According to RFC 7231 4.3.7, OPTIONS may have body. "Although this

specification does not define any use for such a payload, future
extensions to HTTP might use the OPTIONS body to make more detailed
queries about the target resource." The future has arrived.

Found and tested by Michael Lechtermann
OK benno@

diff --git a/usr.sbin/httpd/server_http.c b/usr.sbin/httpd/server_http.c
index 98144f8..b69805a 100644 (file)
--- a/usr.sbin/httpd/server_http.c
+++ b/usr.sbin/httpd/server_http.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: server_http.c,v 1.108 2016/05/27 11:24:13 krw Exp $   */
+/*     $OpenBSD: server_http.c,v 1.109 2016/07/27 11:02:41 reyk Exp $  */
 
 /*
  * Copyright (c) 2006 - 2015 Reyk Floeter <reyk@openbsd.org>
@@ -380,12 +380,12 @@ server_read_http(struct bufferevent *bev, void *arg)
                case HTTP_METHOD_DELETE:
                case HTTP_METHOD_GET:
                case HTTP_METHOD_HEAD:
-               case HTTP_METHOD_OPTIONS:
                /* WebDAV methods */
                case HTTP_METHOD_COPY:
                case HTTP_METHOD_MOVE:
                        clt->clt_toread = 0;
                        break;
+               case HTTP_METHOD_OPTIONS:
                case HTTP_METHOD_POST:
                case HTTP_METHOD_PUT:
                case HTTP_METHOD_RESPONSE:

diff --git a/usr.sbin/relayd/relay_http.c b/usr.sbin/relayd/relay_http.c
index bab2135..c933f99 100644 (file)
--- a/usr.sbin/relayd/relay_http.c
+++ b/usr.sbin/relayd/relay_http.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: relay_http.c,v 1.57 2016/07/27 06:55:44 reyk Exp $    */
+/*     $OpenBSD: relay_http.c,v 1.58 2016/07/27 11:02:41 reyk Exp $    */
 
 /*
  * Copyright (c) 2006 - 2015 Reyk Floeter <reyk@openbsd.org>
@@ -401,9 +401,9 @@ relay_read_http(struct bufferevent *bev, void *arg)
                case HTTP_METHOD_DELETE:
                case HTTP_METHOD_GET:
                case HTTP_METHOD_HEAD:
-               case HTTP_METHOD_OPTIONS:
                        cre->toread = 0;
                        break;
+               case HTTP_METHOD_OPTIONS:
                case HTTP_METHOD_PATCH:
                case HTTP_METHOD_POST:
                case HTTP_METHOD_PUT: