Lighttpd

When clients expect servers to comply with the spec. I hope "because the spec says so" is a good enough reason to fix something, unless there's a compelling reason not to.

Patch changes the Host and URI parsing to do the following:

1: Parse headers, including Host; don't validate the results yet.
2: Validate that at least one Host header was received. Even if the host is being overridden by the URI, this check is still required.
3: Possibly, override the Host header from the URI.
4: Validate the final http_host only.

This also fixes a related issue: HTTP/1.1 requests with no Host: header at all to raise an error, even if a host is specified in the URI. (The spec requires this, and Apache follows this.)

This patch looks bigger than it is; most of it is just moving code around. req->uri_raw to con->request.orig_uri is moved to below header parsing; request_check_hostname is consolidated and moved after everything else.

This patch is locally tested but not production tested; this is a critical path, so please review it carefully.

https://tools.ietf.org/html/rfc7230#section-5.4

   A client MUST send a Host header field in all HTTP/1.1 request
   messages.  If the target URI includes an authority component, then a
   client MUST send a field-value for Host that is identical to that
   authority component, excluding any userinfo subcomponent and its "@" 
   delimiter (Section 2.7.1).