summaryrefslogtreecommitdiff
path: root/usr.sbin/relayd/relay_http.c
AgeCommit message (Collapse)Author
2015-09-27include <unistd.h> unconditionallyTheo de Raadt
ok benno
2015-07-28spacingReyk Floeter
2015-07-18Fix unbounded buffer growth. In the case of a slow client reading large files,Sebastian Benoit
we would consume large ammounts of memory. Found by Matthew Martin <matt DOT a DOT martin AT gmail DOT com> in httpd, fixed in httpd by florian@ feedback from florian, reyk and bluhm, ok bluhm, reyk
2015-06-12To match relayd's style, use an explicit enum with prefixed names forReyk Floeter
the states that Claudio introduced. No functional change. OK claudio@ benno@
2015-06-08Introduce a state on the ctl_relay_event struct. This makes it possibleClaudio Jeker
to better track the connection state of a session and stops doing double opens in certain situations using http relays. Using a state field to simplify the logic since relay_connect() is called multiple times. OK benno@, bluhm@ and running in production for more than a week
2015-06-01Fix memory leak in error case. OK bluhm@ benno@Claudio Jeker
2015-05-22fix a non safe use of TAILQ_FOREACH with TAILQ_REMOVEJonathan Gray
ok reyk@
2015-05-18Fix a crash reported and analyzed by Bertrand PROVOST. When a HTTPAlexander Bluhm
client or server writes multiple requests or chunks in a single transfer, relayd invokes the libevent callback manually for the next data. If the callback closes the session, this resulted in an use after free. Instead of the more complicated fix suggested by Bertrand PROVOST, just move the invocation of the callback to the end of the function. So in case the callback frees any structures, they are not accessed. OK benno@ reyk@
2015-05-18The first line of a HTTP request is the method-url-version. TheAlexander Bluhm
second line is a key-value header. So you cannot append to the previous key-value before line three. Also reset the last header when all headers are purged to avoid a use after free. OK benno@ reyk@
2015-04-29When the HTTP client did close the connection while relayd was stillAlexander Bluhm
parsig the HTTP header, the session was never destroyed. This resulted in a file descriptor leak. Add a check wether the protocol knows how much data to expect. If relayd is reading unlimited data or is expecting nothing to read, ignore the end-of-file. Otherwise it is a protocol violation, so close the session immediately. While there, make relayd compile with DEBUG defined. Based on a diff from claudio@; tested by claudio@; OK claudio@ benno@
2015-01-22Clean up the relayd headers with help of include-what-you-use and someReyk Floeter
manual review. Based on common practice, relayd.h now includes the necessary headers for itself. OK benno@
2015-01-22spacingReyk Floeter
2015-01-16Adapt to <limits.h> universe.Theo de Raadt
ok millert
2015-01-13bump copyright yearReyk Floeter
2015-01-01Merge error page changes from httpd: send Content-Length:, changeReyk Floeter
Date: from asctime to the preferred HTTP/1.1 format, and use the popular "Comic Sans" style (can be changed in the configuration).
2015-01-01Use the recommended HTML5 doctype in error pages.Reyk Floeter
OK validator.w3.org (This document was successfully checked as HTML5!)
2014-12-21Stop pulling in <arpa/inet.h> or <arpa/nameser.h> when unnecessary.Philip Guenther
*Do* pull it in when in_{port,addr}_h is needed and <netinet/in.h> isn't. ok reyk@
2014-12-18Update relayd to use siphash instead of sys/hash. The source-hash,Reyk Floeter
loadbalance and hash modes use a random key by default that can be forced to be a static key with a new configuration argument. With input from Max Fillinger. ok tedu@
2014-10-25Remove unnecessary netinet/in_systm.h include.Lawrence Teo
ok millert@
2014-09-15Make the HTTP version mandatory and abort if it is missing in the request.Reyk Floeter
2014-08-10There was a race in relayd that caused connections to hang. ItAlexander Bluhm
happend with non-persistent PUT connections that had a very short body. If the whole body was read from the client before the connection to the server was set up, the event callback was not called. Do the regular checks after relay_connect() succeeded. OK reyk@
2014-07-17Move comment about strcasecmp() to a more suitable spot.Stefan Sperling
ok reyk benno
2014-07-14When a connection was spliced in one direction and in copy mode inAlexander Bluhm
the other direction, the timeouts did not work. They were longer than specified. Link the splicing and non-splicing timeouts. Found by make run-regress-args-timeout-http.pl OK reyk@
2014-07-13Remove a debug messageReyk Floeter
2014-07-13improve log output for relays. adjust regress testsSebastian Benoit
ok reyk
2014-07-13repair matching of headers, add regress test for this errorSebastian Benoit
ok reyk
2014-07-12fix relay "append header" action, add regression test for appendSebastian Benoit
ok reyk
2014-07-12Move HTTP error codes into http.h.Reyk Floeter
ok benno@
2014-07-11optimize a FALLTHROUGHSebastian Benoit
implicit ok reyk
2014-07-11Limit HTTP header length to about 8K (based on the default of 4-8K inReyk Floeter
common web servers). Add a related regress test. OK benno@
2014-07-11Simplify the code that handles the HTTP headers by using an RB treeReyk Floeter
with associated lists instead of the complicated lookup table and "others" list. This might add a little malloc overhead for common headers but also fixes some issues like the handling of repeated headers - for example, handling of multiple "Set-Cookie" headers. ok bluhm@ (regress part) ok benno@
2014-07-10Print "%s (removed)" into relayd log and test for that string.Alexander Bluhm
suggested by reyk@
2014-07-10Fix another free error.Reyk Floeter
ok benno@
2014-07-09Replace the protocol directives for HTTP with a new generic filteringReyk Floeter
language. The grammar is inspired by pf and allows to write versatile last-matching filter rules in protocol sections starting with the "pass", "block" or "match" keywords. This work was started almost two years ago and replaces large parts of relayd(8)'s HTTP and filtering code. The initial version reimplements and extends HTTP filtering, but will be improved to support generic TCP and other protocols later. With some testing, feedback, and help from benno@ and andre@. OK benno@
2014-06-25sync copyright to reality according to my last changesReyk Floeter
2014-04-20Check for strlcpy overflow when expanding the HTTP input value.Reyk Floeter
2014-04-15Print hashkey to debug output, this helps hash-action use cases to be tested.andre
Use log_debug() instead of log_info(). ok reyk@
2013-09-04Handling of HTTP requests with a body like POST were broken inAlexander Bluhm
relayd. Instead of checking for the direction RELAY_DIR_RESPONSE, set toread to 0 if we don't expect a body. OK reyk@
2013-06-02With HTTP keepalive, relayd only filtered the first request andReyk Floeter
switched to pass-through mode for subsequent requests from the client. Make sure to stay in HTTP header mode. ok benno@
2013-05-30Safari doesn't like HTTP/1.x in the generated error messages (return error),Reyk Floeter
so change it to HTTP/1.0. This also makes it RFC-compliant which only allows digits in the version number. ok bluhm@
2013-05-07- Add a simple check to prevent that the client-provided hex HTTP chunk sizeReyk Floeter
turns our signed input variable into a negative number. This prevents that a chunked HTTP connection could break its own state machine and turn into a stalled state. The bug doesn't harm other connections or relayd itself. - Use a 64bit variable to allow theoretical large chunks. - Fix a comment. ok tedu@
2013-04-20print large time_t nicely; ok bennoTheo de Raadt
2013-03-10This diff changes relayd to use the monotonic clock instead ofReyk Floeter
gettimeofday(). It was also bugging me for some time to have all these checks of gettimeofday()'s return value: it should not fail. So this diff introduces a void getmonotime(struct timeval *tv) that calls clock_gettime(CLOCK_MONOTONIC, &ts) and converts the output to a struct timeval that can be used with the existing code and the timeval-specific timer functions (timerclear, timersub, ...). It does not return a status but calls fatal() on error-that-should-not-happen. ok sthen@ chris@
2013-03-09Enable TCP socket splicing for HTTP persistent connection and chunkedAlexander Bluhm
transfer encoding. This speeds up relayd for more protocol modes by zero-copy TCP forwarding. OK reyk@ benno@
2013-02-15Fix the toread check in the lateconnect case. This allowsAlexander Bluhm
Content-Length: 0 in HTTP GET request when a request filter is used. This was broken by my previous commit. OK reyk@ benno@
2013-02-05Rework http content and chunk handling in relayd. Use specialAlexander Bluhm
toread values to track the current http header or chunk state. This allows to handle an optional chunk trailer properly. Tracking the http state is also a prerequisite for splicing persistent http connections. OK and test reyk@ benno@
2013-01-22Only send a single CRLF between chunks. A second CRLF seemed to beReyk Floeter
optional, and it worked fine with Firefox, but it didn't work with some browsers/clients like Chrome or CURL that implement the specification strictly. See RFC 2616, Section 3.6.1, for more information about Chunked Transfer Encoding. ok bluhm@ benno@
2013-01-17Remove unnecessary pointer casts. No binary diff.Alexander Bluhm
OK benno@
2012-11-27Add format attributes to the proper functions and then fix the warningsPhilip Guenthe
that gcc then reports when compiling with -DDEBUG=2 ok reyk@ benno@
2012-11-21strtonum() can only handle a maximum of LLONG_MAXSebastian Benoit
fixes bug reported by Bogdan Andu, thanks ok reyk@ deraadt@ sthen@
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-12 02:17:41 +0000