From: Andrew Kloet <andrew@kloet.net>
Subject: Re: PATCH: httpd: support gzip-static for directory index files
To: tech@openbsd.org
Date: Thu, 12 Mar 2026 21:31:19 -0400

On 2/14/26 8:52 PM, Andrew Kloet wrote:
> On January 25, 2026 7:10:58 PM UTC, Andrew Kloet <andrew@kloet.net> wrote:
>> Hello,
>>
>> Currently, when gzip-static is enabled in httpd.conf, it does not work
>> for directory index files when the full path is not given.
>> (e.g., http://example.com/ instead of http://example.com/index.html).
>>
>> This problem was previously reported in 2023:
>> https://marc.info/?l=openbsd-misc&m=169957389612286&w=2
>>
>> The issue is in server_file_access(). When a directory is requested, the
>> function appends the index name and calls itself recursively. If the
>> recursive call finds a .gz file, it correctly sets up the response
>> headers and file descriptor. However, the parent call continues to
>> process the directory logic, fails to immediately propagate the
>> successful return code without further side effects, and handles the
>> directory file descriptor in a way that interferes with the final
>> response
>>
>> The following patch ensures that the result of the recursive index
>> lookup is propagated.
>>
>> Index: usr.sbin/httpd/server_file.c
>> ===================================================================
>> RCS file: /cvs/src/usr.sbin/httpd/server_file.c,v
>> diff -u -p -u -p -r1.80 server_file.c
>> --- usr.sbin/httpd/server_file.c        29 Apr 2024 16:17:46 -0000      1.80
>> +++ usr.sbin/httpd/server_file.c        25 Jan 2026 18:53:31 -0000
>> @@ -135,21 +135,14 @@ server_file_access(struct httpd *env, st
>>                 }
>>
>>                 ret = server_file_access(env, clt, path, len);
>> -               if (ret == 404) {
>> -                       /*
>> -                        * Index file not found; fail if auto-indexing is
>> -                        * not enabled, otherwise return success but
>> -                        * indicate directory with S_ISDIR of the previous
>> -                        * stat.
>> -                        */
>> -                       if ((srv_conf->flags & SRVFLAG_AUTO_INDEX) == 0) {
>> -                               close(fd);
>> -                               return (403);
>> -                       }
>> -
>> +               if (ret == 404 && (srv_conf->flags & SRVFLAG_AUTO_INDEX)) {
>> +                       /* Use the existing directory fd for indexing */
>>                         return (server_file_index(env, clt, fd, &st));
>>                 }
>> +
>>                 close(fd);
>> +               if (ret == 404)
>> +                       return (403);
>>                 return (ret);
>>         } else if (!S_ISREG(st.st_mode)) {
>>                 /* Don't follow symlinks and ignore special files */
>>
> 
> Bumping this thread.
> 
> To summarize: current server_file_access logic fails to propagate the
> gzip-static result during recursive directory index lookups. The patch
> ensures the recursive call's return code and file state are respected.
> 
> Looking for feedback, thanks.
> 
> Andrew
> 
ping