[config] opts for http header parsing strictness (fixes #551, fixes #1086, fixes...
commitb47494d4cda6dc1a152f9033e4617897842c2f50
authorGlenn Strauss <gstrauss@gluelogic.com>
Wed, 18 May 2016 09:42:42 +0000 (18 05:42 -0400)
committerGlenn Strauss <gstrauss@gluelogic.com>
Thu, 19 May 2016 23:15:13 +0000 (19 19:15 -0400)
tree6dee7e026f85d7e0e5f14b6bec4719308b2b83f5
parentb29c8efcb91e3cb1b9c1d7d360f689018327548f
[config] opts for http header parsing strictness (fixes #551, fixes #1086, fixes #1184, fixes #2143, #2258, #2281, fixes #946, fixes #1330, fixes #602, #1016)

server.http-parseopt-header-strict  = "enable"
server.http-parseopt-host-strict    = "enable"  (implies host-normalize)
server.http-parseopt-host-normalize = "disable"

defaults retain current behavior, which is strict header parsing
and strict host parsing, with enhancement to normalize IPv4 address
and port number strings.

For lighttpd tests, these need to be enabled (and are by default)
For marginally faster HTTP header parsing for benchmarks, disable these.

To allow
  - underscores in hostname
  - hypen ('-') at beginning of hostname
  - all-numeric TLDs
  server.http-parseopt-host-strict    = "disable"

x-ref:
  "lighttpd doesn't allow underscores in host names"
  https://redmine.lighttpd.net/issues/551
  "hyphen in hostname"
  https://redmine.lighttpd.net/issues/1086
  "a numeric tld"
  https://redmine.lighttpd.net/issues/1184
  "Numeric tld's"
  https://redmine.lighttpd.net/issues/2143
  "Bad Request"
  https://redmine.lighttpd.net/issues/2258
  "400 Bad Request when using Numeric TLDs"
  https://redmine.lighttpd.net/issues/2281

To allow a variety of numerical formats to be converted to IP addresses
  server.http-parseopt-host-strict    = "disable"
  server.http-parseopt-host-normalize = "enable"

x-ref:
  "URL encoding leads to "400 - Bad Request""
  https://redmine.lighttpd.net/issues/946
  "400 Bad Request when using IP's numeric value ("ip2long()")"
  https://redmine.lighttpd.net/issues/1330

To allow most 8-bit and 7-bit chars in headers
  server.http-parseopt-header-strict  = "disable"  (not recommended)

x-ref:
  "Russian letters not alowed?"
  https://redmine.lighttpd.net/issues/602
  "header Content-Disposition with russian '?' (CP1251, ascii code 255) causes error"
  https://redmine.lighttpd.net/issues/1016
src/base.h
src/configfile.c
src/request.c
src/request.h
src/server.c