Reserve the first MB of the DVA address space because qwx(4) doesn't
succeed in doing DMA when the DVA is 0x1000 and PCI-PCI bridges may not
forward address in part of that first MB as well.
ok chris@
Error out on presence of Content-Length and Transfer-Encoding headers
for GET, HEAD and other methods that should have no body.
Ignoring the Content-Length header makes httpd vulnerable to
HTTP request smuggling. A crafted GET request may embed an extra
HTTP request which could bypass a proxy or WAF but then is handled
by httpd.
Remove the special case for TRACE and CONNECT in the Content-Length
handling. Move those checks into the method switch at the end of the
header parsing phase and by that also cover more methods including
GET and HEAD. If either header is present simply abort the connection,
nobody should send extra data along GET and HEAD requests.
Add an an explicit HTTP_METHOD_TRACE case above the default case
to indicated that we deliberately don't handle TRACE requests.
This security vulnerability was found by Nicola Staller of SySS GmbH.
With and OK rsadowski@ previous version also OK florian@
enable forced resolvers that aren't in a preference block
allows a config such as:
preference { autoconf }
forwarder { 127.0.0.1 port 5300 }
force forwarder { local }
also fix a typo while i'm here
ok florian
regress/mmap: Test hints in VM-area edge cases
Test mmap(2) with hint above VM_MAXUSER_ADDRESS without MAP_FIXED.
This tests uvm_map.c,v 1.355.
Also test the lower boundary below PAGE_SIZE.
ok kettenis@
