From: Rafael Sadowski <rafael@sizeofvoid.org>
Subject: Re: httpd header drop
To: Nikola Kolev <koue@chaosophia.net>
Cc: tech@openbsd.org
Date: Fri, 9 Oct 2026 19:03:23 +0200

On Tue Oct 06, 2026 at 10:54:15PM +0000, Nikola Kolev wrote:
> Hi @tech,
> 
> this is small change how httpd handles 'header drop'.
> It's the same approach as 'location block drop':
> set return_code 0, call server_abort_http and log in error.log only.
> 
> Also add test to regress.
> 

Thanks for the test.

> diff --git regress/usr.sbin/httpd/tests/Httpd.pm regress/usr.sbin/httpd/tests/Httpd.pm
> index 53fed7204..1851f1457 100644
> --- regress/usr.sbin/httpd/tests/Httpd.pm
> +++ regress/usr.sbin/httpd/tests/Httpd.pm
> @@ -77,6 +77,7 @@ sub new {
>  	}
>  	print $fh "\n\troot \"/\"";
>  	print $fh "\n\tlog style combined";
> +	print $fh "\n\theader drop \"User-Agent\" \"crawlbot\"";
>  	print $fh  "\n}\n";
>  
>  	return $self;
> diff --git regress/usr.sbin/httpd/tests/args-header-drop.pl regress/usr.sbin/httpd/tests/args-header-drop.pl
> new file mode 100644
> index 000000000..22898cdba
> --- /dev/null
> +++ regress/usr.sbin/httpd/tests/args-header-drop.pl
> @@ -0,0 +1,18 @@
> +use strict;
> +use warnings;
> +
> +our %args = (
> +    client => {
> +	header => {
> +		"User-Agent" => "crawlbot"
> +	},
> +	nocheck => 1
> +    },
> +    httpd => {
> +	loggrep => {
> +	    qr/dropped/ => 1,
> +	},
> +    },
> +);
> +
> +1;
> diff --git regress/usr.sbin/httpd/tests/funcs.pl regress/usr.sbin/httpd/tests/funcs.pl
> index 84c96f188..1b9aa9aa0 100644
> --- regress/usr.sbin/httpd/tests/funcs.pl
> +++ regress/usr.sbin/httpd/tests/funcs.pl
> @@ -183,6 +183,7 @@ sub http_request {
>  
>  sub http_response {
>  	my ($self, $len) = @_;
> +	return if $self->{nocheck};
>  	my $method = $self->{method} || "GET";
>  	my $code = $self->{code} || "200 OK";
>  
> diff --git usr.sbin/httpd/parse.y usr.sbin/httpd/parse.y
> index 3da845035..13cb546b7 100644
> --- usr.sbin/httpd/parse.y
> +++ usr.sbin/httpd/parse.y
> @@ -914,6 +914,7 @@ header		: HEADER REMOVE STRING optalways	{
>  				YYERROR;
>  			}
>  
> +			hrule->return_code = 0;
>  			hrule->name = $3;
>  			hrule->value = $4;
>  
> diff --git usr.sbin/httpd/server_http.c usr.sbin/httpd/server_http.c
> index 582f34fb9..4beccbaca 100644
> --- usr.sbin/httpd/server_http.c
> +++ usr.sbin/httpd/server_http.c
> @@ -1511,9 +1511,6 @@ server_response(struct httpd *httpd, struct client *clt)
>  	if ((mrule = server_match_header_rule(srv_conf, desc)) != NULL) {
>  		switch (mrule->action) {
>  		case HEADER_ACTION_DROP:
> -			(void)server_log_http(clt, 0, 0);

We will lose the log.

> -			server_close(clt, mrule->return_uri);
> -			return (-1);
>  		case HEADER_ACTION_RDR:
>  		case HEADER_ACTION_RETURN:
>  			server_abort_http(clt, mrule->return_code,