[asterisk-dev] [Code Review] 4374: Asterisk: For httpd server, need option to define server name for security purposes

[Ashley Sanders]

> On Jan. 27, 2015, 7:48 p.m., rmudgett wrote:
> > ./branches/13/main/http.c, line 640
> > <https://reviewboard.asterisk.org/r/4374/diff/1-2/?file=71085#file71085line640>
> >
> >     This seems kind of small for the amount that could be put in here.  May want to switch to using an ast_str for this and use ast_str_set_va() instead of the snprintf() when filling the string.

You are correct, this is a small amount. From the previous review, you advised to take the larger of the error/auth functions' header size and use that, which, admittedly, was different from this = 256. However, thinking about it, that amount even seems small and not very useful.

What size seems reasonably large enough to be useful but small enough to be succinct such as not to create an exception on the other side?

I found this answer from 2010: http://stackoverflow.com/a/3436155
and this from 2012: http://stackoverflow.com/a/686243


- Ashley


-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviewboard.asterisk.org/r/4374/#review14324
-----------------------------------------------------------


On Jan. 27, 2015, 6:16 p.m., Ashley Sanders wrote:
> 
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviewboard.asterisk.org/r/4374/
> -----------------------------------------------------------
> 
> (Updated Jan. 27, 2015, 6:16 p.m.)
> 
> 
> Review request for Asterisk Developers.
> 
> 
> Bugs: ASTERISK-24316
>     https://issues.asterisk.org/jira/browse/ASTERISK-24316
> 
> 
> Repository: Asterisk
> 
> 
> Description
> -------
> 
> Currently, all responses from the Asterisk HTTP server contain a [Server] header that identifies Asterisk and its version (e.g. "Server:Asterisk/<version>", where <version> is the currently running version of Asterisk). The preferred behavior is to allow the user to configure an alternate name to use for the value returned in the [Server] header for HTTP responses (e.g. "Server:SomeSuperAwesomeServerName").
> 
> This patch provides a new configuration property, [servername], in http.conf, that gives users the ability to modify the value that Asterisk uses when identifying itself. 
> 
> By default, the new property is unused, which means that out-of-the-box, the HTTP server behaves just like it did prior to the patch. Requests to the HTTP server will generate responses with the old-style [Server] header (e.g. "Server:Asterisk/<version>", where <version> is the currently running version of Asterisk). To see the new behavior, you must add the configuration property, [servername] with some value (an empty value will work, also) to http.conf.
> 
> Whatever value the HTTP server is holding for the server name can now be seen through the httpstatus web page (http://<bindaddr>:<bindport>/<prefix>/httpstatus) (where [bindaddr], [bindport], and [prefix] are all values configured in http.conf) and the CLI command: http show status.
> 
> ***Note*** This is just the patch to the Asterisk source. You can find the review for the Testsuite at: https://reviewboard.asterisk.org/r/4377/
> 
> 
> Diffs
> -----
> 
>   ./branches/13/main/http.c 431112 
>   ./branches/13/include/asterisk/http.h 431112 
>   ./branches/13/configs/samples/http.conf.sample 431112 
> 
> Diff: https://reviewboard.asterisk.org/r/4374/diff/
> 
> 
> Testing
> -------
> 
> 
> Thanks,
> 
> Ashley Sanders
> 
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.digium.com/pipermail/asterisk-dev/attachments/20150128/6ff0cb5f/attachment.html>