On January 25, 2026 7:10:58 PM UTC, Andrew Kloet <andrew@kloet.net> wrote:
>Hello,
>
>Currently, when gzip-static is enabled in httpd.conf, it does not work
>for directory index files when the full path is not given.
>(e.g., http://example.com/ instead of http://example.com/index.html).
>
>This problem was previously reported in 2023:
>https://marc.info/?l=openbsd-misc&m=169957389612286&w=2
>
>The issue is in server_file_access(). When a directory is requested, the
>function appends the index name and calls itself recursively. If the
>recursive call finds a .gz file, it correctly sets up the response
>headers and file descriptor. However, the parent call continues to
>process the directory logic, fails to immediately propagate the
>successful return code without further side effects, and handles the
>directory file descriptor in a way that interferes with the final
>response
>
>The following patch ensures that the result of the recursive index
>lookup is propagated.
>
>Index: usr.sbin/httpd/server_file.c
>===================================================================
>RCS file: /cvs/src/usr.sbin/httpd/server_file.c,v
>diff -u -p -u -p -r1.80 server_file.c
>--- usr.sbin/httpd/server_file.c        29 Apr 2024 16:17:46 -0000      1.80
>+++ usr.sbin/httpd/server_file.c        25 Jan 2026 18:53:31 -0000
>@@ -135,21 +135,14 @@ server_file_access(struct httpd *env, st
>                }
>
>                ret = server_file_access(env, clt, path, len);
>-               if (ret == 404) {
>-                       /*
>-                        * Index file not found; fail if auto-indexing is
>-                        * not enabled, otherwise return success but
>-                        * indicate directory with S_ISDIR of the previous
>-                        * stat.
>-                        */
>-                       if ((srv_conf->flags & SRVFLAG_AUTO_INDEX) == 0) {
>-                               close(fd);
>-                               return (403);
>-                       }
>-
>+               if (ret == 404 && (srv_conf->flags & SRVFLAG_AUTO_INDEX)) {
>+                       /* Use the existing directory fd for indexing */
>                        return (server_file_index(env, clt, fd, &st));
>                }
>+
>                close(fd);
>+               if (ret == 404)
>+                       return (403);
>                return (ret);
>        } else if (!S_ISREG(st.st_mode)) {
>                /* Don't follow symlinks and ignore special files */
>

Bumping this thread.

To summarize: current server_file_access logic fails to propagate the
gzip-static result during recursive directory index lookups. The patch
ensures the recursive call's return code and file state are respected.

Looking for feedback, thanks.

Andrew