- 17 Oct, 2023 7 commits
-
-
Dridi Boukelmoune authored
There are two warnings that we enforce for our own code that zlib does not. There's also the visibility attribute that we check at configure time. And regarding the visibility attribute, zlib no longer relies on a NO_VIZ macro and aligned with the autoconf naming convention and wants HAVE_HIDDEN instead. Conflicts: configure.ac lib/libvgz/Makefile.am
-
Poul-Henning Kamp authored
-
Poul-Henning Kamp authored
-
Poul-Henning Kamp authored
Varnish is not subject to CVE 2022 37434, we never use "extra" data.
-
Poul-Henning Kamp authored
-
Poul-Henning Kamp authored
-
Poul-Henning Kamp authored
FreeBSD's code is undergoing some compatibility adaptations so we go directly to the source from here. PS: Please keep cochinelle out of libvgz.
-
- 04 Sep, 2023 1 commit
-
-
Guillaume Quintard authored
-
- 05 Dec, 2022 1 commit
-
-
Martin Blix Grydeland authored
-
- 12 Oct, 2022 19 commits
-
-
Martin Blix Grydeland authored
-
Martin Blix Grydeland authored
-
Martin Blix Grydeland authored
-
Martin Blix Grydeland authored
-
Martin Blix Grydeland authored
-
Martin Blix Grydeland authored
-
Martin Blix Grydeland authored
-
Martin Blix Grydeland authored
-
Simon Stridsberg authored
Fixes #3491
-
Asad Sajjad Ahmed authored
Check for correct handling of missing pseudo-headers, and invalid characters. Signed-off-by:
Asad Sajjad Ahmed <asadsa@varnish-software.com>
-
Asad Sajjad Ahmed authored
The :scheme pseudo header is not optional in H/2 except when doing CONNECT. There is also a strict requirement for it appear only once. Signed-off-by:
Asad Sajjad Ahmed <asadsa@varnish-software.com>
-
Asad Sajjad Ahmed authored
We should apply the same restrictions on the list of allowed characters inside H/2 pseudo-headers as we do for H/1. This error is translated into the headers we send to a backend over H/1. Failure to do so could permit various exploits against a backend not handling malformed H/1 requests. Signed-off-by:
Asad Sajjad Ahmed <asadsa@varnish-software.com>
-
Dridi Boukelmoune authored
I find ":path: /foo" more descriptive than "/foo", even though I could infer which one it was...
-
AlveElde authored
Now that http_DoConnection() is used without respecting the SC_RX_BAD return value it should not return early when encountering a well-known header.
-
Dridi Boukelmoune authored
Some browsers are strict about this and simply drop responses containing such headers. Since this is not filtering a context switch between a client and a backend transaction (or cache hit) a new filtering flag is added to the HTTP headers table for connection-specific headers. This new flag cannot be compounded as HTTPH_R_FETCH|HTTPH_A_INS because the TE header is an exception and left alone, even though trailers aren't supported. Better diff with the --ignore-all-space option. We could go further and consider any client request containing one as malformed as mandated by RFC 7540. Closes #3416
-
AlveElde authored
-
Mark Felder authored
-
Nils Goroll authored
no semantic changes, just consolidating three places in one (thus pushed during freeze)
-
Martin Blix Grydeland authored
-
- 07 Sep, 2022 1 commit
-
-
Asad Sajjad Ahmed authored
Allow the user to log the request time in milliseconds through the new format specifier: %{ms}T . Signed-off-by:
Asad Sajjad Ahmed <asadsa@varnish-software.com>
-
- 12 Jan, 2022 1 commit
-
-
Martin Blix Grydeland authored
-
- 11 Jan, 2022 5 commits
-
-
Martin Blix Grydeland authored
-
Martin Blix Grydeland authored
-
Martin Blix Grydeland authored
Previously we would ignore errors to iterate the request body into oblivion in VRB_Ignore(), keeping the connection open. This opens an out-of-sync vulnerability on H/1 connections. This patch tests the status of the request body in VRB_Ignore(), marking the request failed and that it should be closed on errors.
-
Martin Blix Grydeland authored
-
Martin Blix Grydeland authored
-
- 08 Dec, 2021 1 commit
-
-
Poul-Henning Kamp authored
Conflicts: bin/varnishd/cache/cache_esi_deliver.c This fixes a potential out-of-workspace panic.
-
- 30 Nov, 2021 1 commit
-
-
Dridi Boukelmoune authored
Otherwise valid code can panic on workspace exhaustion: std.ip(req.http.X-Real-IP, std.ip(req.http.X-Client-IP, client.ip)) If the nested std.ip() call runs out of workspace, it will return a null ip instead of the fallback, and the outer std.ip() call will panic upon checking the suckaddr sanity. Refs #3746
-
- 24 Nov, 2021 3 commits
-
-
Martin Blix Grydeland authored
-
Martin Blix Grydeland authored
-
Martin Blix Grydeland authored
-