the needs of hoststated (which has the most strict quoted string requirements), and ifstated (where one commonly does line continuations in strings). OK deraadt@, OK millert@
2018-09-07replace malloc()+strlcpy() with strndup() in cmdline_symset().miko
"looks good" gilles@ halex@
2018-07-11Do for most running out of memory err() what was done for most runningKenneth R Westerback
out of memory log_warn(). i.e. ("%s", __func__) instead of manual function names and redundant verbiage about which wrapper detected the out of memory condition. ok henning@
2018-07-09No need to mention which memory allocation entry point failed (malloc,Kenneth R Westerback
calloc or strdup), we just need to log that we ran out of memory in a particular function. Recommended by florian@ and deraadt@ ok benno@ henning@ tb@
2018-06-20Add support for simple one-off internal rewrites.Reyk Floeter
For example: location match "/page/(%d+)/.*" { request rewrite "/static/index.php?id=%1&$QUERY_STRING" } Requested by many. Ok benno@
2018-06-13Rename httpd.conf "root strip" option to "request strip".Reyk Floeter
"root strip" was semantically incorrect and did cause some confusion as it never stripped the root but the client's request path. Discussed with many. Heads up: this is a grammar change that also affects acme-client(1) configurations (see current.html). OK claudio@
2018-06-11Sorry, forgot a whitespace.denis
Spotted by benno@
2018-06-11Fix an off-by-one line count when using include statements.denis
Thanks to otto@ for the initial diff. OK benno@
2018-05-23Set the port.op value when parsing the httpd.conf port value.Alexander Bluhm
Otherwise the default port for http or https may used depending on uninitialized memory. Fixes regress on i386. OK reyk@
2018-05-19Add support for client certificate authentication to httpd.Joel Sing
From Jack Burton <jack at saosce dot com dot au> - thanks! Also tested by Jan Klemkow <j.klemkow at wemelug dot de>. ok beck@ reyk@
2018-05-18Move LISTEN ON {} code into a function listen_on().Reyk Floeter
No functional change, but it makes it easier to deal with the grammar.
2018-05-18Revert previous: it introduced a shift/reduce conflict in the grammar.Reyk Floeter
2018-05-18Allow to omit the listen port configuration. Default to port 80, tls port 443.Reyk Floeter
OK florian@ jmc@
2018-04-26Plug leak in error case of the common 'varset' implementations.Kenneth R Westerback
ok benno@
2018-04-11Make httpd listen on all IPv4 and IPv6 addresses forFlorian Obser
"listen on * port 80". While here accept up to 16 addresses from DNS or interface groups. requested by & "lovely" deraadt@ OK kn@
2017-08-2865535 is a valid port to listen on.Florian Obser
Off-by-one pointed out by and diff from Kris Katterjohn katterjohn AT gmail, thanks! chris@ pointed out that more than httpd(8) is effected. OK gilles@
2017-08-11Convert httpd to tls_config_set_ecdhecurves(), allowing a list of curvesJoel Sing
to be specified, rather than a single curve. ok beck@
2017-03-25Implement TLS ticket support in httpd. Off by default. UseClaudio Jeker
tls ticket lifetime default to turn it on with a 2h ticket lifetime. Rekeying happens after a quarter of that time. OK reky@ and bob@
2017-02-07/tmp/cvsspEkokReyk Floeter
2017-01-27More s/OSCP/OCSP/ typosTom Cosgrove
ok jmc@
2017-01-05Replace hand-rolled for(;;) emptying of 'symhead' TAILQ with moreKenneth R Westerback
modern TAILQ_FOREACH_SAFE(). No intentional functional change. ok millert@ bluhm@ gilles@
2017-01-05Replace symset()'s hand-rolled for(;;) traversal of 'symhead' TAILQKenneth R Westerback
with more modern TAILQ_FOREACH(). This what symget() was already doing. Add paranoia '{}' around body of symget()'s TAILQ_FOREACH(). No intentional functional change. ok bluhm@ otto@
2016-11-17Move OCSP loading into a separate function - it is not part of the keypairJoel Sing
and this way we can give a separate specific error message. ok beck@ reyk@
2016-11-06since ocsp stapling is optional, make sure we guard if we do not have it.Bob Beck
ok jsing@
2016-11-06Add OCSP stapling support to httpdBob Beck
ok jsing@ bcook@
2016-09-03Replace [RELAY|SERVER]_MAXPROC with the new PROC_MAX_INSTANCESReyk Floeter
variable and limit it from 128 to 32 instances (the old value). While here, move a few PROC_ defines around. OK rzalamena@
2016-08-22Enable SNI support in httpd(8).Joel Sing
ok reyk@
2016-08-15Move server_match() from parse.y to server.c; use env instead of conf,Joel Sing
which is actually the same thing (cluebat from reyk@).
2016-08-15Make httpd stricter with respect to TLS configuration - in particular, doJoel Sing
not allow TLS and non-TLS to be configured on the same port, do not allow TLS options to be specified without a TLS listener and ensure that the TLS options are the same when a server is specified on the same address/port. Currently, these configurations are permitted but do not work as intended. Also factor out and reuse the server matching code, which was previously duplicated. ok reyk@
2016-06-21do not allow whitespace in macro names, i.e. "this is" = "a variable".Sebastian Benoit
change this in all config parsers in our tree that support macros. problem reported by sven falempin. feedback from henning@, stsp@, deraadt@ ok florian@ mikeb@
2015-11-22Update log.c: change fatal() and fatalx() into variadic functions,Reyk Floeter
include the process name, and replace all calls of fatal*(NULL) with fatal(__func__) for better debugging. OK benno@
2015-08-20stdlib.h is in scope; do not cast malloc/calloc/realloc*Theo de Raadt
ok millert krw
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-13 22:05:28 +0000