summaryrefslogtreecommitdiff
path: root/usr.sbin/httpd/parse.y
AgeCommit message (Collapse)Author
2017-03-25Implement TLS ticket support in httpd. Off by default. UseClaudio Jeker
tls ticket lifetime default to turn it on with a 2h ticket lifetime. Rekeying happens after a quarter of that time. OK reky@ and bob@
2017-02-07/tmp/cvsspEkokReyk Floeter
2017-01-27More s/OSCP/OCSP/ typosTom Cosgrove
ok jmc@
2017-01-05Replace hand-rolled for(;;) emptying of 'symhead' TAILQ with moreKenneth R Westerback
modern TAILQ_FOREACH_SAFE(). No intentional functional change. ok millert@ bluhm@ gilles@
2017-01-05Replace symset()'s hand-rolled for(;;) traversal of 'symhead' TAILQKenneth R Westerback
with more modern TAILQ_FOREACH(). This what symget() was already doing. Add paranoia '{}' around body of symget()'s TAILQ_FOREACH(). No intentional functional change. ok bluhm@ otto@
2016-11-17Move OCSP loading into a separate function - it is not part of the keypairJoel Sing
and this way we can give a separate specific error message. ok beck@ reyk@
2016-11-06since ocsp stapling is optional, make sure we guard if we do not have it.Bob Beck
ok jsing@
2016-11-06Add OCSP stapling support to httpdBob Beck
ok jsing@ bcook@
2016-09-03Replace [RELAY|SERVER]_MAXPROC with the new PROC_MAX_INSTANCESReyk Floeter
variable and limit it from 128 to 32 instances (the old value). While here, move a few PROC_ defines around. OK rzalamena@
2016-08-22Enable SNI support in httpd(8).Joel Sing
ok reyk@
2016-08-15Move server_match() from parse.y to server.c; use env instead of conf,Joel Sing
which is actually the same thing (cluebat from reyk@).
2016-08-15Make httpd stricter with respect to TLS configuration - in particular, doJoel Sing
not allow TLS and non-TLS to be configured on the same port, do not allow TLS options to be specified without a TLS listener and ensure that the TLS options are the same when a server is specified on the same address/port. Currently, these configurations are permitted but do not work as intended. Also factor out and reuse the server matching code, which was previously duplicated. ok reyk@
2016-06-21do not allow whitespace in macro names, i.e. "this is" = "a variable".Sebastian Benoit
change this in all config parsers in our tree that support macros. problem reported by sven falempin. feedback from henning@, stsp@, deraadt@ ok florian@ mikeb@
2015-11-22Update log.c: change fatal() and fatalx() into variadic functions,Reyk Floeter
include the process name, and replace all calls of fatal*(NULL) with fatal(__func__) for better debugging. OK benno@
2015-08-20stdlib.h is in scope; do not cast malloc/calloc/realloc*Theo de Raadt
ok millert krw
2015-08-20Change httpd(8) to use C99-style fixed-width integers (uintN_t insteadReyk Floeter
of u_intN_t) and replace u_int with unsigned int. Mixing both variants is a bad style and most contributors seem to prefer this style; it also helps us to get used to it, portability, and standardization. Theoretically no binary change, except one in practice: httpd.o has a different checksum because gcc with -O2 pads/optimizes "struct privsep" differently when using "unsigned int" instead "u_int" for the affected members. "u_int" is just a typedef of "unsigned int", -O0 doesn't build the difference and clang with -O2 doesn't do it either - it is just another curiosity from gcc-land. OK semarie@
2015-08-19spacingReyk Floeter
2015-07-19For the completeness of HSTS, add the non-standard preload option.Reyk Floeter
OK florian@
2015-07-18Allow to change the default media type globally or per-location,Reyk Floeter
eg. default type text/html. OK florian@
2015-07-18Implement HTTP Strict Transport Security (HSTS).Florian Obser
Input & OK reyk
2015-07-16spacingReyk Floeter
2015-07-15Unbreak configurations that have a non-TLS listen statement followed by aJoel Sing
TLS listen statement. A bug was introduced in r1.68 of parse.y, which results in flags being directly copied from the parent, meaning that the TLS flag for the second server gets lost. ok reyk@
2015-06-23Add initial support for pattern matching using Lua's pattern matching code.Reyk Floeter
With important help on the pattern matcher from semarie@ OK semarie@
2015-04-01Zero the tls cert/key length variables when inheriting a serverJonathan Gray
configuration for multiple listen statements in a server block. Otherwise httpd will crash when a listen statement with tls is followed by a listen statement without tls. Problem reported by Kent Fritz on misc. ok jsing@ looks good deraadt@
2015-03-09Make httpd TLSv1.2-only by default. Some older browsers, like IE 10,Reyk Floeter
will be incompatible with this change. We do this early in the release cycle, so there is a good chance to get more experience with the impact of it and the upcoming restricted cipher modes. OK jsing@ deraadt@ benno@ bmercer@ krw@ florian@
2015-02-12Allow TLS protocols to be specified via a "tls protocols" configurationJoel Sing
option. ok reyk@
2015-02-08Use AI_ADDRCONFIG when resolv hosts on startup.Reyk Floeter
OK henning@
2015-02-08spacingReyk Floeter
2015-02-07Add httpd configuration options to allow the specification of DHEJoel Sing
parameters and the ECDHE curve. This primarily allows for DHE cipher suites to be enabled. ok reyk@
2015-02-07Add support for blocking, dropping, and redirecting requests.Reyk Floeter
OK florian@
2015-02-06Fix log options in locations.Reyk Floeter
Reported and tested by Markus Bergkvist OK florian@
2015-01-29Fix a regression that removed support for using service names insteadReyk Floeter
of ports. It is now possible to use "listen on * port www" again. Found by ajacoutot@ OK ajacoutot@ blambert@
2015-01-21httpd is based on relayd and had included many headers that are onlyReyk Floeter
needed by its ancestor. jsg@, include-what-you-use, and some manual review helped to cleanup the headers (take iwyu with a grain of salt). Based on common practice, httpd.h now also includes the necessary headers for itself. OK florian@
2015-01-19No need to include pfvar.h, another leftover from relayd. It was alsoReyk Floeter
used for portrange operators which weren't used in httpd. OK florian@
2015-01-19Decouple auth parameters from struct server_config into struct auth.Reyk Floeter
OK florian@
2015-01-18First stab at implementing basic auth.Florian Obser
Currently the htpasswd file needs to be in the chroot; will hopefully improved soonish. Based on a diff from Oscar Linderholm many months ago but turned into a complete rewrite. input/OK reyk@
2015-01-16Replace <sys/param.h> with <limits.h> and other less dirty headers whereTheo de Raadt
possible. Annotate <sys/param.h> lines with their current reasons. Switch to PATH_MAX, NGROUPS_MAX, HOST_NAME_MAX+1, LOGIN_NAME_MAX, etc. Change MIN() and MAX() to local definitions of MINIMUM() and MAXIMUM() where sensible to avoid pulling in the pollution. These are the files confirmed through binary verification. ok guenther, millert, doug (helped with the verification protocol)
2015-01-13bump copyright yearReyk Floeter
2015-01-07Relax configuration list parsing to allow multi-line blocks for tls,Reyk Floeter
root, tcp etc. Based on a diff from Nathanael Rensen. OK florian@
2015-01-06Only open a socket once for each unique "listen on" statement. ThisReyk Floeter
prevents running out of file descriptors when loading a configuration with many aliases. OK florian@
2015-01-04add new url stripping option:Christopher Zimmermann
strip number Strip number path components from the beginning of the request URI before looking up the stripped-down URI at the document root. reviewed with much patience and OK by reyk@
2015-01-03Reset tls key and cert to NULL when duplicating a server - avoids aReyk Floeter
possible double free in the error path of the parser. Found by + OK doug@
2015-01-03Tweak previous - add a missing free in the error path.Reyk Floeter
2015-01-03Support alias names and multiple listen statements per server block.Reyk Floeter
The implementation is done in the parser by expanding each alias/listen into an independent server configuration; this makes it easier to handle internally without adding additional loops or conditions. OK florian@
2014-12-21Stop pulling in <arpa/inet.h> or <arpa/nameser.h> when unnecessary.Philip Guenther
*Do* pull it in when in_{port,addr}_h is needed and <netinet/in.h> isn't. ok reyk@
2014-12-18Accept * as an alias for the default ipv4 listen address.Reyk Floeter
OK jsg@
2014-12-12Like previously done in relayd, change the keyword "ssl" to "tls" toReyk Floeter
reflect reality. OK benno@
2014-12-04stop viral header propagation. none of this code uses sys/hash.hTed Unangst
from Max Fillinger
2014-11-20Don't allow embedded nul characters in strings.Jonathan Gray
Fixes a pfctl crash with an anchor name containing an embedded nul found with the afl fuzzer. pfctl parse.y patch from and ok deraadt@
2014-11-11Allow the log directory to be configurable in the config file, rather thanBob Beck
fixed as /logs within the chroot. As this httpd is properly privesp'ed this has the nice property of allowing us to put the logs outside the chroot if we want to. ok reyk@
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-03 19:12:14 +0000