summaryrefslogtreecommitdiff
path: root/usr.sbin/httpd
AgeCommit message (Collapse)Author
2017-11-28Disable oscp stapling on invalid staple, rather than failing to start.Bob Beck
ok claudio@ florian@
2017-08-2865535 is a valid port to listen on.Florian Obser
Off-by-one pointed out by and diff from Kris Katterjohn katterjohn AT gmail, thanks! chris@ pointed out that more than httpd(8) is effected. OK gilles@
2017-08-11punctuation;Jason McIntyre
2017-08-11Convert httpd to tls_config_set_ecdhecurves(), allowing a list of curvesJoel Sing
to be specified, rather than a single curve. ok beck@
2017-07-31Don't set HTTP date header if already set.ians
Thanks Nick Owens OK florian@
2017-07-19Rework the way that TLS configuration is sent/received via imsgs, so thatJoel Sing
are no longer limited by the 16KB maximum size of a single imsg. Configuration data that is larger than a single message is now chunked and sent via multiple imsgs. Prompted by a diff from Jack Burton <jack at saosce dot com dot au>. ok reyk@
2017-07-03no need to generate y.tab.h if nothing uses it, set YFLAGS to nothingMarc Espie
instead of CLEANFILES += y.tab.h okay millert@
2017-06-10Fix broken escaping: "\." is almost never what you want; found withIngo Schwarze
mandoc -Tlint. While here, make macro usage more consistent.
2017-05-28use __func__ in log messages.Sebastian Benoit
From Hiltjo Posthuma hiltjo -AT codemadness -DOT- org, thanks! ok florian, claudio
2017-05-15Avoid a crash servicing requests when a server is configured withJonathan Gray
"block return 401". Problem reported by Jurjen Oskam. ok florian@
2017-04-17some freezero() callsTheo de Raadt
2017-04-09image/svg+xml is a default inbuilt media type.Florian Obser
Pointed out by Anton Lindqvist (anton.lindqvist AT gmail), thanks!
2017-04-04Do not purge the CONFIG_SERVERS config in the parent. The ticket code usesClaudio Jeker
the servers config for its rekeying handling. Without this no rekeying happens and httpd stops working. Learned the hard way by me and beck@ OK reyk@
2017-03-25Implement TLS ticket support in httpd. Off by default. UseClaudio Jeker
tls ticket lifetime default to turn it on with a 2h ticket lifetime. Rekeying happens after a quarter of that time. OK reky@ and bob@
2017-03-21From a syslog perspective it does not make sense to log fatal andAlexander Bluhm
warn with the same severity. Switch log_warn() to LOG_ERR and keep fatal() at LOG_CRIT. OK reyk@ florian@
2017-03-16Expand $HTTP_HOST in redirects.Florian Obser
From Rivo Nurges Rivo.Nurges AT smit.ee, thanks! OK reyk
2017-03-10Sync from relayd: DELETE can have a body.Reyk Floeter
Fix by Rivo Nurges, fixes a problem with Atlassian JIRA OK benno@
2017-02-07/tmp/cvsspEkokReyk Floeter
2017-02-07Improve parsing of the HTTP request lineReyk Floeter
Make sure that the beginning of a new request starts with an alphabetic character. This is a quick way to detect non-ASCII requests (eg. TLS on port 80). The full validation of the request method is done once the input line is read. Make sure that non-terminated lines do not exceed the SERVER_MAXHEADERLENGTH which is 8k. As the current read watermark is set to 64k, this means that the limit check is triggered after max. 64k of input, depending on the TCP read buffer. OK benno@ jsing@
2017-02-03Stop assuming that in_{addr,port}_t are typedefed in <sys/types.h> andPhilip Guenther
instead pull in <netinet/in.h> or <arpa/inet.h> when those are needed. ok florian@ beck@ millert@
2017-02-02Fix support for HTTP pipelining by handling all requests in the buffer.Reyk Floeter
Tested & OK jung@
2017-01-31remove extra call setting OCSP staple now that it is done aboveBob Beck
using keypair_ocsp.. ok reyk@
2017-01-31Correct mistake I made when converting this to new funcitonBob Beck
2017-01-31Add tls_config_[add|set]keypair_ocsp functions so that ocsp staples may beBob Beck
added associated to a keypair used for SNI, and are usable for more than just the "main" certificate. Modify httpd to use this. Bump libtls minor. ok jsing@
2017-01-31Reimplement httpd's support for byte ranges.Reyk Floeter
The previous implementation loaded all the output into a single output buffer and used its size to determine the Content-Length of the body. The new implementation calculates the body length first and writes the individual ranges in an async way using the bufferevent mechanism. This prevents httpd from using too much memory and applies the watermark and throttling mechanisms to range requests. Problem reported by Pierre Kim (pierre.kim.sec at gmail.com) OK benno@ sunil@
2017-01-31The variable clt_done is used in too many places.Reyk Floeter
Introduce a new variable clt_headersdone in the async HTTP parser. OK sunil@ benno@
2017-01-31Do not set EVBUFFER_EOF on read/write errors and handle EOF correctly.Reyk Floeter
Either libevent or the TLS callback can trigger an EOF when the connection is closed. OK sunil@ jung@ benno@
2017-01-30Fix error path of range requests, found while reviewing byte range support.Reyk Floeter
OK jsg@
2017-01-27More s/OSCP/OCSP/ typosTom Cosgrove
ok jmc@
2017-01-24sort SEE ALSO;Jason McIntyre
2017-01-24add ocspcheck to see alsoBob Beck
2017-01-23Split pledge "ioctl" into "tape" and "bpf", and allow SIOCGIFGROUP onlyTheo de Raadt
upon "inet". Adjust the 4 programs that care about this.
2017-01-21The POSIX APIs that that sockaddrs all ignore the s*_len field in thePhilip Guenther
incoming socket, so userspace doesn't need to set it unless it has its own reasons for tracking the size along with the sockaddr. ok phessler@ deraadt@ florian@
2017-01-17Nuke some whitespace that keeps poking me in the eye as I try toKenneth R Westerback
steal code.
2017-01-09Stop accessing verbose and debug variables from log.c directly.Reyk Floeter
This replaces log_verbose() and "extern int verbose" with the two functions log_setverbose() and log_getverbose(). Pointed out by benno@ OK krw@ eric@ gilles@ (OK gilles@ for the snmpd bits as well)
2017-01-09Replace hand-rolled for(;;) traversal of ctl_conns TAILQ withKenneth R Westerback
TAILQ_FOREACH(). No intentional functional change. ok reyk@
2017-01-08Sync log.c with the latest version from vmd/log.c that preserves errnoReyk Floeter
so it is safe calling log_* after an error without loosing the it.
2017-01-05Replace hand-rolled for(;;) emptying of 'symhead' TAILQ with moreKenneth R Westerback
modern TAILQ_FOREACH_SAFE(). No intentional functional change. ok millert@ bluhm@ gilles@
2017-01-05Replace symset()'s hand-rolled for(;;) traversal of 'symhead' TAILQKenneth R Westerback
with more modern TAILQ_FOREACH(). This what symget() was already doing. Add paranoia '{}' around body of symget()'s TAILQ_FOREACH(). No intentional functional change. ok bluhm@ otto@
2016-11-17Check the return value of tls_config_set_protocols(), now that it returnsJoel Sing
an int.
2016-11-17Move OCSP loading into a separate function - it is not part of the keypairJoel Sing
and this way we can give a separate specific error message. ok beck@ reyk@
2016-11-14specify ordering and precedence of location { } sections;Ingo Schwarze
patch from grunk@; feedback and OK jmc@; OK florian@
2016-11-10Fix tcp ip ttl / minttl on IPv6 sockets.Jeremie Courreges-Anglas
ok florian@
2016-11-06conditionalize ocsp load properlyBob Beck
ok jsing@
2016-11-06since ocsp stapling is optional, make sure we guard if we do not have it.Bob Beck
ok jsing@
2016-11-06tweak previous;Jason McIntyre
2016-11-06Add OCSP stapling support to httpdBob Beck
ok jsing@ bcook@
2016-10-12copy updated log.c from vmd: for correctness, save errno when doingReyk Floeter
additional actions before printing it. OK rzalamena@
2016-10-12Prevent fd exhaustion in the parent when loading the listening serverReyk Floeter
sockets by sending the fd one-by-one. This allows to start httpd with max 32 server instances and many server sockets without changing the default rlimits in any way. OK rzalamena@
2016-10-10Modify httpd(8)'s proc.c to use less file descriptors during the daemonRafael Zalamena
start up. To achieve this proc_init() initiates only the necessary pipes between child and parent, allocate and distribute fds in proc_connect(). In case of configuration checks ('-n') we do nothing in proc_init() and proc_connect(). ok reyk@
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-30 17:30:42 +0000