* The new algorithm parse the headers in one pass (including folded
headers) thus multiple passes over the same memory area are avoided
(efficiency for large headers should be improved).
* Strict implementation of RFC 9110 and 9112 requirements, including
replacing or reporting error for unacceptable characters.
* Implemented various levels of strictness for requests interpretations:
three levels within RFC requirements (more strict and more secure; less
strict and more compatible with various clients; balanced (default)),
one more relaxed level with violation of RFC's SHOULD/SHOULD NOT,
one even more relaxed level with violation of MUST/MUST NOT,
one stricter level then required by RFC, but absolutely compatible with
clients following RFC's MUST/MUST NOT, and one more even stricter level
compatible with clients following both MUST/MUST NOT and
SHOULD/SHOULD NOT.
* Added detection and handling of more erroneous situations, like space
at the start of the first line (as recommended by RFC).
* Added more detailed responses for invalid requests with descriptions
of the found problems (as recommended by RFC).
* If many chars have been replaced, only summary is reported instead
of flooding logs with messages when request is badly constructed.
* Whitespaces in headers values are trimmed at start and at the end. No
need to handle extra spaces in the app or when using headers in other
MHD parts, like cookie parsing.
* In overall: increased flexibility, the security must be improved,
much better compliance with the standards.
New check works correctly with new compilers.
Added known problematic implementations.
Added more checks for correct behaviour.
Removed some m4 macros.
MHD_daemon_get_timeout computes the time to wait as:
timeout = (last_activity + connection_timeout - MHD_monotonic_sec_counter ()) * 1000
After sleeping timeout milliseconds, MHD_monotonic_sec_counter () will be:
MHD_monotonic_sec_counter () = last_activity + connection_timeout
With that (timeout < (MHD_monotonic_sec_counter () - connection->last_activity)) evaluates to false and the MHD_connection_close_ is not done.
For the next cycle, MHD_daemon_get_timeout() will return 0 and this goes on, until MHD_monotonic_sec_counter jumps to the next second.
This bug causes thousands of unnecessary calls to MHD_run, when a connection timed out.
Evgeny Grin (Karlson2k)
Rosen Penev
Christian Grothoff
Alexander Irion
silvioprog
Tim Rühsen