1 /* 2 * keyvalue - PCRE matching and substitution for mod_redirect and mod_rewrite 3 * 4 * Fully-rewritten from original 5 * Copyright(c) 2018 Glenn Strauss gstrauss()gluelogic.com All rights reserved 6 * License: BSD 3-clause (same as lighttpd) 7 */ 8 #include "first.h" 9 10 #include "keyvalue.h" 11 #include "plugin_config.h" /* struct cond_match_t */ 12 #include "burl.h" 13 #include "log.h" 14 15 #include <stdlib.h> 16 #include <string.h> 17 18 #ifdef HAVE_PCRE2_H 19 #define PCRE2_CODE_UNIT_WIDTH 8 20 #include <pcre2.h> 21 #elif defined(HAVE_PCRE_H) 22 #include <pcre.h> 23 #ifndef PCRE_STUDY_JIT_COMPILE 24 #define PCRE_STUDY_JIT_COMPILE 0 25 #define pcre_free_study(x) pcre_free(x) 26 #endif 27 #endif 28 29 #ifdef HAVE_PCRE2_H 30 static struct pcre2_real_match_data_8 *keyvalue_match_data; 31 #endif 32 33 typedef struct pcre_keyvalue { 34 #ifdef HAVE_PCRE2_H 35 pcre2_code *code; 36 struct pcre2_real_match_data_8 *match_data; 37 #elif defined(HAVE_PCRE_H) 38 pcre *key; 39 pcre_extra *key_extra; 40 #endif 41 buffer value; 42 } pcre_keyvalue; 43 44 pcre_keyvalue_buffer *pcre_keyvalue_buffer_init(void) { 45 pcre_keyvalue_buffer *kvb; 46 47 kvb = calloc(1, sizeof(*kvb)); 48 force_assert(NULL != kvb); 49 50 return kvb; 51 } 52 53 int pcre_keyvalue_buffer_append(log_error_st *errh, pcre_keyvalue_buffer *kvb, const buffer *key, const buffer *value, const int pcre_jit) { 54 55 pcre_keyvalue *kv; 56 57 if (0 == (kvb->used & 3)) { /*(allocate in groups of 4)*/ 58 kvb->kv = realloc(kvb->kv, (kvb->used + 4) * sizeof(*kvb->kv)); 59 force_assert(NULL != kvb->kv); 60 } 61 62 kv = kvb->kv + kvb->used++; 63 64 /* copy persistent config data, and elide free() in free_data below */ 65 memcpy(&kv->value, value, sizeof(buffer)); 66 /*buffer_copy_buffer(&kv->value, value);*/ 67 68 #ifdef HAVE_PCRE 69 70 #ifdef HAVE_PCRE2_H 71 72 int errcode; 73 PCRE2_SIZE erroff; 74 PCRE2_UCHAR errbuf[1024]; 75 76 kv->code = pcre2_compile((PCRE2_SPTR)BUF_PTR_LEN(key), 77 PCRE2_UTF, &errcode, &erroff, NULL); 78 if (NULL == kv->code) { 79 pcre2_get_error_message(errcode, errbuf, sizeof(errbuf)); 80 log_error(errh, __FILE__, __LINE__, 81 "pcre2_compile: %s at offset %zu, regex: %s", 82 (char *)errbuf, erroff, key->ptr); 83 return 0; 84 } 85 86 if (pcre_jit) { 87 errcode = pcre2_jit_compile(kv->code, PCRE2_JIT_COMPLETE); 88 if (0 != errcode && errcode != PCRE2_ERROR_JIT_BADOPTION) { 89 pcre2_get_error_message(errcode, errbuf, sizeof(errbuf)); 90 log_error(errh, __FILE__, __LINE__, 91 "pcre2_jit_compile: %s, regex: %s", (char *)errbuf, key->ptr); 92 /*return 0;*/ 93 } 94 } 95 96 uint32_t captures; 97 errcode = pcre2_pattern_info(kv->code, PCRE2_INFO_CAPTURECOUNT, &captures); 98 if (0 != errcode) { 99 pcre2_get_error_message(errcode, errbuf, sizeof(errbuf)); 100 log_error(errh, __FILE__, __LINE__, 101 "pcre2_pattern_info: %s, regex: %s", (char *)errbuf, key->ptr); 102 return 0; 103 } 104 else if (captures > 19) { 105 log_error(errh, __FILE__, __LINE__, 106 "Too many captures in regex, " 107 "use (?:...) instead of (...): %s", key->ptr); 108 return 0; 109 } 110 111 #if 1 /*(share single keyvalue_match_data among all keyvalue regexes)*/ 112 if (NULL == keyvalue_match_data) { 113 keyvalue_match_data = pcre2_match_data_create(20, NULL); 114 force_assert(keyvalue_match_data); 115 } 116 kv->match_data = keyvalue_match_data; 117 #else 118 kv->match_data = pcre2_match_data_create_from_pattern(kv->code, NULL); 119 force_assert(kv->match_data); 120 #endif 121 122 #elif defined(HAVE_PCRE_H) 123 124 const char *errptr; 125 int erroff; 126 127 kv->key_extra = NULL; 128 129 if (NULL == (kv->key = pcre_compile(key->ptr, 130 0, &errptr, &erroff, NULL))) { 131 132 log_error(errh, __FILE__, __LINE__, 133 "rexexp compilation error at %s", errptr); 134 return 0; 135 } 136 137 const int study_options = pcre_jit ? PCRE_STUDY_JIT_COMPILE : 0; 138 if (NULL == (kv->key_extra = pcre_study(kv->key, study_options, &errptr)) 139 && errptr != NULL) { 140 log_error(errh, __FILE__, __LINE__, 141 "studying regex failed: %s -> %s\n", 142 key->ptr, errptr); 143 return 0; 144 } 145 146 #endif 147 148 #else /* !HAVE_PCRE */ 149 150 if (!buffer_is_blank(key)) { 151 static int logged_message = 0; 152 if (logged_message) return 1; 153 logged_message = 1; 154 log_error(errh, __FILE__, __LINE__, 155 "pcre support is missing, please install libpcre and the headers"); 156 UNUSED(pcre_jit); 157 } 158 159 #endif /* !HAVE_PCRE */ 160 161 return 1; 162 } 163 164 void pcre_keyvalue_buffer_free(pcre_keyvalue_buffer *kvb) { 165 #ifdef HAVE_PCRE 166 pcre_keyvalue *kv = kvb->kv; 167 for (int i = 0, used = (int)kvb->used; i < used; ++i, ++kv) { 168 #ifdef HAVE_PCRE2_H 169 if (kv->code) pcre2_code_free(kv->code); 170 #if 1 171 if (keyvalue_match_data) { 172 pcre2_match_data_free(keyvalue_match_data); 173 keyvalue_match_data = NULL; 174 } 175 #else 176 if (kv->match_data) pcre2_match_data_free(kv->match_data); 177 #endif 178 #elif defined(HAVE_PCRE_H) 179 if (kv->key) pcre_free(kv->key); 180 if (kv->key_extra) pcre_free_study(kv->key_extra); 181 /*free (kv->value.ptr);*//*(see pcre_keyvalue_buffer_append)*/ 182 #endif 183 } 184 #endif 185 186 if (kvb->kv) free(kvb->kv); 187 free(kvb); 188 } 189 190 #ifdef HAVE_PCRE 191 192 static void pcre_keyvalue_buffer_append_match(buffer *b, const pcre_keyvalue_ctx *ctx, unsigned int num, int flags) { 193 if (num < (unsigned int)ctx->n) { /* n is always > 0 */ 194 #ifdef HAVE_PCRE2_H 195 const PCRE2_SIZE *ovec = (PCRE2_SIZE *)ctx->ovec; 196 #elif defined(HAVE_PCRE_H) 197 const int *ovec = (int *)ctx->ovec; 198 #endif 199 const size_t off = (size_t)ovec[(num <<= 1)]; /*(num *= 2)*/ 200 const size_t len = (size_t)ovec[num+1] - off; 201 burl_append(b, ctx->subject + off, len, flags); 202 } 203 } 204 205 static void pcre_keyvalue_buffer_append_ctxmatch(buffer *b, const pcre_keyvalue_ctx *ctx, unsigned int num, int flags) { 206 const struct cond_match_t * const cache = ctx->cache; 207 if (!cache) return; /* no enclosing match context */ 208 if (num < (unsigned int)cache->captures) { 209 #ifdef HAVE_PCRE2_H 210 const PCRE2_SIZE *ovec = (PCRE2_SIZE *)cache->matches; 211 #elif defined(HAVE_PCRE_H) 212 const int *ovec = (int *)cache->matches; 213 #endif 214 const size_t off = (size_t)ovec[(num <<= 1)]; /*(num *= 2)*/ 215 const size_t len = (size_t)ovec[num+1] - off; 216 burl_append(b, cache->comp_value->ptr + off, len, flags); 217 } 218 } 219 220 #endif /* HAVE_PCRE */ 221 222 static int pcre_keyvalue_buffer_subst_ext(buffer *b, const char *pattern, const pcre_keyvalue_ctx *ctx) { 223 const unsigned char *p = (unsigned char *)pattern+2;/* +2 past ${} or %{} */ 224 int flags = 0; 225 while (!light_isdigit(*p) && *p != '}' && *p != '\0') { 226 if (0) { 227 } 228 else if (p[0] == 'e' && p[1] == 's' && p[2] == 'c') { 229 p+=3; 230 if (p[0] == ':') { 231 flags |= BURL_ENCODE_ALL; 232 p+=1; 233 } 234 else if (0 == strncmp((const char *)p, "ape:", 4)) { 235 flags |= BURL_ENCODE_ALL; 236 p+=4; 237 } 238 else if (0 == strncmp((const char *)p, "nde:", 4)) { 239 flags |= BURL_ENCODE_NDE; 240 p+=4; 241 } 242 else if (0 == strncmp((const char *)p, "psnde:", 6)) { 243 flags |= BURL_ENCODE_PSNDE; 244 p+=6; 245 } 246 else { /* skip unrecognized esc... */ 247 p = (const unsigned char *)strchr((const char *)p, ':'); 248 if (NULL == p) return -1; 249 ++p; 250 } 251 } 252 else if (p[0] == 'n' && p[1] == 'o') { 253 p+=2; 254 if (0 == strncmp((const char *)p, "esc:", 4)) { 255 flags |= BURL_ENCODE_NONE; 256 p+=4; 257 } 258 else if (0 == strncmp((const char *)p, "escape:", 7)) { 259 flags |= BURL_ENCODE_NONE; 260 p+=7; 261 } 262 else { /* skip unrecognized no... */ 263 p = (const unsigned char *)strchr((const char *)p, ':'); 264 if (NULL == p) return -1; 265 ++p; 266 } 267 } 268 else if (p[0] == 't' && p[1] == 'o') { 269 p+=2; 270 if (0 == strncmp((const char *)p, "lower:", 6)) { 271 flags |= BURL_TOLOWER; 272 p+=6; 273 } 274 else if (0 == strncmp((const char *)p, "upper:", 6)) { 275 flags |= BURL_TOLOWER; 276 p+=6; 277 } 278 else { /* skip unrecognized to... */ 279 p = (const unsigned char *)strchr((const char *)p, ':'); 280 if (NULL == p) return -1; 281 ++p; 282 } 283 } 284 else if (p[0] == 'u' && p[1] == 'r' && p[2] == 'l' && p[3] == '.') { 285 const struct burl_parts_t * const burl = ctx->burl; 286 p+=4; 287 if (0 == strncmp((const char *)p, "scheme}", 7)) { 288 if (burl->scheme) 289 burl_append(b, BUF_PTR_LEN(burl->scheme), flags); 290 p+=6; 291 } 292 else if (0 == strncmp((const char *)p, "authority}", 10)) { 293 if (burl->authority) 294 burl_append(b, BUF_PTR_LEN(burl->authority), flags); 295 p+=9; 296 } 297 else if (0 == strncmp((const char *)p, "port}", 5)) { 298 buffer_append_int(b, (int)burl->port); 299 p+=4; 300 } 301 else if (0 == strncmp((const char *)p, "path}", 5)) { 302 const buffer * const target = burl->path; 303 const uint32_t len = buffer_clen(target); 304 const char * const ptr = target->ptr; 305 const char * const qmark = memchr(ptr, '?', len); 306 burl_append(b, ptr, qmark ? (uint32_t)(qmark-ptr) : len, flags); 307 p+=4; 308 } 309 else if (0 == strncmp((const char *)p, "query}", 6)) { 310 if (burl->query) 311 burl_append(b, BUF_PTR_LEN(burl->query), flags); 312 p+=5; 313 } 314 else { /* skip unrecognized url.* */ 315 p = (const unsigned char *)strchr((const char *)p, '}'); 316 if (NULL == p) return -1; 317 } 318 break; 319 } 320 else if (p[0] == 'q' && p[1] == 's' && p[2] == 'a' && p[3] == '}') { 321 const buffer *qs = ctx->burl->query; 322 if (qs && !buffer_is_unset(qs)) { 323 if (NULL != strchr(b->ptr, '?')) { 324 if (!buffer_is_blank(qs)) 325 buffer_append_char(b, '&'); 326 } 327 else { 328 buffer_append_char(b, '?'); 329 } 330 burl_append(b, BUF_PTR_LEN(qs), flags); 331 } 332 p+=3; 333 break; 334 } 335 else if (p[0] == 'e' && p[1] == 'n' && p[2] == 'c' 336 && 0 == strncmp((const char *)p+3, "b64u:", 5)) { 337 flags |= BURL_ENCODE_B64U; 338 p+=8; 339 } 340 else if (p[0] == 'd' && p[1] == 'e' && p[2] == 'c' 341 && 0 == strncmp((const char *)p+3, "b64u:", 5)) { 342 flags |= BURL_DECODE_B64U; 343 p+=8; 344 } 345 else ++p; /* skip unrecognized char */ 346 } 347 if (*p == '\0') return -1; 348 if (*p != '}') { /* light_isdigit(*p) */ 349 unsigned int num = *p - '0'; 350 ++p; 351 if (light_isdigit(*p)) num = num * 10 + (*p++ - '0'); 352 if (*p != '}') { 353 p = (const unsigned char *)strchr((const char *)p, '}'); 354 if (NULL == p) return -1; 355 } 356 if (0 == flags) flags = BURL_ENCODE_PSNDE; /* default */ 357 #ifdef HAVE_PCRE 358 pattern[0] == '$' /*(else '%')*/ 359 ? pcre_keyvalue_buffer_append_match(b, ctx, num, flags) 360 : pcre_keyvalue_buffer_append_ctxmatch(b, ctx, num, flags); 361 #endif 362 } 363 return (int)(p + 1 - (unsigned char *)pattern - 2); 364 } 365 366 static void pcre_keyvalue_buffer_subst(buffer *b, const buffer *patternb, const pcre_keyvalue_ctx *ctx) { 367 const char *pattern = patternb->ptr; 368 const size_t pattern_len = buffer_clen(patternb); 369 size_t start = 0; 370 371 /* search for $... or %... pattern substitutions */ 372 373 buffer_clear(b); 374 375 for (size_t k = 0; k + 1 < pattern_len; ++k) { 376 if (pattern[k] == '$' || pattern[k] == '%') { 377 378 buffer_append_string_len(b, pattern + start, k - start); 379 380 if (pattern[k + 1] == '{') { 381 int num = pcre_keyvalue_buffer_subst_ext(b, pattern+k, ctx); 382 if (num < 0) return; /* error; truncate result */ 383 k += (size_t)num; 384 } else if (light_isdigit(((unsigned char *)pattern)[k + 1])) { 385 #ifdef HAVE_PCRE 386 unsigned int num = (unsigned int)pattern[k + 1] - '0'; 387 pattern[k] == '$' /*(else '%')*/ 388 ? pcre_keyvalue_buffer_append_match(b, ctx, num, 0) 389 : pcre_keyvalue_buffer_append_ctxmatch(b, ctx, num, 0); 390 #endif 391 } else { 392 /* enable escape: "%%" => "%", "%a" => "%a", "$$" => "$" */ 393 buffer_append_string_len(b, pattern+k, pattern[k] == pattern[k+1] ? 1 : 2); 394 } 395 396 k++; 397 start = k + 1; 398 } 399 } 400 401 buffer_append_string_len(b, pattern + start, pattern_len - start); 402 } 403 404 handler_t pcre_keyvalue_buffer_process(const pcre_keyvalue_buffer *kvb, pcre_keyvalue_ctx *ctx, const buffer *input, buffer *result) { 405 const pcre_keyvalue *kv = kvb->kv; 406 for (int i = 0, used = (int)kvb->used; i < used; ++i, ++kv) { 407 #ifdef HAVE_PCRE 408 #ifdef HAVE_PCRE2_H 409 int n = pcre2_match(kv->code, (PCRE2_SPTR)BUF_PTR_LEN(input), 410 0, 0, kv->match_data, NULL); 411 #else 412 #define N 20 413 int ovec[N * 3]; 414 #undef N 415 int n = pcre_exec(kv->key, kv->key_extra, BUF_PTR_LEN(input), 416 0, 0, ovec, sizeof(ovec)/sizeof(int)); 417 #endif 418 #else 419 int n = 1; 420 #endif 421 if (n < 0) { 422 #ifdef HAVE_PCRE 423 #ifdef HAVE_PCRE2_H 424 if (n != PCRE2_ERROR_NOMATCH) 425 #else 426 if (n != PCRE_ERROR_NOMATCH) 427 #endif 428 #endif 429 return HANDLER_ERROR; 430 } 431 else if (buffer_is_blank(&kv->value)) { 432 /* short-circuit if blank replacement pattern 433 * (do not attempt to match against remaining kvb rules) */ 434 ctx->m = i; 435 return HANDLER_GO_ON; 436 } 437 else { /* it matched */ 438 ctx->m = i; 439 ctx->n = n; 440 ctx->subject = input->ptr; 441 #ifdef HAVE_PCRE 442 #ifdef HAVE_PCRE2_H 443 ctx->ovec = pcre2_get_ovector_pointer(kv->match_data); 444 #else 445 ctx->ovec = ovec; 446 #endif 447 #endif 448 pcre_keyvalue_buffer_subst(result, &kv->value, ctx); 449 return HANDLER_FINISHED; 450 } 451 } 452 453 return HANDLER_GO_ON; 454 } 455 456 457 /* modified from burl_normalize_basic() to handle %% extra encoding layer */ 458 459 /* c (char) and n (nibble) MUST be unsigned integer types */ 460 #define li_cton(c,n) \ 461 (((n) = (c) - '0') <= 9 || (((n) = ((c)&0xdf) - 'A') <= 5 ? ((n) += 10) : 0)) 462 463 static void pcre_keyvalue_burl_percent_toupper (buffer *b) 464 { 465 const unsigned char * const s = (unsigned char *)b->ptr; 466 const int used = (int)buffer_clen(b); 467 unsigned int n1, n2; 468 for (int i = 0; i < used; ++i) { 469 if (s[i]=='%' && li_cton(s[i+1],n1) && li_cton(s[i+2],n2)) { 470 if (s[i+1] >= 'a') b->ptr[i+1] &= 0xdf; /* uppercase hex */ 471 if (s[i+2] >= 'a') b->ptr[i+2] &= 0xdf; /* uppercase hex */ 472 i+=2; 473 } 474 } 475 } 476 477 static void pcre_keyvalue_burl_percent_percent_toupper (buffer *b) 478 { 479 const unsigned char * const s = (unsigned char *)b->ptr; 480 const int used = (int)buffer_clen(b); 481 unsigned int n1, n2; 482 for (int i = 0; i < used; ++i) { 483 if (s[i] == '%' && s[i+1]=='%' 484 && li_cton(s[i+2],n1) && li_cton(s[i+3],n2)) { 485 if (s[i+2] >= 'a') b->ptr[i+2] &= 0xdf; /* uppercase hex */ 486 if (s[i+3] >= 'a') b->ptr[i+3] &= 0xdf; /* uppercase hex */ 487 i+=3; 488 } 489 } 490 } 491 492 static const char hex_chars_uc[] = "0123456789ABCDEF"; 493 494 static void pcre_keyvalue_burl_percent_high_UTF8 (buffer *b, buffer *t) 495 { 496 const unsigned char * const s = (unsigned char *)b->ptr; 497 unsigned char *p; 498 const int used = (int)buffer_clen(b); 499 unsigned int count = 0, j = 0; 500 for (int i = 0; i < used; ++i) { 501 if (s[i] > 0x7F) ++count; 502 } 503 if (0 == count) return; 504 505 p = (unsigned char *)buffer_string_prepare_copy(t, used+(count*2)); 506 for (int i = 0; i < used; ++i, ++j) { 507 if (s[i] <= 0x7F) 508 p[j] = s[i]; 509 else { 510 p[j] = '%'; 511 p[++j] = hex_chars_uc[(s[i] >> 4) & 0xF]; 512 p[++j] = hex_chars_uc[s[i] & 0xF]; 513 } 514 } 515 buffer_copy_string_len(b, (char *)p, (size_t)j); 516 } 517 518 static void pcre_keyvalue_burl_percent_percent_high_UTF8 (buffer *b, buffer *t) 519 { 520 const unsigned char * const s = (unsigned char *)b->ptr; 521 unsigned char *p; 522 const int used = (int)buffer_clen(b); 523 unsigned int count = 0, j = 0; 524 for (int i = 0; i < used; ++i) { 525 if (s[i] > 0x7F) ++count; 526 } 527 if (0 == count) return; 528 529 p = (unsigned char *)buffer_string_prepare_copy(t, used+(count*3)); 530 for (int i = 0; i < used; ++i, ++j) { 531 if (s[i] <= 0x7F) 532 p[j] = s[i]; 533 else { 534 p[j] = '%'; 535 p[++j] = '%'; 536 p[++j] = hex_chars_uc[(s[i] >> 4) & 0xF]; 537 p[++j] = hex_chars_uc[s[i] & 0xF]; 538 } 539 } 540 buffer_copy_string_len(b, (char *)p, (size_t)j); 541 } 542 543 /* Basic normalization of regex and regex replacement to mirror some of 544 * the normalizations performed on request URI (for better compatibility). 545 * Note: not currently attempting to replace unnecessary percent-encoding 546 * (would need to know if regex was intended to match url-path or 547 * query-string or both, and then would have to regex-escape if those 548 * chars where special regex chars such as . * + ? ( ) [ ] | and more) 549 * Not attempting to percent-encode chars which should be encoded, again 550 * since regex might target url-path, query-string, or both, and we would 551 * have to avoid percent-encoding special regex chars. 552 * Also not attempting to detect unnecessarily regex-escape in, e.g. %\x\x 553 * Preserve improper %-encoded sequences which are not %XX (using hex chars) 554 * Intentionally not performing path simplification (e.g. ./ ../) 555 * If regex-specific normalizations begin to be made to k here, 556 * must revisit callers, e.g. one configfile.c use on non-regex string. 557 * "%%" (percent_percent) is used in regex replacement strings since 558 * otherwise "%n" is used to indicate regex backreference where n is number. 559 */ 560 561 void pcre_keyvalue_burl_normalize_key (buffer *k, buffer *t) 562 { 563 pcre_keyvalue_burl_percent_toupper(k); 564 pcre_keyvalue_burl_percent_high_UTF8(k, t); 565 } 566 567 void pcre_keyvalue_burl_normalize_value (buffer *v, buffer *t) 568 { 569 pcre_keyvalue_burl_percent_percent_toupper(v); 570 pcre_keyvalue_burl_percent_percent_high_UTF8(v, t); 571 } 572