root/config.h

/* */

INCLUDED FROM

   1 /* config.h - configuration defines for xthttpd and libhttpd
   2 **
   3 ** Copyright (c) 1995,1998,1999,2000,2001
   4 **     Jef Poskanzer <jef@mail.acme.com>.  All rights reserved.
   5 ** Copyright (c) 2023,2024,2025
   6 **     Amelia Zabardast Ziabari <ame@psianesia.org>.  All rights reserved.
   7 **
   8 ** Redistribution and use in source and binary forms, with or without
   9 ** modification, are permitted provided that the following conditions
  10 ** are met:
  11 ** 1. Redistributions of source code must retain the above copyright
  12 **    notice, this list of conditions and the following disclaimer.
  13 ** 2. Redistributions in binary form must reproduce the above copyright
  14 **    notice, this list of conditions and the following disclaimer in the
  15 **    documentation and/or other materials provided with the distribution.
  16 **
  17 ** THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  18 ** ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  19 ** IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  20 ** ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  21 ** FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  22 ** DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  23 ** OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  24 ** HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  25 ** LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  26 ** OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  27 ** SUCH DAMAGE.
  28 */
  29 
  30 #ifndef _CONFIG_H_
  31 #define _CONFIG_H_
  32 
  33 
  34 /* The following configuration settings are sorted in order of decreasing
  35 ** likelihood that you'd want to change them - most likely first, least
  36 ** likely last.
  37 **
  38 ** In case you're not familiar with the convention, "#ifdef notdef"
  39 ** is a Berkeleyism used to indicate temporarily disabled code.
  40 ** The idea here is that you re-enable it by just moving it outside
  41 ** of the ifdef.
  42 */
  43 
  44 /* CONFIGURE: Pre-process config files using the system's "m4" process.
  45 ** You can use this to make more powerful configuration files.
  46 */
  47 #define PROCESS_CONFIG_M4
  48 
  49 /* CONFIGURE: CGI programs must match this pattern to get executed.  It's
  50 ** a simple shell-style wildcard pattern, with * meaning any string not
  51 ** containing a slash, ** meaning any string at all, and ? meaning any
  52 ** single character; or multiple such patterns separated by |.  The
  53 ** patterns get checked against the filename part of the incoming URL.
  54 **
  55 ** Restricting CGI programs to a single directory lets the site administrator
  56 ** review them for security holes, and is strongly recommended.  If there
  57 ** are individual users that you trust, you can enable their directories too.
  58 **
  59 ** You can also specify a CGI pattern on the command line, with the -c flag.
  60 ** Such a pattern overrides this compiled-in default.
  61 **
  62 ** If no CGI pattern is specified, neither here nor on the command line,
  63 ** then CGI programs cannot be run at all.  If you want to disable CGI
  64 ** as a security measure that's how you do it, just don't define any
  65 ** pattern here and don't run with the -c flag.
  66 */
  67 #ifdef notdef
  68 /* Some sample patterns.  Allow programs only in one central directory: */
  69 #define CGI_PATTERN "/cgi-bin/*"
  70 /* Allow programs in a central directory, or anywhere in a trusted
  71 ** user's tree: */
  72 #define CGI_PATTERN "/cgi-bin/*|/jef/**"
  73 /* Allow any program ending with a .cgi: */
  74 #define CGI_PATTERN "**.cgi"
  75 /* When virtual hosting, enable the central directory on every host: */
  76 #define CGI_PATTERN "/*/cgi-bin/*"
  77 #endif
  78 
  79 /* CONFIGURE: Provide a wrapper to be executed as an intermediate step
  80 ** between all CGI executions.  The wrapper is executed with the first arg
  81 ** containing the path to the originally intended CGI program, while the
  82 ** rest of the arguments are the original arguments intended for that program.
  83 **
  84 ** If this value is not specified in config.h, it defaults to nothing, which
  85 ** means no wrapper program will be used, and CGI programs will run as normal.
  86 **
  87 ** If a value is specified here, it can be overriden via the config file or
  88 ** command-line arguments. (cgiwrap and -w respectively)
  89 */
  90 #ifdef notdef
  91 /* An example program. */
  92 #define CGI_WRAP "/usr/libexec/php-wrapper"
  93 #endif
  94 
  95 /* CONFIGURE: How many seconds to allow CGI programs to run before killing
  96 ** them.  This is in case someone writes a CGI program that goes into an
  97 ** infinite loop, or does a massive database lookup that would take hours,
  98 ** or whatever.  If you don't want any limit, comment this out, but that's
  99 ** probably a really bad idea.
 100 */
 101 #define CGI_TIMELIMIT 30
 102 
 103 /* CONFIGURE: Maximum number of simultaneous CGI programs allowed.
 104 ** If this many are already running, then attempts to run more will
 105 ** return an HTTP 503 error.  If this is not defined then there's
 106 ** no limit (and you'd better have a lot of memory).  This can also be
 107 ** set in the runtime config file.
 108 */
 109 #define CGI_LIMIT 64
 110 
 111 /* CONFIGURE: How many seconds to allow for reading the initial request
 112 ** on a new connection.
 113 */
 114 #define IDLE_READ_TIMELIMIT 60
 115 
 116 /* CONFIGURE: How many seconds before an idle connection gets closed.
 117 */
 118 #define IDLE_SEND_TIMELIMIT 300
 119 
 120 /* CONFIGURE: The syslog facility to use.  Using this you can set up your
 121 ** syslog.conf so that all xthttpd messages go into a separate file.  Note
 122 ** that even if you use the -l command line flag to send logging to a
 123 ** file, errors still get sent via syslog.
 124 */
 125 #define LOG_FACILITY LOG_DAEMON
 126 
 127 /* CONFIGURE: Tilde mapping.  Many URLs use ~username to indicate a
 128 ** user's home directory.  xthttpd provides two options for mapping
 129 ** this construct to an actual filename.
 130 **
 131 ** 1) Map ~username to <prefix>/username.  This is the recommended choice.
 132 ** Each user gets a subdirectory in the main chrootable web tree, and
 133 ** the tilde construct points there.  The prefix could be something
 134 ** like "users", or it could be empty.  See also the makeweb program
 135 ** for letting users create their own web subdirectories.
 136 **
 137 ** 2) Map ~username to <user's homedir>/<postfix>.  The postfix would be
 138 ** the name of a subdirectory off of the user's actual home dir, something
 139 ** like "public_html".  This is what Apache and other servers do.  The problem
 140 ** is, you can't do this and chroot() at the same time, so it's inherently
 141 ** a security hole.  This is strongly dis-recommended, but it's here because
 142 ** some people really want it.  Use at your own risk.
 143 **
 144 ** You can also leave both options undefined, and xthttpd will not do
 145 ** anything special about tildes.  Enabling both options is an error.
 146 */
 147 #ifdef notdef
 148 #define TILDE_MAP_1 "users"
 149 #define TILDE_MAP_2 "public_html"
 150 #endif
 151 
 152 /* CONFIGURE: The file to use for authentication.  If this is defined then
 153 ** xthttpd checks for this file in the local directory before every fetch.
 154 ** If the file exists then authentication is done, otherwise the fetch
 155 ** proceeds as usual.
 156 **
 157 ** If you undefine this then xthttpd will not implement authentication
 158 ** at all and will not check for auth files, which saves a bit of CPU time.
 159 */
 160 #define AUTH_FILE ".htpasswd"
 161 
 162 /* CONFIGURE: The default character set name to use with text MIME types.
 163 ** This gets substituted into the MIME types where they have a "%s".
 164 **
 165 ** You can override this in the config file with the "charset" setting,
 166 ** or on the command like with the -T flag.
 167 */
 168 #define DEFAULT_CHARSET "UTF-8"
 169 
 170 
 171 /* Most people won't want to change anything below here. */
 172 
 173 /* CONFIGURE: This controls the SERVER_NAME environment variable that gets
 174 ** passed to CGI programs.  By default xthttpd does a gethostname(), which
 175 ** gives the host's canonical name.  If you want to always use some other name
 176 ** you can define it here.
 177 **
 178 ** Alternately, if you want to run the same xthttpd binary on multiple
 179 ** machines, and want to build in alternate names for some or all of
 180 ** them, you can define a list of canonical name to altername name
 181 ** mappings.  xthttpd seatches the list and when it finds a match on
 182 ** the canonical name, that alternate name gets used.  If no match
 183 ** is found, the canonical name gets used.
 184 **
 185 ** If both SERVER_NAME and SERVER_NAME_LIST are defined here, xthttpd searches
 186 ** the list as above, and if no match is found then SERVER_NAME gets used.
 187 **
 188 ** In any case, if xthttpd is started with the -h flag, that name always
 189 ** gets used.
 190 */
 191 #ifdef notdef
 192 #define SERVER_NAME "your.hostname.here"
 193 #define SERVER_NAME_LIST \
 194     "canonical.name.here/alternate.name.here", \
 195     "canonical.name.two/alternate.name.two"
 196 #endif
 197 
 198 /* CONFIGURE: Undefine this if you want xthttpd to hide its specific version
 199 ** when returning into to browsers.  Instead it'll just say "xthttpd" with
 200 ** no version.
 201 */
 202 #define SHOW_SERVER_VERSION
 203 
 204 /* CONFIGURE: Define this if you want xthttpd to specify the server's hostname
 205 ** (or the user's provided Host header) as well as the port number that the
 206 ** server is running on with each error page.  This replicates behaviour similar
 207 ** to Apache, but is disabled by default just in case the hostname of your
 208 ** system is particularly embarrassing.  You may want to enable this in order
 209 ** to be able to provide a link back to the root directory of the web-server on
 210 ** the error pages, though.
 211 */
 212 #ifdef notdef
 213 #define SHOW_SERVER_DETAILS
 214 #endif
 215 
 216 /* CONFIGURE: Define this if you want xthttpd to stop "correcting" the
 217 ** Content-Type header of XHTML documents when it encounters a user agent that
 218 ** can parse XHTML 1.0 but cannot reliably work if the Content-Type is set to
 219 ** application/xhtml+xml instead of text/html
 220 */
 221 #ifdef notdef
 222 #define STRICT_XHTML
 223 #endif
 224 
 225 /* CONFIGURE: Define this if you want to always chroot(), without having
 226 ** to give the -r command line flag.  Some people like this as a security
 227 ** measure, to prevent inadvertant exposure by accidentally running without -r.
 228 ** You can still disable it at runtime with the -nor flag.
 229 */
 230 #ifdef notdef
 231 #define ALWAYS_CHROOT
 232 #endif
 233 
 234 /* CONFIGURE: Define this if you want to always do virtual hosting, without
 235 ** having to give the -v command line flag.  You can still disable it at
 236 ** runtime with the -nov flag.
 237 */
 238 #ifdef notdef
 239 #define ALWAYS_VHOST
 240 #endif
 241 
 242 /* CONFIGURE: Define this if you want to always enable X-Forwarded-For, without
 243 ** having to give the -f command line flag.  You can still disable it at
 244 ** runtime with the -nof flag.
 245 */
 246 #ifdef notdef
 247 #define ALWAYS_FWDHDR
 248 #endif
 249 
 250 /* CONFIGURE: If you're using the vhost feature and you have a LOT of
 251 ** virtual hostnames (like, hundreds or thousands), you will want to
 252 ** enable this feature.  It avoids a problem with most Unix filesystems,
 253 ** where if there are a whole lot of items in a directory then name lookup
 254 ** becomes very slow.  This feature makes xthttpd use subdirectories
 255 ** based on the first characters of each hostname.  You can set it to use
 256 ** from one to three characters.  If the hostname starts with "www.", that
 257 ** part is skipped over.  Dots are also skipped over, and if the name isn't
 258 ** long enough then "_"s are used.  Here are some examples of how hostnames
 259 ** would get turned into directory paths, for each different setting:
 260 ** 1: www.acme.com ->    a/www.acme.com
 261 ** 1: foobar.acme.com -> f/foobar.acme.com
 262 ** 2: www.acme.com ->    a/c/www.acme.com
 263 ** 2: foobar.acme.com -> f/o/foobar.acme.com
 264 ** 3: www.acme.com ->    a/c/m/www.acme.com
 265 ** 3: foobar.acme.com -> f/o/o/foobar.acme.com
 266 ** 3: m.tv ->            m/t/v/m.tv
 267 ** 4: m.tv ->            m/t/v/_/m.tv
 268 ** Note that if you compile this setting in but then forget to set up
 269 ** the corresponding subdirectories, the only error indication you'll
 270 ** get is a "404 Not Found" when you try to visit a site.  So be careful.
 271 */
 272 #ifdef notdef
 273 #define VHOST_DIRLEVELS 1
 274 #define VHOST_DIRLEVELS 2
 275 #define VHOST_DIRLEVELS 3
 276 #endif
 277 
 278 /* CONFIGURE: Define this if you want to always use a global passwd file,
 279 ** without having to give the -P command line flag.  You can still disable
 280 ** it at runtime with the -noP flag.
 281 */
 282 #ifdef notdef
 283 #define ALWAYS_GLOBAL_PASSWD
 284 #endif
 285 
 286 /* CONFIGURE: When started as root, the default username to switch to after
 287 ** initializing.  If this user (or the one specified by the -u flag) does
 288 ** not exist, the program will refuse to run.
 289 */
 290 #define DEFAULT_USER "nobody"
 291 
 292 /* CONFIGURE: When started as root, the program can automatically chdir()
 293 ** to the home directory of the user specified by -u or DEFAULT_USER.
 294 ** An explicit -d still overrides this.
 295 */
 296 #ifdef notdef
 297 #define USE_USER_DIR
 298 #endif
 299 
 300 /* CONFIGURE: If this is defined, some of the built-in error pages will
 301 ** have more explicit information about exactly what the problem is.
 302 ** Some sysadmins don't like this, for security reasons.
 303 */
 304 #ifdef notdef
 305 #define EXPLICIT_ERROR_PAGES
 306 #endif
 307 
 308 /* CONFIGURE: Subdirectory for custom error pages.  The error filenames are
 309 ** $WEBDIR/$ERR_DIR/err%d.html - if virtual hosting is enabled then
 310 ** $WEBDIR/hostname/$ERR_DIR/err%d.html is searched first.  This allows
 311 ** different custom error pages for each virtual hosting web server.  If
 312 ** no custom page for a given error can be found, the built-in error page
 313 ** is generated.  If ERR_DIR is not defined at all, only the built-in error
 314 ** pages will be generated.
 315 */
 316 #define ERR_DIR "errors"
 317 
 318 /* CONFIGURE: Define this if you want a standard HTML tail containing
 319 ** $SERVER_SOFTWARE and $SERVER_ADDRESS to be appended to the custom error
 320 ** pages.  (It is always appended to the built-in error pages.)
 321 */
 322 #ifdef notdef
 323 #define ERR_APPEND_SERVER_INFO
 324 #endif
 325 
 326 /* CONFIGURE: nice(2) value to use for CGI programs.  If this is undefined,
 327 ** CGI programs run at normal priority.
 328 */
 329 #define CGI_NICE 10
 330 
 331 /* CONFIGURE: $PATH to use for CGI programs.
 332 */
 333 #define CGI_PATH "/usr/ucb:/bin:/sbin:/usr/bin:/usr/sbin:/usr/pkg/bin:/usr/pkg/sbin:/usr/local/bin:/usr/local/sbin"
 334 
 335 /* CONFIGURE: If defined, $LD_LIBRARY_PATH to use for CGI programs.
 336 */
 337 #ifdef notdef
 338 #define CGI_LD_LIBRARY_PATH "/usr/local/lib:/usr/lib"
 339 #endif
 340 
 341 /* CONFIGURE: How often to run the occasional cleanup job.
 342 */
 343 #define OCCASIONAL_TIME 120
 344 
 345 /* CONFIGURE: Seconds between stats syslogs.  If this is undefined then
 346 ** no stats are accumulated and no stats syslogs are done.
 347 */
 348 #define STATS_TIME 3600
 349 
 350 /* CONFIGURE: The mmap cache tries to keep the total number of mapped
 351 ** files below this number, so you don't run out of kernel file descriptors.
 352 ** If you have reconfigured your kernel to have more descriptors, you can
 353 ** raise this and xthttpd will keep more maps cached.  However it's not
 354 ** a hard limit, xthttpd will go over it if you really are accessing
 355 ** a whole lot of files.
 356 */
 357 #define DESIRED_MAX_MAPPED_FILES 1000
 358 
 359 /* CONFIGURE: The mmap cache also tries to keep the total mapped bytes
 360 ** below this number, so you don't run out of address space.  Again
 361 ** it's not a hard limit, xthttpd will go over it if you really are
 362 ** accessing a bunch of large files.
 363 */
 364 #define DESIRED_MAX_MAPPED_BYTES 1000000000
 365 
 366 
 367 /* You almost certainly don't want to change anything below here. */
 368 
 369 /* CONFIGURE: When throttling CGI programs, we don't know how many bytes
 370 ** they send back to the client because it would be inefficient to
 371 ** interpose a counter.  CGI programs are much more expensive than
 372 ** regular files to serve, so we set an arbitrary and high byte count
 373 ** that gets applied to all CGI programs for throttling purposes.
 374 */
 375 #define CGI_BYTECOUNT 25000
 376 
 377 /* CONFIGURE: The default port to listen on.  80 is the standard HTTP port.
 378 */
 379 #define DEFAULT_PORT 80
 380 
 381 /* CONFIGURE: A list of index filenames to check.  The files are searched
 382 ** for in this order.
 383 */
 384 #define INDEX_NAMES "index.html", "index.htm", "index.xhtml", "index.xht", "Default.htm", "index.cgi", "index.pl", "index.php"
 385 
 386 /* CONFIGURE: If this is defined then xthttpd will automatically generate
 387 ** index pages for directories that don't have an explicit index file.
 388 ** If you want to disable this behavior site-wide, perhaps for security
 389 ** reasons, just undefine this.  Note that you can disable indexing of
 390 ** individual directories by merely doing a "chmod 711" on them - the
 391 ** standard Unix file permission to allow file access but disable "ls".
 392 */
 393 #define GENERATE_INDEXES
 394 
 395 /* CONFIGURE: If this is defined then xthttpd will use the older style of index
 396 ** pages used in the original thttpd (raw-ish text output similar to the result
 397 ** of the "ls -l" command), rather than a newer style with a similar look to
 398 ** Apache or other more sophisticated web-servers.  The newer style provides
 399 ** less information, such as permissions, which may be relevant for security.
 400 */
 401 #ifdef notdef
 402 #define OLD_STYLE_INDEXES
 403 #endif
 404 
 405 /* CONFIGURE: If this is defined, xthttpd will show hidden files in
 406 ** directory indexes again.
 407 */
 408 #ifdef notdef
 409 #define INDEX_SHOW_HIDDEN
 410 #endif
 411 
 412 /* CONFIGURE: If this is defined, xthttpd will not serve X.gz when X is
 413 ** requested.
 414 */
 415 #ifdef notdef
 416 #define DISABLE_GZ
 417 #endif
 418 
 419 /* CONFIGURE: If this is defined, xthttpd will accept MIME encodings via
 420 ** mime_encodings.txt.
 421 */
 422 #ifdef notdef
 423 #define ENABLE_MIME_ENCODING
 424 #endif
 425 
 426 /* CONFIGURE: Whether to log unknown request headers.  Most sites will not
 427 ** want to log them, which will save them a bit of CPU time.
 428 */
 429 #ifdef notdef
 430 #define LOG_UNKNOWN_HEADERS
 431 #endif
 432 
 433 /* CONFIGURE: Time between updates of the throttle table's rolling averages. */
 434 #define THROTTLE_TIME 2
 435 
 436 /* CONFIGURE: The listen() backlog queue length.  The 1024 doesn't actually
 437 ** get used, the kernel uses its maximum allowed value.  This is a config
 438 ** parameter only in case there's some OS where asking for too high a queue
 439 ** length causes an error.  Note that on many systems the maximum length is
 440 ** way too small.
 441 */
 442 #define LISTEN_BACKLOG 1024
 443 
 444 /* CONFIGURE: Maximum number of throttle patterns that any single URL can
 445 ** be included in.  This has nothing to do with the number of throttle
 446 ** patterns that you can define, which is unlimited.
 447 */
 448 #define MAXTHROTTLENUMS 10
 449 
 450 /* CONFIGURE: Number of file descriptors to reserve for uses other than
 451 ** connections.  Currently this is 10, representing one for the listen fd,
 452 ** one for dup()ing at connection startup time, one for reading the file,
 453 ** one for syslog, and possibly one for the regular log file, which is
 454 ** five, plus a factor of two for who knows what.
 455 */
 456 #define SPARE_FDS 10
 457 
 458 /* CONFIGURE: How many milliseconds to leave a connection open while doing a
 459 ** lingering close.
 460 */
 461 #define LINGER_TIME 500
 462 
 463 /* CONFIGURE: Maximum number of symbolic links to follow before
 464 ** assuming there's a loop.
 465 */
 466 #define MAX_LINKS 32
 467 
 468 /* CONFIGURE: You don't even want to know.
 469 */
 470 #define MIN_RESTART_DELAY 100L
 471 #define MAX_RESTART_DELAY 500L
 472 #define MIN_WOULDBLOCK_DELAY 100L
 473 
 474 #endif /* _CONFIG_H_ */

/* */