Add $REQUEST_SCHEME (block) macro to httpd

The patch below adds a "$REQUEST_SCHEME" macro to those available in block rules in httpd.conf Justification: when redirecting from a (virtual) server which supports both http and https to a (virtual) server which also supports both schemes, it make sense to be able to respect (preserve) the

[Patch] style(9) improvements for sample code in pf(4)

Just trying to make things a little more standard. Ross Index: pf.4 === RCS file: /cvs/src/share/man/man4/pf.4,v retrieving revision 1.88 diff -u -p -r1.88 pf.4 --- pf.429 Aug 2017 02:16:56 - 1.88 +++ pf.48

[Patch] directory.3 should describe return value of readdir_r()

directory.3 (has no "RETURN VALUES" section and) fails to describe the return value of readdir_r(). The diff below adds a sentence about the return value. It also converts "return (X)" to "return X" in the sample code. Ross Index: directory.3

Re: [Patch] style(9) improvements for sample code in pf(4)

Improved version, with thanks to anton@ [Should usage() be __dead?] Ross Index: pf.4 === RCS file: /cvs/src/share/man/man4/pf.4,v retrieving revision 1.88 diff -u -p -r1.88 pf.4 --- pf.429 Aug 2017 02:16:56 - 1.88

Typo in utf8.7

Two bytes plus a bonus bit :-) Patch below. Ross -- Index: utf8.7 === RCS file: /cvs/src/share/man/man7/utf8.7,v retrieving revision 1.6 diff -u -p -r1.6 utf8.7 --- utf8.7 31 May 2017 17:58:56 - 1.6 +++ utf8.7

acme-client.conf.5 - domain chain certificate is (also) optional

domain chain certificate is one of the two remaining optional settings not yet documented Ross Index: acme-client.conf.5 === RCS file: /cvs/src/usr.sbin/acme-client/acme-client.conf.5,v retrieving revision 1.14 diff -u

[1/3] acme-client - correct error message in parse.y

[Previously submitted large diff now being sent in three more-readily digestible pieces...] The error message looks to have been copied/pasted from the earlier DOMAIN CHAIN CERT STRING case, but not edited. Ross Index: parse.y

[2/3] acme-client - correct "sign with" error messages in parse.y

It appears that, sometime in the early development of the config file stuff, there was a different syntax for what is now "sign with". A couple of error messages refer to "use" [but should not]. Ross Index: parse.y === RCS file:

acme-client.conf.5 - "sign with" setting is (also) optional

sign with is the final optional setting not yet documented If absent, defaults to the first authority in the config. Ross Index: acme-client.conf.5 === RCS file: /cvs/src/usr.sbin/acme-client/acme-client.conf.5,v

[3/3] acme-client - style(9) cleanup in parse.y

This diff contains only style(9) cleanup: - mainly "return (x);" => "return x;" - a few "if (x)" ==> "if (x != something)" No change to parse.o Ross Index: parse.y === RCS file:

[diff] acme-client - fix err messages and style in parse.y

[The non-style(9) parts of this were sent previously off-list to a few.] The diff: - fixes error messages - one copy/pasto - two with old(?) syntax "use" rather than "sign with" - applies some style(9) - lots of "return (x);" ==> "return x;" - a few "if (x)" ==>

Re: [diff] acme-client - remove NULL checks before _free() calls

On Sat, Jul 28, 2018 at 05:09:50PM +0200, Theo Buehler wrote: >[...] > I'll commit this tomorrow if no-one commits it earlier with my ok. > > > [Note that the behaviour of X509_REQ_free(NULL) and X509_NAME_free(NULL) > > is not documented in the man pages, so those calls in keyproc.c are not > >

[diff] acme-client - improve printing of alt names (with -n)

Simple diff so that instead of printing ... alternative names { httpd.example.com, secure.example.com} ... we get ... alternative names { httpd.example.com, secure.example.com } ... Ross Index: parse.y

[diff] acme-client - remove NULL checks before _free() calls

The diff below just removes NULL checks before various LibreSSL *_free() calls, on the assumption that that's the preferred usage where it's documented that *_free(NULL) is safe. [Note that the behaviour of X509_REQ_free(NULL) and X509_NAME_free(NULL) is not documented in the man pages, so

[diff] acme-client - clean up main.c

[This diff is very similar to one I sent previously off-list to a few.] Just some style(9) and simple cleanup: - order getopt string and switch cases - add space between "if" and "(" - wrap a long line - return rather than exit() from main() - move chngdir == NULL test to where it belongs

[diff] Improvements for acme-client.1, acme-client.conf.5

acme-client.1 changes are largely similar to my previous attempt [off-list] with some feedback from jsing@ [thanks!] The example has been changed from "example.com" to "www.example.com" in an attempt to make it clear that "domain" is a misnomer. acme-client.conf.5 stuff is mostly documenting

acme-client.1 - fix mangled sentence and stray plural

This is the first of several diffs containing separate bits of the earlier combined diff. "X509" to "X.509" for correctness and consistency with acme-client.conf.5 Index: acme-client.1 === RCS file:

acme-client.1 - Change "TLS certificate" to "X.509 certificate"

It's an "X.509 certificate" rather than a "TLS certificate". As pointed out by sthen@, TLS isn't the only possible use. Index: acme-client.1 === RCS file: /cvs/src/usr.sbin/acme-client/acme-client.1,v retrieving revision 1.24

[Patch] Specify unit for 'every' in ifstated.conf.5

The number is in seconds, but that's currently not specified. Wording which preserved "frequency" but made sense with "seconds" eluded me, so I changed things to refer to "interval". Ross Index: ifstated.conf.5 === RCS

Re: [Patch] Specify unit for 'every' in ifstated.conf.5

Whilst I agree with Otto (and others), how about making it really simple by avoiding technical terms? Ross Index: ifstated.conf.5 === RCS file: /cvs/src/usr.sbin/ifstated/ifstated.conf.5,v retrieving revision 1.13 diff -u -p

Re: [Patch] Specify unit for 'every' in ifstated.conf.5

On Fri, Dec 07, 2018 at 06:42:51AM +, Jason McIntyre wrote: >[...] > > morning. > > i'm afraid i think this reads quite poorly - it is hard to actually > understand what is meant. > > here's the thing - someone has already written the text. if we want to > change the author's text, i

[diff] events.html - add 2 more BSDCan 2019 videos

Probably in acceptable form :-) [Patch for www/libressl/papers.html should follow.] Ross Index: events.html === RCS file: /cvs/www/events.html,v retrieving revision 1.1174 diff -u -p -r1.1174 events.html --- events.html 18 Jun

[diff] www/libressl/papers.html - add video link

The following corresponds with the events.html patch... Ross Index: papers.html === RCS file: /cvs/www/libressl/papers.html,v retrieving revision 1.16 diff -u -p -r1.16 papers.html --- papers.html 13 Jun 2019 07:34:36 -

[diff] events.html - video links for BSDCan 2019

The patch below just adds links for the videos currently available. Notes: - Lines were already > 80 characters, so I haven't folded. - Links are to the context of the BSDCan 2019 playlist (which may not be what is wanted). Ross Index: events.html

[Patch] smtp(1) with proto "smtps" should default to port smtps/465

...unless I'm very mistaken! Ross Index: smtpc.c === RCS file: /cvs/src/usr.sbin/smtpd/smtpc.c,v retrieving revision 1.6 diff -u -p -r1.6 smtpc.c --- smtpc.c 2 Jul 2019 09:36:20 - 1.6 +++ smtpc.c 31 Aug 2019

Re: smtp(1) certificate validation

On Fri, Sep 06, 2019 at 08:41:21AM +0200, Eric Faurot wrote: > Hi, > > This patch adds the missing bits for verifying the server certificate > in smtp(1). >[...] Whilst this is a great improvement, it doesn't seem to be quite right... For sites with valid certificates, things seem OK:

Re: smtp(1) certificate validation

Eric, On Tue, Sep 10, 2019 at 05:38:30PM +0200, Eric Faurot wrote: > On Fri, Sep 06, 2019 at 08:41:21AM +0200, Eric Faurot wrote: > > Hi, > > > > This patch adds the missing bits for verifying the server certificate > > in smtp(1). > > Take two: now check the name(s) of the server certificate.

Re: smtp(1) certificate validation

On Fri, Sep 06, 2019 at 10:58:43PM +1000, Ross L Richardson wrote: >[...] > > For invalid certificates, the result sometimes does not correspond with > that from nc(1): > > $ ./smtp -nv -s smtps://devio.us:https > trying host 74.81.181.124 port 443... >

Re: probable error in 66.html regarding rpki-client

On Wed, Oct 16, 2019 at 09:34:26PM -0600, Theo de Raadt wrote: > Ross L Richardson wrote: > > > 66.html claims that rpki-client is included, but: > > - <https://man.openbsd.org/rpki-client.8> gives no result. > > - The test system I just sysupgraded doesn't have

probable error in 66.html regarding rpki-client

66.html claims that rpki-client is included, but: - gives no result. - The test system I just sysupgraded doesn't have it. It's not actually linked to the build (in src/usr.sbin/Makefile), is it? Ross

[Patch 2 of 2] Update list of ssh key files checked in Xsession

Add checks for the (new) security key files... Patch assumes previous patch has been applied. Ross --- Xsession.in.prevMon Nov 25 21:29:42 2019 +++ Xsession.in Mon Nov 25 21:35:11 2019 @@ -26,10 +26,12 @@ fi id1=$HOME/.ssh/id_dsa id2=$HOME/.ssh/id_rsa id3=$HOME/.ssh/id_ecdsa

[Patch 1 of 2] Update list of ssh key files checked in Xsession

Noticed when testing a U2F key... SSH1 is no longer supported, so checking for an "identity" private key file is unhelpful. [Has this been overlooked, or is there some reason it has been preserved?] Ross Index: Xsession.in

[Patch] Correct the version of OpenSSH in 67.html

Should be 8.3, shouldn't it? Ross Index: 67.html === RCS file: /cvs/www/67.html,v retrieving revision 1.65 diff -u -p -r1.65 67.html --- 67.html 11 May 2020 19:24:58 - 1.65 +++ 67.html 12 May 2020 04:45:33 - @@

Re: [Patch] Change httpd's handling of request "Host:" headers

Leo, On Mon, Aug 10, 2020 at 08:46:19AM +0200, Leo Unglaub wrote: > Hey, > i love your patch. The current behavour always bothered me because it caused > servers to display "wrong" sites as defaults for all requests missing the > Host header. I really like your patch and it works fine for me on

[Patch] Change httpd's handling of request "Host:" headers

At present, if a request contains no "Host:" header [HTTP pre-1.1] or if the supplied header does not match any of the servers configured in httpd.conf, the request is directed to the first server. This isn't documented, AFAICT. For example, if httpd.conf has just one server server

[Patch] Remove unnecessary assignment in httpd's server_fcgi.c

cppcheck finds an unnecessary assignment. The patch below deletes it. Ross Index: server_fcgi.c === RCS file: /cvs/src/usr.sbin/httpd/server_fcgi.c,v retrieving revision 1.81 diff -u -p -r1.81 server_fcgi.c --- server_fcgi.c

[Patch] Delete redundant condition in httpd's proc.c

cppcheck finds a redundant condition. The patch below deletes it. Ross Index: proc.c === RCS file: /cvs/src/usr.sbin/httpd/proc.c,v retrieving revision 1.38 diff -u -p -r1.38 proc.c --- proc.c 9 Sep 2018 21:06:51 -

[Patch] Delete unread assignments in httpd's config.c

cppcheck finds some unread assignments in httpd's config.c The patch below deletes them and the resulting unused variables. By way of [a bit more] context, the last of these is: 682 if (srv->srv_conf.return_uri_len != 0) { 683 if ((srv->srv_conf.return_uri =

[Patch] Remove unused functions in httpd[.ch]

cppcheck reports that kv_inherit(), kv_log(), and print_time() are unused. The patch below deletes them. Ross -- Index: httpd.c === RCS file: /cvs/src/usr.sbin/httpd/httpd.c,v retrieving revision 1.69 diff -u -p -r1.69 httpd.c ---

[Patch] Remove redundant condition in httpd's server_http.c

cppcheck reports this [and other less simple things]. Ross Index: server_http.c === RCS file: /cvs/src/usr.sbin/httpd/server_http.c,v retrieving revision 1.139 diff -u -p -r1.139 server_http.c --- server_http.c 22 May 2020

[Patch] Remove unused functions in httpd's proc(?)

cppcheck reports that proc_iev and proc_ispeer are unused. Unless they are wanted for consistency with other versions of proc.c, tbey can be removed. Ross Index: httpd.h === RCS file: /cvs/src/usr.sbin/httpd/httpd.h,v retrieving

Re: [Patch] Change httpd's handling of request "Host:" headers

On Mon, Aug 10, 2020 at 10:37:16PM +0200, Sebastian Benoit wrote: >[...] > > In which way can the current behaviour cause problems? Whilst a client sending bizarre requests perhaps deserves what they get, I thought an error status would be better than OK. If odd hostnames are accepted, they may

[Patch] Make some functions static in httpd's server_fcgi.c

Noticed when working on my next [more interesting] patch... Various functions could/should be static. Ross Index: server_fcgi.c === RCS file: /cvs/src/usr.sbin/httpd/server_fcgi.c,v retrieving revision 1.81 diff -u -p -r1.81

[Patch] Be strict with fastcgi Status header

The current code hides gross errors in the Status header generated by fastcgi applications: - Bogus codes are converted to 200. - The presence of multple Status headers is not reported as an error. IMHO, this doesn't really help anyone. The patch below attempts to address both these concerns.

[Patch] httpd.h - delete unused field and enum

Field kv_type in struct kv is not used. As that's the only use of enum key_type, delete them both. Ross Index: httpd.h === RCS file: /cvs/src/usr.sbin/httpd/httpd.h,v retrieving revision 1.146 diff -u -p -r1.146 httpd.h ---

[Patch] Fix mangled language in x509v3.cnf.5

Fix a horribly mangled sentence. Would "may" be more appropriate than "can"? Also, in the list of usages: for serverAuth and clientAuth, shouldn't the word "web" be elided? Ross Index: x509v3.cnf.5 === RCS file:

[Patch] httpd - delete unused function canonicalize_host()

Function is unused and can go. Ross -- Index: httpd.c === RCS file: /cvs/src/usr.sbin/httpd/httpd.c,v retrieving revision 1.68 diff -u -p -r1.68 httpd.c --- httpd.c 9 Sep 2018 21:06:51 - 1.68 +++ httpd.c 26 Jul

login_passwd.c (etc.) and auth_mkvalue(3) returning NULL

auth_mkvalue(3) may return NULL (if no memory is available), but login_passwd.c and friends use the return value without checking. $ cd /usr/src/libexec/ $ egrep -B 1 auth_mkval login_*/*.c login_passwd/login_passwd.c-fprintf(back, BI_VALUE " errormsg %s\n",

Re: login_passwd.c (etc.) and auth_mkvalue(3) returning NULL

On Wed, Dec 30, 2020 at 09:08:53AM -0700, Todd C. Miller wrote: >[...] > Yes, that should be checked. In the case of login_passwd.c there > is really no reason to use auth_mkvalue(3) at all as there is nothing > that needs to be escaped. I think the simplest approach is to send > a reject

[Patch] Typo in errata69.html

Broke the parsing on Undeadly :-( Ross Index: errata69.html === RCS file: /cvs/www/errata69.html,v retrieving revision 1.3 diff -u -p -r1.3 errata69.html --- errata69.html 3 May 2021 20:12:53 - 1.3 +++ errata69.html

Re: random manual pages

On Thu, Feb 11, 2021 at 10:40:07PM -0700, Theo de Raadt wrote: >[...] > +original development, is underspecified, and should not be relied up to "relied up to" should probably be "relied upon to" (twice). Ross

[Patch] Relocate a vmctl entry in 69.html

It probably belongs with the other vmctl entry rather than under userland networking changes... Ross Index: 69.html === RCS file: /cvs/www/69.html,v retrieving revision 1.53 diff -u -p -r1.53 69.html --- 69.html 18 Apr 2021

[Patch] Typo ("it's" should be "its") in 69.html

Just an incorrect possessive form... Ross Index: 69.html === RCS file: /cvs/www/69.html,v retrieving revision 1.53 diff -u -p -r1.53 69.html --- 69.html 18 Apr 2021 12:08:06 - 1.53 +++ 69.html 19 Apr 2021 04:25:56

[Patch] Spell ...initializ... consistently in 69.html

It may be pedantic, but the only offending case has different spellings in the same sentence! Ross Index: 69.html === RCS file: /cvs/www/69.html,v retrieving revision 1.60 diff -u -p -r1.60 69.html --- 69.html 19 Apr 2021

[Patch] Possible redundant item in 69.html

The last item under OpenSMTPD seems to be covered by the second last item (or the difference is really subtle). Deleting the final item may be appropriate. Ross Index: 69.html === RCS file: /cvs/www/69.html,v retrieving revision

[Patch] Typos in OpenSSH section of 69.html

(Haven't finished reading it yet...) Index: 69.html === RCS file: /cvs/www/69.html,v retrieving revision 1.61 diff -u -p -r1.61 69.html --- 69.html 19 Apr 2021 11:22:08 - 1.61 +++ 69.html 19 Apr 2021 12:11:28 -

[Patch] Delete extra word in OpenSSH section of 69.html

(Probably the last report from me for 69.html) Index: 69.html === RCS file: /cvs/www/69.html,v retrieving revision 1.63 diff -u -p -r1.63 69.html --- 69.html 19 Apr 2021 20:06:24 - 1.63 +++ 69.html 20 Apr 2021

[Patch] "usb" ==> "USB" for consistency

Probably! Ross Index: 69.html === RCS file: /cvs/www/69.html,v retrieving revision 1.52 diff -u -p -r1.52 69.html --- 69.html 17 Apr 2021 20:45:22 - 1.52 +++ 69.html 18 Apr 2021 11:19:14 - @@ -424,7 +424,7

Incomplete sentence in 69.html

Under "IEEE 802.11 wireless stack improvements and bugfixes:", an item appears to have been truncated... "Fixed automatic selection of the 11a/b/g/n/ac operating mode when" Ross

[Patch] Fix mangled sentence in 69.html (apmd control socket)

Simplest fix below. Ross Index: 69.html === RCS file: /cvs/www/69.html,v retrieving revision 1.52 diff -u -p -r1.52 69.html --- 69.html 17 Apr 2021 20:45:22 - 1.52 +++ 69.html 18 Apr 2021 11:05:33 - @@

[Patch] Typo in www/events.html

Just a stray '>'. Ross -- Index: events.html === RCS file: /cvs/www/events.html,v retrieving revision 1.1205 diff -u -p -r1.1205 events.html --- events.html 18 Sep 2021 13:05:34 - 1.1205 +++ events.html 19 Sep 2021 12:36:48

[Possible patch] httpd and HEAD requests to CGI scripts

This relates to the earlier messages I sent to bugs@ in: https://marc.info/?t=16330937691=1=2 RFC 7231 [HTTP/1.1] section 4.3.2. "HEAD" states: The HEAD method is identical to GET except that the server MUST NOT send a message body in the response (i.e., the response

[Patch] Fix a few typos (etc.) in 70.html

Hope these are right! Ross Index: 70.html === RCS file: /cvs/www/70.html,v retrieving revision 1.83 diff -u -p -r1.83 70.html --- 70.html 8 Oct 2021 16:31:36 - 1.83 +++ 70.html 9 Oct 2021 11:04:41 - @@

[Patch] Capitalise "DHCP" and "DNS" in 70.html

Think I got them all. Ross Index: 70.html === RCS file: /cvs/www/70.html,v retrieving revision 1.85 diff -u -p -r1.85 70.html --- 70.html 9 Oct 2021 18:27:18 - 1.85 +++ 70.html 10 Oct 2021 05:02:35 - @@

[Patch] Fix a couple of minor errors in OpenSSH section of 70.html

Missing space after "RFC" and a typo... Ross Index: 70.html === RCS file: /cvs/www/70.html,v retrieving revision 1.87 diff -u -p -r1.87 70.html --- 70.html 10 Oct 2021 06:32:45 - 1.87 +++ 70.html 10 Oct 2021

[Patch] httpd handling of HEAD requests to CGI w.r.t. Content-Length

This is a rewording of my later posts to bugs@ in: https://marc.info/?t=16330937691=1=2 RFC 7231 [HTTP 1.1] states that, for a HEAD request, the server SHOULD send the same header fields in response to HEAD as it would for GET, except that payload headers MAY be omitted.

[Patch] Make errata70.html consistent with earlier errata*.html

Hitherto, errata IDs have been "p" rather than "". Ross Index: errata70.html === RCS file: /cvs/www/errata70.html,v retrieving revision 1.6 diff -u -p -r1.6 errata70.html --- errata70.html 31 Oct 2021 00:14:46 -

Re: www/errata74.html does not exist [CORRECTED]

On Wed, Oct 04, 2023 at 12:37:03PM +1100, Ross L Richardson wrote: > if the OpenBSD home page "Errata" still links to those of the old/current ... if the OpenBSD home page "Patches" still links to those of the old/current ... > > Anyway, here's a 74.html versio

www/errata74.html does not exist

errata.html has a link to errata74.html as the latest, but the latter does not exist. [FWIW, this confuses Undeadly's errata list/RSS, so that it bails out and fails to update for 7.3's patch 017. That's been fixed manually.] IIRC, it's normal for the errata file [errata74.html] to be created

[Patch] Delete extra word in 72.html

Simple fix for typo/edito... Ross Index: 72.html === RCS file: /cvs/www/72.html,v retrieving revision 1.54 diff -u -p -r1.54 72.html --- 72.html 4 Oct 2022 01:38:08 - 1.54 +++ 72.html 4 Oct 2022 06:10:12 - @@

[Patch] Probable error in sh.1

The word "array" occurs only once in sh.1. Therefore, either it deserves more explanation, or removal with something like the patch below. Ross == --- sh.1.orig Thu Sep 1 10:07:22 2022 +++ sh.1Sun Dec 18 20:47:53 2022 @@ -1390,7 +1390,7 @@ .Pp Where .Ar expression -is an integer,

[Patch] Inconsistent markup in 73.html

There's a glaring inconsistency in the markup used for the various .tar.gz files. Should be all-or-nothing; patch for the former below... Ross -- Index: 73.html === RCS file: /cvs/www/73.html,v retrieving revision 1.33 diff -u -p