summaryrefslogtreecommitdiff
path: root/usr.sbin/httpd/server_fcgi.c
AgeCommit message (Collapse)Author
2017-07-31Don't set HTTP date header if already set.ians
Thanks Nick Owens OK florian@
2017-01-21The POSIX APIs that that sockaddrs all ignore the s*_len field in thePhilip Guenther
incoming socket, so userspace doesn't need to set it unless it has its own reasons for tracking the size along with the sockaddr. ok phessler@ deraadt@ florian@
2016-10-07The strchr() call either returns a NULL pointer, on which the code willPatrick Wildt
break out of the loop, or a pointer to ':'. Thus the extra check for ':' is unnecessary and can be removed. ok jung@
2016-10-07Empty lines cause server_fcgi_getheaders() to immediately return.Patrick Wildt
Unfortunately in that case the line was not freed. This lead to a memleak on each request. Thus, save the return value prior to returning, free the line and return the saved value. ok jung@
2016-09-01struct client starts to become the kitchen sink. Move fastcgi data toFlorian Obser
its own struct. Requested by and OK reyk@
2016-09-01spacingReyk Floeter
2016-08-30Do not assume that the full http response header is in the firstFlorian Obser
fastcgi stdout record. Keep processing stdout records until we found the header / body separator and only then generate the header response. Problem reported by many. OK jung@
2016-04-24Always pass QUERY_STRING variable.Christopher Zimmermann
According to the RFC it is empty when no query string was found. From Tim Baumgard <openbsd@bmgrd.com>o ok florian@
2015-11-23Retire socket_set_blockmode() in favor of the SOCK_NONBLOCK type flag.Reyk Floeter
As done in iked and snmpd. OK jung@
2015-10-08fix an fd leak if socket connection fails; from Carlin BinghamJonathan Gray
ok reyk@
2015-10-08fix a typo; from Carlin BinghamJonathan Gray
2015-08-20Change httpd(8) to use C99-style fixed-width integers (uintN_t insteadReyk Floeter
of u_intN_t) and replace u_int with unsigned int. Mixing both variants is a bad style and most contributors seem to prefer this style; it also helps us to get used to it, portability, and standardization. Theoretically no binary change, except one in practice: httpd.o has a different checksum because gcc with -O2 pads/optimizes "struct privsep" differently when using "unsigned int" instead "u_int" for the affected members. "u_int" is just a typedef of "unsigned int", -O0 doesn't build the difference and clang with -O2 doesn't do it either - it is just another curiosity from gcc-land. OK semarie@
2015-08-03Fix rev 1.70 of server.c by only re-enabling the bufferevent if weFlorian Obser
previously disabled it because we were reading to fast (from disk). Problem noted and tracked down to that commit by weerd@ and independently by stsp@. Tested by weerd@, stsp@, reyk@ OK bluhm@, reyk@
2015-07-31repair hsts header output, wrong format strings caused brokenSebastian Benoit
Strict-Transport-Security headers. Add __format__ attribute to kv_set() and kv_setkey() to make it easier to spot such problems. Found by and fix from Donovan Watteau <tsoomi -AT- gmail -DOT- com>, thanks for your help. ok deraadt@
2015-07-29backout the previous: it broke wordpress somehow.Reyk Floeter
we need more care to find a proper fix for the fastcgi headers. acknowledged by deraadt@
2015-07-29Read fcgi response records until we have the whole http header and canFlorian Obser
parse it. Otherwise http headers can leak into the body. Pointed out by Jean-Philippe Ouellet on bugs@ Thanks! OK reyk, commit ASAP deraadt@
2015-07-28add HSTS to fcgi responsesFlorian Obser
OK reyk
2015-07-19handle error returns from bufferevent_write()Bret Lambert
ok florian@
2015-07-18remove XXX and handle error return from evbuffer_add()Bret Lambert
ok florian@
2015-07-18treat asprintf failure in REQUEST_URI case as a fatal errorBret Lambert
ok florian@
2015-07-17According to RFC 3875 PATH_INFO should either contain a full path orReyk Floeter
be empty (""). It was not set at all when there is nothing to set which caused problems with some FastCGI applications (like Flask/Python through uWSGI). From hrkfdn via github
2015-06-09plug fd leak found by Todd MortimerJoerg Jung
ok claudio deraadt florian
2015-03-26Allow more characters in CGI environment variables as specified by RFCFlorian Obser
7230 and RFC 3875. sthen@ suggested to add a comment to explain where the list of characters is coming from. Found the hard way and initial diff from Tim van der Molen (tbvdm at xs4all), thanks! Some more allowed characters added by me. OK sthen@
2015-02-23Use the rewritten (index file appended) uri as DOCUMENT_URI.Christopher Zimmermann
OK florian@
2015-01-21Ooops, no need to include sys/cdefs.h.Reyk Floeter
Pointed out by florian@
2015-01-21httpd is based on relayd and had included many headers that are onlyReyk Floeter
needed by its ancestor. jsg@, include-what-you-use, and some manual review helped to cleanup the headers (take iwyu with a grain of salt). Based on common practice, httpd.h now also includes the necessary headers for itself. OK florian@
2015-01-19s/clt_fcgi_remote_user/clt_remote_user/Florian Obser
OK reyk@
2015-01-19Decouple auth parameters from struct server_config into struct auth.Reyk Floeter
OK florian@
2015-01-18First stab at implementing basic auth.Florian Obser
Currently the htpasswd file needs to be in the chroot; will hopefully improved soonish. Based on a diff from Oscar Linderholm many months ago but turned into a complete rewrite. input/OK reyk@
2015-01-16Replace <sys/param.h> with <limits.h> and other less dirty headers whereTheo de Raadt
possible. Annotate <sys/param.h> lines with their current reasons. Switch to PATH_MAX, NGROUPS_MAX, HOST_NAME_MAX+1, LOGIN_NAME_MAX, etc. Change MIN() and MAX() to local definitions of MINIMUM() and MAXIMUM() where sensible to avoid pulling in the pollution. These are the files confirmed through binary verification. ok guenther, millert, doug (helped with the verification protocol)
2015-01-13Abort if fcgi_chunked is not true to avoid sending additional garbageReyk Floeter
after the response. Found by Erik Lax ok florian@
2015-01-04add new url stripping option:Christopher Zimmermann
strip number Strip number path components from the beginning of the request URI before looking up the stripped-down URI at the document root. reviewed with much patience and OK by reyk@
2014-12-21Stop pulling in <arpa/inet.h> or <arpa/nameser.h> when unnecessary.Philip Guenther
*Do* pull it in when in_{port,addr}_h is needed and <netinet/in.h> isn't. ok reyk@
2014-12-12Like previously done in relayd, change the keyword "ssl" to "tls" toReyk Floeter
reflect reality. OK benno@
2014-12-04stop viral header propagation. none of this code uses sys/hash.hTed Unangst
from Max Fillinger
2014-10-25Remove unnecessary netinet/in_systm.h include.Lawrence Teo
ok millert@
2014-09-29whitespace spotted while studying the codeTheo de Raadt
2014-09-02FastCGI did not support persistent connections. Add initial supportReyk Floeter
for persistent connections with FastCGI by implementing chunked Transfer-Encoding. This only works with HTTP/1.1. With input and help from florian@ who found some FastCGI edge cases. OK florian@
2014-09-01Don't pass the local buffer array by reference.Reyk Floeter
OK florian@
2014-09-01Replace the code to get the FastCGI Status header with a proper way toReyk Floeter
parse and write the headers using the http response descriptor. This allows to add other tweaks, like support for chunked encoding, later. OK florian@
2014-08-29Use two instead of one http descriptor for request and response.Reyk Floeter
OK chrisz@
2014-08-21Add Last-Modified: HTTP header.Christopher Zimmermann
OK reyk@
2014-08-13For a non-existent root we don't want the root prefix to show up inChristopher Zimmermann
PATH_INFO. Therefore put a lower bound of strlen(root) on scriptlen. This makes perfect sense for virtual FastCGI scripts which run chrooted in another directory from httpd. ok reyk@
2014-08-13Provide a failsafe version of the path_info() function that doesn'tReyk Floeter
need a temporary path variable. Based on an initial diff from chrisz@. "Commit any failsafe version and I'm ok with it" chrisz@
2014-08-11make a few variables more localTheo de Raadt
2014-08-08When opening directories, re-match the location after the index fileReyk Floeter
has been appended. This allows to use a fastcgi target as the default index, for example index.php. OK florian@
2014-08-07Don't try to ouput FCGI_STDERR into error.log if there is no data.Florian Obser
Problem noticed by naddy@, OK reyk@
2014-08-07Opportunistically try to parse "Status: $code" in the very firstFlorian Obser
response from the fcgi daemon and use that code as HTTP response code. If it doesn't work out fall back to code 200. This might fix naddy@'s issue with redirects in cvsweb. To be revisited after unlock. Discussed with & grudgingly OK reyk@
2014-08-06Write STDERR from the CGI to the web server error log as intended.Reyk Floeter
OK florian@
2014-08-06If the very first fcgi STDOUT record has length 0 the cgi scriptFlorian Obser
didn't send anything back. This is an internal server error. OK reyk@
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-01 21:01:15 +0000