04-notify-on-block.patch

Copyright (c) 2021 - 2026 Matthias Pressfreund

Permission to use, copy, modify, and distribute this software for any
purpose with or without fee is hereby granted, provided that the above
copyright notice and this permission notice appear in all copies.

THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

Index: usr.sbin/httpd/config.c
@@ -1,6 +1,7 @@
 /*	$OpenBSD: config.c,v 1.81 2026/10/15 10:59:00 rsadowski Exp $	*/
 
 /*
+ * Copyright (c) 2021 Matthias Pressfreund
  * Copyright (c) 2011 - 2015 Reyk Floeter <reyk@openbsd.org>
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -740,6 +741,7 @@
 	uint8_t			*p = imsg->data;
 	uint64_t		 f;
 	size_t			 s;
+	struct timeval		*tv;
 
 	if ((srv_conf = calloc(1, sizeof(*srv_conf))) == NULL)
 		return (-1);
@@ -895,6 +897,16 @@
 		    sizeof(srv_conf->errdocroot));
 
 		srv_conf->flags |= parent->flags & SRVFLAG_NO_BANNER;
+
+		if (*srv_conf->notifier.socket.sun_path == '\0')
+			srv_conf->notifier.socket = parent->notifier.socket;
+		if (*srv_conf->notifier.message == '\0')
+			(void)strlcpy(srv_conf->notifier.message,
+			    parent->notifier.message,
+			    sizeof(srv_conf->notifier.message));
+		tv = &srv_conf->notifier.timeout;
+		if (!timeval_isset(tv))
+			*tv = parent->notifier.timeout;
 
 		DPRINTF("%s: %s %d location \"%s\", "
 		    "parent \"%s[%u]\", flags: %s",
Index: usr.sbin/httpd/httpd.conf.5
@@ -737,6 +737,119 @@
 .Xr syslog 3
 instead of the log files.
 .El
+.Tg notify-on-block
+.It Oo Ic no Oc Ic notify-on-block Ar option | Brq ...
+Makes
+.Xr httpd 8
+send a notification message to a listening UNIX-domain socket right after the
+connection to the client has been closed due to a
+.Ic block
+directive.
+If specified on
+.Ic server
+level,
+.Ic notify-on-block
+will be inherited by all enclosed locations unless
+.Ic no notify-on-block
+is specified.
+In case making the connection or sending the message fails (either because of
+transmission error or timeout), a corresponding warning will be written into
+the system log.
+.Pp
+Options may be specified either one at a time or enclosed in curly braces.
+Valid options are:
+.Bl -tag -width Ds
+.It Ic message Ar string ... | Ic drop
+Specifies the notification message to be sent and may consist of one or more
+parts.
+Each part may be either a regular
+.Ar string
+or one of the newline substitutes
+.Ic cr
+.Pq Sq Dv \er
+or
+.Ic lf
+.Pq Sq Dv \en .
+The parts will be concatenated in the given order.
+.Pp
+Additionally, a
+.Ar string
+may contain the following macros which will be expanded at runtime:
+.Pp
+.Bl -tag -width $HTTP_USER_AGENT -offset indent -compact
+.It Ic $HTTP_HOST
+The host from the HTTP
+.Sq Dv Host
+header.
+.It Ic $HTTP_REFERRER
+The referrer from the HTTP
+.Sq Dv Referer
+header.
+.It Ic $HTTP_USER_AGENT
+The user agent from the HTTP
+.Sq Dv User-Agent
+header.
+.It Ic $REMOTE_ADDR
+The client IP address.
+.It Ic $REMOTE_PORT
+The client source port.
+.It Ic $REMOTE_USER
+The HTTP authenticated remote user.
+.It Ic $REQUEST_METHOD
+The HTTP method the connected client used when making the request.
+.It Ic $REQUEST_SCHEME
+The request scheme
+.Pq So Dv http Sc No or Sq Dv https .
+.It Ic $REQUEST_URI
+The request path and optional query string.
+.It Ic $RESPONSE_CODE
+The 3-digit HTTP response code sent to the client or
+.Sq Dv 000
+if the connection was dropped.
+.It Ic $RESPONSE_URI
+The URI sent to the client in the HTTP
+.Sq Dv Location
+header.
+.El
+.Pp
+The following example defines a two line message, line 1 containing the client
+IP address, line 2 the requested URI, using
+.Sq Dv \en
+as the newline character:
+.Bd -literal -offset indent
+notify-on-block {
+	socket "/run/example.sock"
+	message "$REMOTE_ADDR" lf \(rs
+		"$REQUEST_URI"
+}
+.Ed
+.Pp
+Here, the two string parts of the
+.Ic message
+internally concatenate and transform to
+.Pp
+.Dl message \(dq$REMOTE_ADDR\en$REQUEST_URI\(dq
+.Pp
+If
+.Ic drop
+is specified instead of an actual message, a previously (perhaps in a parent
+.Ic server )
+defined message will be deleted.
+.It Ic socket Ar path
+Specifies the
+.Ar path
+to the listening UNIX-domain socket that will be notified.
+.Tg timeout
+.It Oo Ic no Oc Ic timeout Ar millis
+Set the maximum time the server will try to send the notification message to
+.Ar millis
+milliseconds, or disable the
+.Ic timeout
+by specifying the
+.Ic no
+keyword.
+Defaults to 2000 milliseconds.
+.El
 .It Ic pass
 Disable any previous
 .Ic block
Index: usr.sbin/httpd/httpd.h
@@ -27,6 +27,7 @@
 #include <sys/queue.h>
 #include <sys/tree.h>
 #include <sys/time.h>
+#include <sys/un.h>
 
 #include <net/if.h>
 #include <netinet/in.h>
@@ -91,6 +92,8 @@
 #define SERVER_DEF_TLS_LIFETIME	(2 * 3600)
 #define SERVER_MIN_TLS_LIFETIME	(60)
 #define SERVER_MAX_TLS_LIFETIME	(24 * 3600)
+#define SERVER_MAXNOTIFYMESSAGE	512
+#define SERVER_NOTIFYTIMEOUT	2000
 
 #define MEDIATYPE_NAMEMAX	128	/* file name extension */
 #define MEDIATYPE_TYPEMAX	64	/* length of type/subtype */
@@ -534,6 +537,26 @@
 	struct client_addr	 xff;
 };
 
+struct socket_notifier {
+	struct sockaddr_un	 socket;
+	char			 message[SERVER_MAXNOTIFYMESSAGE];
+	struct timeval		 timeout;
+};
+#define timeval_isset(t)	((t)->tv_sec != 0 || (t)->tv_usec != 0)
+#define timeval_setmillis(t, m)	do {		\
+	(t)->tv_sec = (m) / 1000;		\
+	(t)->tv_usec = (m) % 1000 * 1000;	\
+} while (0)
+
+struct notify_message {
+	const char	*str;
+	size_t		 size;
+	size_t		 n;
+	const char	*path;
+	struct timeval	*tv;
+	struct event	*ev;
+};
+
 struct server_config {
 	uint32_t			 id;
 	uint32_t			 parent_id;
@@ -611,6 +634,7 @@
 
 	char				 fcgiscript[PATH_MAX];
 	struct addr_filter		 clientfilter[HTTPD_CLIENT_FILTER_MAX];
+	struct socket_notifier		 notifier;
 
 	TAILQ_ENTRY(server_config)	 entry;
 };
Index: usr.sbin/httpd/parse.y
@@ -145,7 +145,7 @@
 %token	ACCESS ADD ALIAS ALWAYS AUTHENTICATE AUTO
 %token	BACKLOG BANNER BLOCK BODY BUFFER
 %token	CA CACHE CERTIFICATE CHROOT CIPHERS CLIENT COMBINED COMMON CONNECTION
-%token	CRL
+%token	CR CRL
 %token	DEFAULT DHE DIRECTORY DROP
 %token	ECDHE ERR ERRDOCS ERROR
 %token	FCGI FORWARDED FOUND FROM
@@ -153,9 +153,9 @@
 %token	HEADER HSTS
 %token	INCLUDE INDEX IP
 %token	KEY
-%token	LIFETIME LISTEN LOCATION LOG LOGDIR
-%token	MATCH MAXAGE MAXIMUM
-%token	NO NODELAY NOT
+%token	LF LIFETIME LISTEN LOCATION LOG LOGDIR
+%token	MATCH MAXAGE MAXIMUM MESSAGE
+%token	NO NODELAY NOT NOTIFY
 %token	OCSP ON OPTIONAL
 %token	PARAM PASS PORT PREFORK PRELOAD PROTOCOLS
 %token	REMOVE REQUEST REQUESTS RETURN REWRITE ROOT
@@ -169,8 +169,8 @@
 %type	<v.string>	fcgiport
 %type	<v.number>	optalways opttls optmatch optfound
 %type	<v.tv>		timeout
-%type	<v.string>	numberstring optstring
-%type	<v.string>	optclientfilter clientfilters_l
+%type	<v.string>	numberstring optstring stringornl
+%type	<v.string>	optclientfilter clientfilters_l msgopts_l
 %type	<v.auth>	authopts
 
 %%
@@ -1520,6 +1520,25 @@
 			srv_conf->flags &= ~SRVFLAG_BLOCK;
 			srv_conf->flags |= SRVFLAG_NO_BLOCK;
 		}
+		| NO NOTIFY			{
+			memset(&srv_conf->notifier, 0,
+			    sizeof(srv_conf->notifier));
+		}
+		| NOTIFY			{
+			if (parentsrv != NULL)
+				srv_conf->notifier =
+				    parentsrv->srv_conf.notifier;
+		} notifyopts_v			{
+			struct timeval	*tv;
+
+			if (*srv_conf->notifier.message == '\0') {
+				yyerror("empty notify message");
+				YYERROR;
+			}
+			tv = &srv_conf->notifier.timeout;
+			if (!timeval_isset(tv))
+				timeval_setmillis(tv, SERVER_NOTIFYTIMEOUT);
+		}
 		;
 
 block		: BLOCK				{
@@ -1528,6 +1547,92 @@
 		}
 		;
 
+notifyopts_v	: '{' optnl notifyopts_l '}'
+		| notifyopts
+		;
+
+notifyopts_l	: notifyopts optcommanl notifyopts_l
+		| notifyopts optnl
+		;
+
+notifyopts	: MESSAGE DROP		{
+			*srv_conf->notifier.message = '\0';
+		}
+		| MESSAGE msgopts_l	{
+			if (strlcpy(srv_conf->notifier.message, $2,
+			    sizeof(srv_conf->notifier.message)) >=
+			    sizeof(srv_conf->notifier.message)) {
+				yyerror("notify message too long");
+				free($2);
+				YYERROR;
+			}
+			free($2);
+	   	}
+		| NO TIMEOUT		{
+			memset(&srv_conf->notifier.timeout, 0,
+			    sizeof(srv_conf->notifier.timeout));
+		}
+		| SOCKET STRING		{
+			if (strlcpy(srv_conf->notifier.socket.sun_path, $2,
+			    sizeof(srv_conf->notifier.socket.sun_path)) >=
+			    sizeof(srv_conf->notifier.socket.sun_path)) {
+				yyerror("notify socket path too long");
+				free($2);
+				YYERROR;
+			}
+			free($2);
+			srv_conf->notifier.socket.sun_family = AF_UNIX;
+		}
+		| TIMEOUT NUMBER	{
+			if ($2 <= 0 || $2 > LONG_MAX) {
+				yyerror("notify timeout out of bounds");
+				YYERROR;
+			}
+			timeval_setmillis(&srv_conf->notifier.timeout, $2);
+		}
+		;
+
+msgopts_l	: msgopts_l stringornl	{
+			char	*s;
+
+			if (asprintf(&s, "%s%s", $1, $2) == -1) {
+				yyerror("asprintf: \"%s%s\"", $1, $2);
+				free($1);
+				free($2);
+				YYERROR;
+			}
+			free($1);
+			free($2);
+			$$ = s;
+		}
+		| stringornl		{
+			$$ = $1;
+		}
+		;
+
+stringornl	: CR		{
+	   		char	*s;
+
+	   		if ((s = strdup("\r")) == NULL) {
+				yyerror("strdup: \"\\r\"");
+				YYERROR;
+			}
+			$$ = s;
+		}
+		| LF		{
+	   		char	*s;
+
+	   		if ((s = strdup("\n")) == NULL) {
+				yyerror("strdup: \"\\n\"");
+				YYERROR;
+			}
+			$$ = s;
+		}
+		| STRING	{
+			$$ = $1;
+		}
+		;
+
 optmatch	: /* empty */		{ $$ = 0; }
 		| MATCH			{ $$ = 1; }
 		;
@@ -1974,6 +2079,7 @@
 		{ "combined",		COMBINED },
 		{ "common",		COMMON },
 		{ "connection",		CONNECTION },
+		{ "cr",			CR },
 		{ "crl",		CRL },
 		{ "default",		DEFAULT },
 		{ "dhe",		DHE },
@@ -1993,6 +2099,7 @@
 		{ "index",		INDEX },
 		{ "ip",			IP },
 		{ "key",		KEY },
+		{ "lf",			LF },
 		{ "lifetime",		LIFETIME },
 		{ "listen",		LISTEN },
 		{ "location",		LOCATION },
@@ -2001,9 +2108,11 @@
 		{ "match",		MATCH },
 		{ "max",		MAXIMUM },
 		{ "max-age",		MAXAGE },
+		{ "message",		MESSAGE },
 		{ "no",			NO },
 		{ "nodelay",		NODELAY },
 		{ "not",		NOT },
+		{ "notify-on-block",	NOTIFY },
 		{ "ocsp",		OCSP },
 		{ "on",			ON },
 		{ "optional",		OPTIONAL },
Index: usr.sbin/httpd/server_http.c
@@ -39,6 +39,7 @@
 #include <ctype.h>
 #include <vis.h>
 #include <fcntl.h>
+#include <netdb.h>
 
 #include "httpd.h"
 #include "http.h"
@@ -67,6 +68,10 @@
     const char *);
 int		 server_clientfilter(struct server_config *,
     struct server_client_addr *);
+char		*server_notify_init(struct client *, struct socket_notifier *,
+    unsigned int, const char *);
+int		 server_notify_send(struct socket_notifier *, const char *);
+void		 server_notify_write(int, short, void *);
 
 static struct http_method	 http_methods[] = HTTP_METHODS;
 static struct http_error	 http_errors[] = HTTP_ERRORS;
@@ -1392,6 +1397,7 @@
 	char			*hostval, *query;
 	const char		*errstr = NULL;
 	struct header_rule	*mrule = NULL;
+	char			*notify_msg = NULL;
 
 	/* Preserve original path */
 	if (desc->http_path == NULL ||
@@ -1576,8 +1582,17 @@
 	}
 
 	if (srv_conf->flags & SRVFLAG_BLOCK) {
+		if (*srv_conf->notifier.socket.sun_path != '\0' &&
+		    (notify_msg = server_notify_init(clt, &srv_conf->notifier,
+		     srv_conf->return_code, srv_conf->return_uri)) == NULL)
+			log_warn("failed initializing notifier at '%s'",
+			    srv_conf->notifier.socket.sun_path);
 		server_abort_http(clt, srv_conf->return_code,
 		    srv_conf->return_uri);
+		if (notify_msg != NULL) {
+			server_notify_send(&srv_conf->notifier, notify_msg);
+			free(notify_msg);
+		}
 		return (-1);
 	} else if (srv_conf->flags & SRVFLAG_AUTH &&
 	    server_http_authenticate(srv_conf, clt) == -1) {
@@ -1593,6 +1608,192 @@
 	srv_conf = clt->clt_srv_conf;
 	server_abort_http(clt, 500, srv_conf->root);
 	return (-1);
+}
+
+char *
+server_notify_init(struct client *clt, struct socket_notifier *notifier,
+    unsigned int code, const char *uri)
+{
+	char			*msg, *str = NULL;
+	struct http_descriptor	*desc;
+	struct server_config	*srv_conf;
+	struct kv		 key, *k;
+	char			 hbuf[NI_MAXHOST], ibuf[IBUF_READ_SIZE];
+
+	if ((msg = strdup(notifier->message)) == NULL)
+		fatal("strdup");
+	desc = clt->clt_descreq;
+	srv_conf = clt->clt_srv_conf;
+	msg = replace_var(msg, "$HTTP_HOST",
+	    desc->http_host == NULL ? "" : desc->http_host);
+	if (strstr(msg, "$HTTP_REFERRER") != NULL) {
+		key.kv_key = "Referer"; /* sic */
+		if ((k = kv_find(&desc->http_headers, &key)) != NULL &&
+		    k->kv_value != NULL) {
+			if (stravis(&str, k->kv_value, HTTPD_LOGVIS) == -1)
+				goto err;
+		} else if ((str = calloc(1, 1)) == NULL)
+			fatal("calloc");
+		msg = replace_var(msg, "$HTTP_REFERRER", str);
+		free(str);
+		str = NULL;
+	}
+	if (strstr(msg, "$HTTP_USER_AGENT") != NULL) {
+		key.kv_key = "User-Agent";
+		if ((k = kv_find(&desc->http_headers, &key)) != NULL &&
+		    k->kv_value != NULL) {
+			if (stravis(&str, k->kv_value, HTTPD_LOGVIS) == -1)
+				goto err;
+		} else if ((str = calloc(1, 1)) == NULL)
+			fatal("calloc");
+		msg = replace_var(msg, "$HTTP_USER_AGENT", str);
+		free(str);
+		str = NULL;
+	}
+	if (strstr(msg, "$HTTP_VERSION") != NULL) {
+		if (stravis(&str, desc->http_version, HTTPD_LOGVIS) == -1)
+			goto err;
+
+		msg = replace_var(msg, "$HTTP_VERSION", str);
+		free(str);
+		str = NULL;
+	}
+	if (strstr(msg, "$REMOTE_ADDR") != NULL) {
+		if (print_host(&clt->clt_ss, hbuf, sizeof(hbuf)) == NULL)
+			goto err;
+
+		msg = replace_var(msg, "$REMOTE_ADDR", hbuf);
+	}
+	if (strstr(msg, "$REMOTE_PORT") != NULL) {
+		if (asprintf(&str, "%u", ntohs(clt->clt_port)) == -1)
+			fatal("asprintf");
+		msg = replace_var(msg, "$REMOTE_PORT", str);
+		free(str);
+		str = NULL;
+	}
+	msg = replace_var(msg, "$REMOTE_USER",
+	    (srv_conf->flags & SRVFLAG_AUTH) && clt->clt_remote_user != NULL ?
+	    clt->clt_remote_user : "");
+	msg = replace_var(msg, "$REQUEST_METHOD",
+	    server_httpmethod_byid(desc->http_method));
+	msg = replace_var(msg, "$REQUEST_SCHEME",
+	    srv_conf->flags & SRVFLAG_TLS ? "https" : "http");
+	if (strstr(msg, "$REQUEST_URI") != NULL) {
+		if (desc->http_query == NULL) {
+			if ((str = strdup(desc->http_path)) == NULL)
+				fatal("strdup");
+		} else if (asprintf(&str, "%s?%s", desc->http_path,
+		    desc->http_query) == -1)
+			fatal("asprintf");
+		msg = replace_var(msg, "$REQUEST_URI", str);
+		free(str);
+		str = NULL;
+	}
+	if (strstr(msg, "$RESPONSE_CODE") != NULL) {
+		if (asprintf(&str, "%03u", code) == -1)
+			fatal("asprintf");
+		msg = replace_var(msg, "$RESPONSE_CODE", str);
+		free(str);
+		str = NULL;
+	}
+	if (strstr(msg, "$RESPONSE_URI") != NULL) {
+		memset(ibuf, 0, sizeof(ibuf));
+		if (uri != NULL && server_expand_http(clt, uri, ibuf,
+		    sizeof(ibuf)) == NULL)
+			goto err;
+
+		msg = replace_var(msg, "$RESPONSE_URI", ibuf);
+	}
+
+	return (msg);
+
+ err:
+	free(str);
+	free(msg);
+	return (NULL);
+}
+
+int
+server_notify_send(struct socket_notifier *notifier, const char *message)
+{
+	int			 fd;
+	struct timeval		*tv;
+	struct notify_message	 msg;
+	struct event_base	*evb;
+	struct event		 ev;
+
+	if ((fd = socket(AF_UNIX, SOCK_STREAM, 0)) == -1)
+		fatal("socket");
+
+	tv = &notifier->timeout;
+	if (timeval_isset(tv) &&
+	    setsockopt(fd, SOL_SOCKET, SO_SNDTIMEO, tv, sizeof(*tv)) == -1)
+		fatal("setsockopt");
+
+	if (connect(fd, (struct sockaddr *)&notifier->socket,
+	    sizeof(notifier->socket)) == -1) {
+		log_warn("failed connecting to notify socket at '%s'",
+		    notifier->socket.sun_path);
+		close(fd);
+		return (-1);
+	}
+
+	if ((evb = event_base_new()) == NULL)
+		fatal("event_base_new");
+	event_set(&ev, fd, EV_WRITE, &server_notify_write, &msg);
+	if (event_base_set(evb, &ev) == -1)
+		fatal("event_base_set");
+	if (event_add(&ev, timeval_isset(tv) ? tv : NULL) == -1)
+		fatal("event_add");
+
+	msg.str = message;
+	msg.size = strlen(message) + 1;
+	msg.n = 0;
+	msg.path = notifier->socket.sun_path;
+	msg.tv = tv;
+	msg.ev = &ev;
+
+	if (event_base_dispatch(evb) == -1)
+		fatal("event_base_dispatch");
+
+	event_base_free(evb);
+	close(fd);
+	return (0);
+}
+
+void
+server_notify_write(int fd, short event, void *arg)
+{
+	struct notify_message	*msg = arg;
+	struct event		*ev = msg->ev;
+	const char		*path = msg->path;
+	struct timeval		*tv = msg->tv;
+	size_t			 n, size;
+	ssize_t			 nw;
+
+	if (event == EV_TIMEOUT) {
+		log_warnx("timeout while writing to notify socket at '%s'",
+		    path);
+		event_del(ev);
+		return;
+	}
+	/* EV_WRITE */
+	n = msg->n;
+	size = msg->size;
+	if ((nw = send(fd, &msg->str[n], size - n, MSG_NOSIGNAL)) == -1) {
+		log_warn("failed writing to notify socket at '%s'", path);
+		event_del(ev);
+		return;
+	}
+	n += nw;
+	if (n == size || nw == 0) {
+		event_del(ev);
+		return;
+	}
+	event_del(ev);
+	if (event_add(ev, timeval_isset(tv) ? tv : NULL) == -1)
+		fatal("event_add");
+	msg->n = n;
 }
 
 const char *