aboutsummaryrefslogtreecommitdiff
path: root/src/supplemental/http/http_server.c
Commit message (Collapse)AuthorAge
* Introduce DTLS transport for NNG.Garrett D'Amore2025-06-01
| | | | | | | | | | | | | This introduces a new experimental transport for DTLS, that provides encryption over UDP. It has a simpler protocol than the current UDP SP protocol (but we intend to fix that by making the UDP transport simpler in a follow up!) There are a few other fixes in the TLS layer itself, and in the build, that were needed to accomplish this work. Also there was an endianness bug in the UDP protocol handling, which is fixed here.
* http: use nng_err throughoutGarrett D'Amore2025-01-12
|
* http: status is an enumGarrett D'Amore2025-01-12
| | | | | This is slightly less efficient, but it provides for better debugging and type safety.
* http: fix mishandling of very long headers or URIs, and mishandling of unicodeGarrett D'Amore2025-01-12
| | | | Also, nng_err is now a distinct type which might be nicer in debuggers.
* http: remove unused nng_http_handler_get_dataGarrett D'Amore2025-01-12
| | | | The data is now passed directly to the handler function.
* http: server error handling improvements and testsGarrett D'Amore2025-01-12
| | | | | | | We want to consume the request properly on an error, so that we can give a reasonable response. We were prematurely closing the connection for certain failure modes. We still have to fix overly long URIs and headers, but thats next!
* http: use common canonify at request parse timeGarrett D'Amore2025-01-12
|
* http: move connection properties to http_conn, use static Location for redirectGarrett D'Amore2025-01-12
|
* http: status and reason fixes (make it match docs)Garrett D'Amore2025-01-12
|
* http: improve buffer reuse for heeaders, and discard unused bodiesGarrett D'Amore2025-01-11
| | | | | | | | | | | | | The body content not being consumed was leading to misparses, where we consumed body data as if it were a request. When mixed with proxies this could lead to a security problem where the following request content submitted from a different client winds up as stolen request body content. This also ensures we actually deliver errors to clients without prematurely closing the connection. (There are still problems where the connection may be closed prematurely for an overlarge header.)
* http: drop exclusive tree modeGarrett D'Amore2025-01-10
| | | | | Nothing really needs it -- we kept it in 1.0 to preserve semantics, but there is no requirement for semantic preservation in 2.0.
* http: The big HTTP API refactoring of January 2025.v2.0.0-alpha.3http-client-transGarrett D'Amore2025-01-09
| | | | | | | | | | | | | | | | | | | | | | This represents a major change in the HTTP code base, consisting of a complete revamp of the HTTP API. The changes here are too numerous to mention, but the end result should be a vastly simpler API for both server and client applications. Many needless allocations were removed by providing fixed buffers for various parameters and headers when possible. A few bugs were fixed. Most especially we have fixed some bugs around very large URIs and headers, and we have also addressed conformance bugs to more closely conform to RFCs 9110 and 9112. As part of this work, the APIs for WebSockets changed slightly as well. In particular the properties available for accessing headers have changed. There is still documentation conversion work to do, and additional functionality (such as proper support for chunked transfers), but this is a big step in the right direction.
* http: server callback API simplifiedGarrett D'Amore2025-01-06
| | | | | | | | | | This simplified API lets callbacks obtain the response from the connection objection directly, and does not require the aio to carry it as a parameter. Further, the request and response are both stored inline in the connection, reducing allocations. This is at present only for the server; the client will get a similar set of changes.
* api: fold TLS supplemental headers into nng.hGarrett D'Amore2025-01-04
|
* http: No need to do nni_aio_begin for callbacksGarrett D'Amore2024-12-26
|
* http: limit handler uri to 1KGarrett D'Amore2024-12-22
| | | | | | | | | | | This is just the part of the tree that will be matched when looking up a handler. Requests may come in with very much longer URIs, and be matched to the handler as a "subdirectory". This approach makes it possible to avoid a dynamic allocation on the handler, at the cost of pre-allocating 1KB with the handler object. This size can be overridden using a NNG_HTTP_MAX_URI at compile time.
* http: nng_http_handler_set_data is now void return (API break)Garrett D'Amore2024-12-22
|
* http: handler set tree no longer returns a value (API break)Garrett D'Amore2024-12-22
|
* HTTP: nng_http_handler_set_method no longer failsGarrett D'Amore2024-12-22
|
* HTTP handler: limit host names to 256 bytes (RFC 1035 specifies 253.)Garrett D'Amore2024-12-22
| | | | This also makes `nng_http_handler_set_host` never fail (API break).
* http: setting response status never fails (breaking API change)Garrett D'Amore2024-12-22
|
* http handler: avoid method allocationGarrett D'Amore2024-12-22
| | | | | | | | | We limit HTTP method lengths to 32.. there are no currently defined HTTP methods that need more than 19 bytes (including trailing zero.) Generally most servers will not have vast numbers of handlers, so the cost of allocating some storage up front to avoid the dynamic allocation is worth while.
* http server: inline connection aio objectsGarrett D'Amore2024-12-15
| | | | Fewer failure paths, fewer allocations.
* http server: inline the accept aioGarrett D'Amore2024-12-15
| | | | Also properly stop it when doing http_server_stop.
* streams: add explicit stop functionsGarrett D'Amore2024-12-12
| | | | | | | | | | | | This allows us to explicitly stop streams, dialers, and listeners, before we start tearing down things. This hopefully will be useful in resolving use-after-free bugs in http, tls, and websockets. The new functions are not yet documented, but they are nng_stream_stop, nng_stream_dialer_stop, and nng_stream_listener_stop. They should be called after close, and before free. The close functions now close without blocking, but the stop function is allowed to block.
* performance: reference counters can use relaxed order when incrementingGarrett D'Amore2024-12-07
|
* http server: sprintf is considered deprecatedGarrett D'Amore2024-12-01
| | | | | | | | | | Because it is typically associated with insecure code, use of sprintf is discouraged. Note that our usage was actually quite careful and not insecure, but its mere presence raises concern especially by parties who are unwilling or unable to assess the actual code for correctness. A better choice here would be strlcat, but strlcat is not universally available.
* http server: fix race condition for server->closedGarrett D'Amore2024-12-01
|
* Use 32-bit port numbers.Garrett D'Amore2024-11-21
| | | | | While TCP and UDP port numbers are 16-bits, ZT uses a larger (24-bit) port number.
* Merge internal and external URL APIs. No need forGarrett D'Amore2024-11-18
| | | | the separation of nni_url and nng_url.
* URL u_port should be a number not a string.Garrett D'Amore2024-11-17
| | | | | | | | | | | The idea here is to reduce the dynamic allocations used for URLs, and also the back and forth with parsing begin strings and port numbers. We always resolve to a port number, and this is easier for everyone. The real goal in the long term is to eliminate dynamic allocation of the URL fields altogether, but that requires a little more work. This is a step in the right direction.
* TLS configuration changed to use discret _set_tls and _get_tls functions.Garrett D'Amore2024-11-09
| | | | This is simpler, and more reliable than using socket options.
* fixes #1735 websocket should send, and wait for, WS_CLOSE frames on shutdownGarrett D'Amore2023-12-17
| | | | fixes #1733 deadlock in websocket listener close
* Skip URI parameters when serving a directory (http_server)Robert Bielik2023-08-23
|
* fixes#1611 http_sconn_error() in http_server.c; use after freeGarrett D'Amore2023-04-19
|
* Fixes for some security complaints.Garrett D'Amore2022-12-31
| | | | | | | None of these changes are actual security bugs, but GitHub's scanner reports false positives at Critical severity for them. (There are a number of complaints from that scanner, many of which we do not necessarily agree with.)
* Fix out-of-bounds error in http_uri_canonify(). (#1595)Manuel Saraiva2022-05-31
|
* Use static initialization for lists and mutexes.Garrett D'Amore2021-12-05
| | | | | | This eliminates some run-time initialization, moving it to compile time. Additional follow up work will expand on this to simplify initialization and reduce the need for certain locks.
* fixes #1393 Use after free in http (#1395)Evgeny Ermakov2021-01-03
|
* fixes #1372 nni_reap could be smallerGarrett D'Amore2020-12-19
|
* fixes #1358 nni_strtou64 and nni_strtox64 could be replaced with strtoullGarrett D'Amore2020-11-23
|
* Centralize the scheme handling for HTTP schemes.Garrett D'Amore2020-11-17
|
* fixes #1200 Shouldn't nng_http_server_stop be synchronous?Garrett D'Amore2020-11-17
|
* fixes #1355 wss4 and wss6 don't work as they shouldGarrett D'Amore2020-11-17
| | | | This also properly reenables the wssfile_test.
* fixes #1071 tran_chkopt can be cleaned upGarrett D'Amore2020-11-15
| | | | | | | | | | | | | | | | | This is a sweeping cleanup of the transport logic around options, and also harmonizes the names used when setting or getting options. Additionally, legacy methods are now moved into a separate file and can be elided via CMake or a preprocessor define. Fundamentally, the ability to set to transport options via the socket is deprecated; there are numerous problems with this and my earlier approaches to deal with this have been somewhat misguided. Further these approaches will not work with future protocol work that is planned (were some options need to be negotiated with peers at the time of connection establishment.) Documentation has been updated to reflect this. The test suites still make rather broad use of the older APIs, and will be converted later.
* fixes #1337 nni aio user data could be removedGarrett D'Amore2020-11-10
|
* fixes #1279 Add support for ws4:// and ws6:// style websocket urlsGarrett D'Amore2020-08-08
| | | | fixes #1277 FreeBSD errors due to bad v4 vs. v6 assumptions
* fixes #844 WebSocket wildcard host errorsGarrett D'Amore2020-07-27
| | | | | | | | | | fixes #1224 wss fails on IPV6 address This fixes bugs and inconsistencies in the way addresses are handled for HTTP (and consequently websocket). The Host: address line needs to look at numeric IPs and treat wildcards as if they are not specified, and needs to understand the IPv6 address format using brackets (e.g. [::1]:80).
* fixes #1005 TLS 1.3 supportGarrett D'Amore2020-02-23
| | | | | | | | This introduces support for an external wolfSSL plugin, and generally creates the framework for pluggable TLS implementations. The wolfSSL engine is provided via an external module (git submodule), available either under a GPLv3 license or a commercial license.
* Fix typos in commentsEvgeny Ermakov2020-02-13
|
generated by cgit v1.2.3-70-g09d2 (git 2.46.0) at 2026-01-18 13:24:47 +0000