lear

lear copied to clipboard

There is a logical defect that causes a denial of service vulnerability

1

src/http.c lines 156-165: ``` if(compare_string_const(&protocol, C_HTTP[1])) { request->version = V1_1; } else if(compare_string_const(&protocol, C_HTTP[0])) { request->version = V1_0; } else { message_log("HTTP version unsupported", DEBUG); request->status = HTTP_VERSION_NOT_SUPPORTED; } ```...

zztytu

Virtual hosts should be supported. Host should be stored in and retrieved from highly optimized string->dir hash table

Glorf

As it's used only by VERY outdated clients and by most web-crawling robots, AFAIK It's worth discussing how to do it - whether server should handle incoming HTTP/1.0 as HTTP/1.1,...

Glorf

Allow HTTPS connections. This should: * Use OpenSSL (or another *SSL library if found faster & secure enough) * Be able to be disabled at compilation time and introduce no...

Glorf

Frequently used files should be cached in memory using custom caching method, and retrieved using string->ptr hashmap. File retrieval to cache should be subscribed by native linux AIO (use bare...

Glorf

Test framework should be chosen. Tests should be written

Glorf

It's a must be for server that claims to be fast

Glorf

Compression should be allowed, if user precises so in his headers. The compression rate should be chosen based on CPU/transfer tradeoff

Glorf