summaryrefslogtreecommitdiff
path: root/usr.sbin/httpd
AgeCommit message (Collapse)Author
2018-11-04isalpha(3) requires an unsigned char value (or -1).Philip Guenther
from Hiltjo Posthuma (hiltjo(at)codemadness.org)
2018-11-01- odd condition/test in PF lexerAlexandr Nedvedicky
(and other lexers too) This commit rectifies earlier change: in the lex... even inside quotes, a \ followed by space or tab should expand to space or tab, and a \ followed by newline should be ignored (as a line continuation). compatible with the needs of hoststated (which has the most strict quoted string requirements), and ifstated (where one commonly does line continuations in strings). OK deraadt@, OK millert@
2018-10-15Omit HSTS headers over unencrypted connections, per RFC 6797.Anthony J. Bentley
ok florian@
2018-10-11Backout my previous commit:Sebastian Benoit
date: 2018/10/01 19:24:09; author: benno; state: Exp; lines: +7 -1; commitid: 0O8fyHPNvPd8rvYU; Only send 408 Timeout responses when we have seen at least part of a request. Without a request, just close the connection when we hit request timeout. Prompted by a bug report from Nikola Kolev, thanks. ok reyk@ and some suggestions from claudio@ and bluhm@ Mark Patruck (mark AT wrapped DOT cx) found a problem with it, thanks for the report. ok reyk@ bluhm@ sthen@ deraadt@
2018-10-01Only send 408 Timeout responses when we have seen at least part of aSebastian Benoit
request. Without a request, just close the connection when we hit request timeout. Prompted by a bug report from Nikola Kolev, thanks. ok reyk@ and some suggestions from claudio@ and bluhm@
2018-09-09During the fork+exec implementation, daemon(3) was moved afterAlexander Bluhm
proc_init(). As a consequence httpd(8) and relayd(8) child processes did not detach from the terminal anymore. Dup /dev/null to the stdio file descriptors in the children. OK benno@
2018-09-07Do not send a Content-Length header for 1xx and 204 status codes sinceFlorian Obser
RFC 7230 states that a server MUST NOT do so. At least relayd chokes on this. Pointed out & diff by Carlin Bingham (cb AT walcyrge.org), thanks! OK benno
2018-09-07replace malloc()+strlcpy() with strndup() in cmdline_symset().miko
"looks good" gilles@ halex@
2018-08-19double the allowed length for the 'tls ciphers' optionJasper Lievisse Adriaanse
for example now it can hold the recommended cipher list from the mozilla ssl config generator rather than failing with a "ciphers too long" error. ok benno@ sthen@ tb@
2018-07-11Do for most running out of memory err() what was done for most runningKenneth R Westerback
out of memory log_warn(). i.e. ("%s", __func__) instead of manual function names and redundant verbiage about which wrapper detected the out of memory condition. ok henning@
2018-07-09No need to mention which memory allocation entry point failed (malloc,Kenneth R Westerback
calloc or strdup), we just need to log that we ran out of memory in a particular function. Recommended by florian@ and deraadt@ ok benno@ henning@ tb@
2018-06-20Add support for simple one-off internal rewrites.Reyk Floeter
For example: location match "/page/(%d+)/.*" { request rewrite "/static/index.php?id=%1&$QUERY_STRING" } Requested by many. Ok benno@
2018-06-18remove the SECTIONS header, since a one line DESCRIPTION is a bit silly;Jason McIntyre
use a more general text for the sections, and avoid the catchup issue that was trying to document how many there were; ok benno rob
2018-06-15Something went wrong - the strip option was documented twice.Reyk Floeter
Found by Mischa Peters, thanks
2018-06-15Fix 304 Not Modified response: don't send a body, use the correct MIME type.Reyk Floeter
Reported by Hidvegi Gabor gaborca websivision hu Fix found by anton@ OK anton@
2018-06-13one too many .El;Jason McIntyre
2018-06-13Rename httpd.conf "root strip" option to "request strip".Reyk Floeter
"root strip" was semantically incorrect and did cause some confusion as it never stripped the root but the client's request path. Discussed with many. Heads up: this is a grammar change that also affects acme-client(1) configurations (see current.html). OK claudio@
2018-06-11The http_query is already url_encoded; don't encode it twice.Reyk Floeter
This fixes a bug in the macros and log file handler that double-encoded the query. This does not change FCGI as it was already handling the query correctly. Additional verification of the QUERY_STRING should be implemented as well. OK claudio@
2018-06-11Sorry, forgot a whitespace.denis
Spotted by benno@
2018-06-11Fix an off-by-one line count when using include statements.denis
Thanks to otto@ for the initial diff. OK benno@
2018-05-23Set the port.op value when parsing the httpd.conf port value.Alexander Bluhm
Otherwise the default port for http or https may used depending on uninitialized memory. Fixes regress on i386. OK reyk@
2018-05-23Forgot to revert another "port 80"Reyk Floeter
Pointed out by jmc@
2018-05-19Add support for client certificate authentication to httpd.Joel Sing
From Jack Burton <jack at saosce dot com dot au> - thanks! Also tested by Jan Klemkow <j.klemkow at wemelug dot de>. ok beck@ reyk@
2018-05-18Move LISTEN ON {} code into a function listen_on().Reyk Floeter
No functional change, but it makes it easier to deal with the grammar.
2018-05-18Revert manpage description as wellReyk Floeter
2018-05-18Revert previous: it introduced a shift/reduce conflict in the grammar.Reyk Floeter
2018-05-18Allow to omit the listen port configuration. Default to port 80, tls port 443.Reyk Floeter
OK florian@ jmc@
2018-04-26Plug leak in error case of the common 'varset' implementations.Kenneth R Westerback
ok benno@
2018-04-11Make httpd listen on all IPv4 and IPv6 addresses forFlorian Obser
"listen on * port 80". While here accept up to 16 addresses from DNS or interface groups. requested by & "lovely" deraadt@ OK kn@
2018-04-06After processing of a range request httpd would never close theFlorian Obser
connection and eventually stop answering queries because of file descriptor starvation. Problem reported by, minimal testcase provided and testing by trondd _AT_ kagu-tsuchi.com, thanks! Testing Nick Holland and millert OK deraadt
2018-02-07NAME_MAX is the length of the thing between / / in a path *without*Florian Obser
the terminating NUL. Do not use it for a "small string" or a "probably short path". Replace it with new defines or PATH_MAX. It also makes the life easier for people auditing the tree for real usage of NAME_MAX. OK deraadt, benno
2018-01-04from paul de weerd: provide a more helpful Xr to ocspcheck, and noteJason McIntyre
that the path to "file" is not relative to the chroot;
2017-12-21typo;Jason McIntyre
2017-12-14set Location header for 307 and 308 status codesSebastian Benoit
ok sthen@ phessler@
2017-11-29Don't do OCSP stapling only if the staple file is 0 length.Bob Beck
This allows something external (like ocspcheck) to disable the stapling deliberatly if it can not retreive a valid staple by truncating the staple file to indicate "do not provide a staple", while the file not existin will still be treated as a configuration error ok claudio@ florian@, and prompted by @jsing
2017-11-28tweak previous;Jason McIntyre
2017-11-28Disable oscp stapling on invalid staple, rather than failing to start.Bob Beck
ok claudio@ florian@
2017-08-2865535 is a valid port to listen on.Florian Obser
Off-by-one pointed out by and diff from Kris Katterjohn katterjohn AT gmail, thanks! chris@ pointed out that more than httpd(8) is effected. OK gilles@
2017-08-11punctuation;Jason McIntyre
2017-08-11Convert httpd to tls_config_set_ecdhecurves(), allowing a list of curvesJoel Sing
to be specified, rather than a single curve. ok beck@
2017-07-31Don't set HTTP date header if already set.ians
Thanks Nick Owens OK florian@
2017-07-19Rework the way that TLS configuration is sent/received via imsgs, so thatJoel Sing
are no longer limited by the 16KB maximum size of a single imsg. Configuration data that is larger than a single message is now chunked and sent via multiple imsgs. Prompted by a diff from Jack Burton <jack at saosce dot com dot au>. ok reyk@
2017-07-03no need to generate y.tab.h if nothing uses it, set YFLAGS to nothingMarc Espie
instead of CLEANFILES += y.tab.h okay millert@
2017-06-10Fix broken escaping: "\." is almost never what you want; found withIngo Schwarze
mandoc -Tlint. While here, make macro usage more consistent.
2017-05-28use __func__ in log messages.Sebastian Benoit
From Hiltjo Posthuma hiltjo -AT codemadness -DOT- org, thanks! ok florian, claudio
2017-05-15Avoid a crash servicing requests when a server is configured withJonathan Gray
"block return 401". Problem reported by Jurjen Oskam. ok florian@
2017-04-17some freezero() callsTheo de Raadt
2017-04-09image/svg+xml is a default inbuilt media type.Florian Obser
Pointed out by Anton Lindqvist (anton.lindqvist AT gmail), thanks!
2017-04-04Do not purge the CONFIG_SERVERS config in the parent. The ticket code usesClaudio Jeker
the servers config for its rekeying handling. Without this no rekeying happens and httpd stops working. Learned the hard way by me and beck@ OK reyk@
2017-03-25Implement TLS ticket support in httpd. Off by default. UseClaudio Jeker
tls ticket lifetime default to turn it on with a 2h ticket lifetime. Rekeying happens after a quarter of that time. OK reky@ and bob@
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-27 12:12:47 +0000