1 /* 2 * request - HTTP request processing 3 * 4 * Fully-rewritten from original EXCEPT for request_check_hostname() 5 * Copyright(c) 2018 Glenn Strauss gstrauss()gluelogic.com All rights reserved 6 * License: BSD 3-clause (same as lighttpd) 7 */ 8 #include "first.h" 9 10 #include "request.h" 11 #include "burl.h" 12 #include "http_header.h" 13 #include "http_kv.h" 14 #include "log.h" 15 #include "sock_addr.h" 16 17 #include <limits.h> 18 #include <stdlib.h> 19 #include <string.h> 20 21 static int request_check_hostname(buffer * const host) { 22 enum { DOMAINLABEL, TOPLABEL } stage = TOPLABEL; 23 size_t i; 24 int label_len = 0; 25 size_t host_len, hostport_len; 26 char *colon; 27 int is_ip = -1; /* -1 don't know yet, 0 no, 1 yes */ 28 int level = 0; 29 30 /* 31 * hostport = host [ ":" port ] 32 * host = hostname | IPv4address | IPv6address 33 * hostname = *( domainlabel "." ) toplabel [ "." ] 34 * domainlabel = alphanum | alphanum *( alphanum | "-" ) alphanum 35 * toplabel = alpha | alpha *( alphanum | "-" ) alphanum 36 * IPv4address = 1*digit "." 1*digit "." 1*digit "." 1*digit 37 * IPv6address = "[" ... "]" 38 * port = *digit 39 */ 40 41 /* IPv6 address */ 42 if (host->ptr[0] == '[') { 43 char *c = host->ptr + 1; 44 int colon_cnt = 0; 45 46 /* check the address inside [...] */ 47 for (; *c && *c != ']'; c++) { 48 if (*c == ':') { 49 if (++colon_cnt > 7) { 50 return -1; 51 } 52 } else if (!light_isxdigit(*c) && '.' != *c) { 53 return -1; 54 } 55 } 56 57 /* missing ] */ 58 if (!*c) { 59 return -1; 60 } 61 62 /* check port */ 63 if (*(c+1) == ':') { 64 for (c += 2; *c; c++) { 65 if (!light_isdigit(*c)) { 66 return -1; 67 } 68 } 69 } 70 else if ('\0' != *(c+1)) { 71 /* only a port is allowed to follow [...] */ 72 return -1; 73 } 74 return 0; 75 } 76 77 hostport_len = host_len = buffer_string_length(host); 78 79 if (NULL != (colon = memchr(host->ptr, ':', host_len))) { 80 char *c = colon + 1; 81 82 /* check portnumber */ 83 for (; *c; c++) { 84 if (!light_isdigit(*c)) return -1; 85 } 86 87 /* remove the port from the host-len */ 88 host_len = colon - host->ptr; 89 } 90 91 /* Host is empty */ 92 if (host_len == 0) return -1; 93 94 /* if the hostname ends in a "." strip it */ 95 if (host->ptr[host_len-1] == '.') { 96 /* shift port info one left */ 97 if (NULL != colon) memmove(colon-1, colon, hostport_len - host_len); 98 buffer_string_set_length(host, --hostport_len); 99 if (--host_len == 0) return -1; 100 } 101 102 103 /* scan from the right and skip the \0 */ 104 for (i = host_len; i-- > 0; ) { 105 const char c = host->ptr[i]; 106 107 switch (stage) { 108 case TOPLABEL: 109 if (c == '.') { 110 /* only switch stage, if this is not the last character */ 111 if (i != host_len - 1) { 112 if (label_len == 0) { 113 return -1; 114 } 115 116 /* check the first character at right of the dot */ 117 if (is_ip == 0) { 118 if (!light_isalnum(host->ptr[i+1])) { 119 return -1; 120 } 121 } else if (!light_isdigit(host->ptr[i+1])) { 122 is_ip = 0; 123 } else if ('-' == host->ptr[i+1]) { 124 return -1; 125 } else { 126 /* just digits */ 127 is_ip = 1; 128 } 129 130 stage = DOMAINLABEL; 131 132 label_len = 0; 133 level++; 134 } else if (i == 0) { 135 /* just a dot and nothing else is evil */ 136 return -1; 137 } 138 } else if (i == 0) { 139 /* the first character of the hostname */ 140 if (!light_isalnum(c)) { 141 return -1; 142 } 143 label_len++; 144 } else { 145 if (c != '-' && !light_isalnum(c)) { 146 return -1; 147 } 148 if (is_ip == -1) { 149 if (!light_isdigit(c)) is_ip = 0; 150 } 151 label_len++; 152 } 153 154 break; 155 case DOMAINLABEL: 156 if (is_ip == 1) { 157 if (c == '.') { 158 if (label_len == 0) { 159 return -1; 160 } 161 162 label_len = 0; 163 level++; 164 } else if (!light_isdigit(c)) { 165 return -1; 166 } else { 167 label_len++; 168 } 169 } else { 170 if (c == '.') { 171 if (label_len == 0) { 172 return -1; 173 } 174 175 /* c is either - or alphanum here */ 176 if ('-' == host->ptr[i+1]) { 177 return -1; 178 } 179 180 label_len = 0; 181 level++; 182 } else if (i == 0) { 183 if (!light_isalnum(c)) { 184 return -1; 185 } 186 label_len++; 187 } else { 188 if (c != '-' && !light_isalnum(c)) { 189 return -1; 190 } 191 label_len++; 192 } 193 } 194 195 break; 196 } 197 } 198 199 /* a IP has to consist of 4 parts */ 200 if (is_ip == 1 && level != 3) { 201 return -1; 202 } 203 204 if (label_len == 0) { 205 return -1; 206 } 207 208 return 0; 209 } 210 211 int http_request_host_normalize(buffer * const b, const int scheme_port) { 212 /* 213 * check for and canonicalize numeric IP address and portnum (optional) 214 * (IP address may be followed by ":portnum" (optional)) 215 * - IPv6: "[...]" 216 * - IPv4: "x.x.x.x" 217 * - IPv4: 12345678 (32-bit decimal number) 218 * - IPv4: 012345678 (32-bit octal number) 219 * - IPv4: 0x12345678 (32-bit hex number) 220 * 221 * allow any chars (except ':' and '\0' and stray '[' or ']') 222 * (other code may check chars more strictly or more pedantically) 223 * ':' delimits (optional) port at end of string 224 * "[]" wraps IPv6 address literal 225 * '\0' should have been rejected earlier were it present 226 * 227 * any chars includes, but is not limited to: 228 * - allow '-' any where, even at beginning of word 229 * (security caution: might be confused for cmd flag if passed to shell) 230 * - allow all-digit TLDs 231 * (might be mistaken for IPv4 addr by inet_aton() 232 * unless non-digits appear in subdomain) 233 */ 234 235 /* Note: not using getaddrinfo() since it does not support "[]" around IPv6 236 * and is not as lenient as inet_aton() and inet_addr() for IPv4 strings. 237 * Not using inet_pton() (when available) on IPv4 for similar reasons. */ 238 239 const char * const p = b->ptr; 240 const size_t blen = buffer_string_length(b); 241 long port = 0; 242 243 if (*p != '[') { 244 char * const colon = (char *)memchr(p, ':', blen); 245 if (colon) { 246 if (*p == ':') return -1; /*(empty host then port, or naked IPv6)*/ 247 if (colon[1] != '\0') { 248 char *e; 249 port = strtol(colon+1, &e, 0); /*(allow decimal, octal, hex)*/ 250 if (0 < port && port <= USHRT_MAX && *e == '\0') { 251 /* valid port */ 252 } else { 253 return -1; 254 } 255 } /*(else ignore stray colon at string end)*/ 256 buffer_string_set_length(b, (size_t)(colon - p)); /*(remove port str)*/ 257 } 258 259 if (light_isdigit(*p)) do { 260 /* (IPv4 address literal or domain starting w/ digit (e.g. 3com))*/ 261 /* (check one-element cache of normalized IPv4 address string) */ 262 static struct { char s[INET_ADDRSTRLEN]; size_t n; } laddr; 263 size_t n = colon ? (size_t)(colon - p) : blen; 264 sock_addr addr; 265 if (n == laddr.n && 0 == memcmp(p, laddr.s, n)) break; 266 if (1 == sock_addr_inet_pton(&addr, p, AF_INET, 0)) { 267 sock_addr_inet_ntop_copy_buffer(b, &addr); 268 n = buffer_string_length(b); 269 if (n < sizeof(laddr.s)) memcpy(laddr.s, b->ptr, (laddr.n = n)); 270 } 271 } while (0); 272 } else do { /* IPv6 addr */ 273 #if defined(HAVE_IPV6) && defined(HAVE_INET_PTON) 274 275 /* (check one-element cache of normalized IPv4 address string) */ 276 static struct { char s[INET6_ADDRSTRLEN]; size_t n; } laddr; 277 sock_addr addr; 278 char *bracket = b->ptr+blen-1; 279 char *percent = strchr(b->ptr+1, '%'); 280 size_t len; 281 int rc; 282 char buf[INET6_ADDRSTRLEN+16]; /*(+16 for potential %interface name)*/ 283 if (blen <= 2) return -1; /*(invalid "[]")*/ 284 if (*bracket != ']') { 285 bracket = (char *)memchr(b->ptr+1, ']', blen-1); 286 if (NULL == bracket || bracket[1] != ':' || bracket - b->ptr == 1){ 287 return -1; 288 } 289 if (bracket[2] != '\0') { /*(ignore stray colon at string end)*/ 290 char *e; 291 port = strtol(bracket+2, &e, 0); /*(allow decimal, octal, hex)*/ 292 if (0 < port && port <= USHRT_MAX && *e == '\0') { 293 /* valid port */ 294 } else { 295 return -1; 296 } 297 } 298 } 299 300 len = (size_t)((percent ? percent : bracket) - (b->ptr+1)); 301 if (laddr.n == len && 0 == memcmp(laddr.s, b->ptr+1, len)) { 302 /* truncate after ']' and re-add normalized port, if needed */ 303 buffer_string_set_length(b, (size_t)(bracket - b->ptr + 1)); 304 break; 305 } 306 307 *bracket = '\0';/*(terminate IPv6 string)*/ 308 if (percent) *percent = '\0'; /*(remove %interface from address)*/ 309 rc = sock_addr_inet_pton(&addr, b->ptr+1, AF_INET6, 0); 310 if (percent) *percent = '%'; /*(restore %interface)*/ 311 *bracket = ']'; /*(restore bracket)*/ 312 if (1 != rc) return -1; 313 314 sock_addr_inet_ntop(&addr, buf, sizeof(buf)); 315 len = strlen(buf); 316 if (percent) { 317 if (percent > bracket) return -1; 318 if (len + (size_t)(bracket - percent) >= sizeof(buf)) return -1; 319 if (len < sizeof(laddr.s)) memcpy(laddr.s, buf, (laddr.n = len)); 320 memcpy(buf+len, percent, (size_t)(bracket - percent)); 321 len += (size_t)(bracket - percent); 322 } 323 buffer_string_set_length(b, 1); /* truncate after '[' */ 324 buffer_append_string_len(b, buf, len); 325 buffer_append_string_len(b, CONST_STR_LEN("]")); 326 327 #else 328 329 return -1; 330 331 #endif 332 } while (0); 333 334 if (0 != port && port != scheme_port) { 335 buffer_append_string_len(b, CONST_STR_LEN(":")); 336 buffer_append_int(b, (int)port); 337 } 338 339 return 0; 340 } 341 342 int http_request_host_policy (buffer * const b, const unsigned int http_parseopts, const int scheme_port) { 343 return (((http_parseopts & HTTP_PARSEOPT_HOST_STRICT) 344 && 0 != request_check_hostname(b)) 345 || ((http_parseopts & HTTP_PARSEOPT_HOST_NORMALIZE) 346 && 0 != http_request_host_normalize(b, scheme_port))); 347 } 348 349 __attribute_pure__ /*(could be even more strict and use __attribute_const__)*/ 350 static int request_uri_is_valid_char(const unsigned char c) { 351 return (c > 32 && c != 127 && c != 255); 352 } 353 354 __attribute_cold__ 355 __attribute_noinline__ 356 static int http_request_header_line_invalid(request_st * const restrict r, const int status, const char * const restrict msg) { 357 if (r->conf.log_request_header_on_error) { 358 if (msg) log_error(r->conf.errh, __FILE__, __LINE__, "%s", msg); 359 } 360 return status; 361 } 362 363 __attribute_cold__ 364 __attribute_noinline__ 365 static int http_request_header_char_invalid(request_st * const restrict r, const char ch, const char * const restrict msg) { 366 if (r->conf.log_request_header_on_error) { 367 if ((unsigned char)ch > 32 && ch != 127) { 368 log_error(r->conf.errh, __FILE__, __LINE__, "%s ('%c')", msg, ch); 369 } 370 else { 371 log_error(r->conf.errh, __FILE__, __LINE__, "%s (0x%x)", msg, ch); 372 } 373 } 374 return 400; 375 } 376 377 /* add header to list of headers 378 * certain headers are also parsed 379 * might drop a header if deemed unnecessary/broken 380 * 381 * returns 0 on success, HTTP status on error 382 */ 383 static int http_request_parse_single_header(request_st * const restrict r, const enum http_header_e id, const char * const restrict k, const size_t klen, const char * const restrict v, const size_t vlen) { 384 buffer **saveb = NULL; 385 386 /* 387 * Note: k might not be '\0'-terminated 388 * Note: v is not '\0'-terminated, and ends with whitespace 389 * (one of '\r' '\n' ' ' '\t') 390 */ 391 392 switch (id) { 393 /*case HTTP_HEADER_OTHER:*/ 394 default: 395 break; 396 case HTTP_HEADER_HOST: 397 if (!(r->rqst_htags & HTTP_HEADER_HOST)) { 398 saveb = &r->http_host; 399 if (vlen >= 1024) { /*(expecting < 256)*/ 400 return http_request_header_line_invalid(r, 400, "uri-authority too long -> 400"); 401 } 402 } 403 else if (NULL != r->http_host 404 && buffer_is_equal_string(r->http_host, v, vlen)) { 405 /* ignore all Host: headers if match authority in request line */ 406 return 0; /* ignore header */ 407 } 408 else { 409 return http_request_header_line_invalid(r, 400, "duplicate Host header -> 400"); 410 } 411 break; 412 case HTTP_HEADER_CONNECTION: 413 /* "Connection: close" is common case if header is present */ 414 if ((vlen == 5 && buffer_eq_icase_ssn(v, CONST_STR_LEN("close"))) 415 || http_header_str_contains_token(v,vlen,CONST_STR_LEN("close"))) { 416 r->keep_alive = 0; 417 break; 418 } 419 if (http_header_str_contains_token(v,vlen,CONST_STR_LEN("keep-alive"))){ 420 r->keep_alive = 1; 421 break; 422 } 423 break; 424 case HTTP_HEADER_CONTENT_TYPE: 425 if (r->rqst_htags & HTTP_HEADER_CONTENT_TYPE) { 426 return http_request_header_line_invalid(r, 400, "duplicate Content-Type header -> 400"); 427 } 428 break; 429 case HTTP_HEADER_IF_NONE_MATCH: 430 /* if dup, only the first one will survive */ 431 if (r->rqst_htags & HTTP_HEADER_IF_NONE_MATCH) { 432 return 0; /* ignore header */ 433 } 434 break; 435 case HTTP_HEADER_CONTENT_LENGTH: 436 if (!(r->rqst_htags & HTTP_HEADER_CONTENT_LENGTH)) { 437 /*(trailing whitespace was removed from vlen)*/ 438 char *err; 439 off_t clen = strtoll(v, &err, 10); 440 if (clen >= 0 && err == v+vlen && light_isdigit(v[0])) { 441 /* (set only if not set to -1 by Transfer-Encoding: chunked) */ 442 if (0 == r->reqbody_length) r->reqbody_length = clen; 443 } 444 else { 445 return http_request_header_line_invalid(r, 400, "invalid Content-Length header -> 400"); 446 } 447 } 448 else { 449 return http_request_header_line_invalid(r, 400, "duplicate Content-Length header -> 400"); 450 } 451 break; 452 case HTTP_HEADER_HTTP2_SETTINGS: 453 if (r->rqst_htags & HTTP_HEADER_HTTP2_SETTINGS) { 454 return http_request_header_line_invalid(r, 400, "duplicate HTTP2-Settings header -> 400"); 455 } 456 break; 457 case HTTP_HEADER_IF_MODIFIED_SINCE: 458 if (r->rqst_htags & HTTP_HEADER_IF_MODIFIED_SINCE) { 459 /* Proxies sometimes send dup headers 460 * if they are the same we ignore the second 461 * if not, we raise an error */ 462 const buffer *vb = 463 http_header_request_get(r, HTTP_HEADER_IF_MODIFIED_SINCE, 464 CONST_STR_LEN("If-Modified-Since")); 465 if (vb && buffer_is_equal_caseless_string(vb, v, vlen)) { 466 /* ignore it if they are the same */ 467 return 0; /* ignore header */ 468 } 469 else { 470 return http_request_header_line_invalid(r, 400, "duplicate If-Modified-Since header -> 400"); 471 } 472 } 473 break; 474 case HTTP_HEADER_TRANSFER_ENCODING: 475 if (HTTP_VERSION_1_1 != r->http_version) { 476 return http_request_header_line_invalid(r, 400, 477 HTTP_VERSION_1_0 == r->http_version 478 ? "HTTP/1.0 with Transfer-Encoding (bad HTTP/1.0 proxy?) -> 400" 479 : "HTTP/2 with Transfer-Encoding is invalid -> 400"); 480 } 481 482 if (!buffer_eq_icase_ss(v, vlen, CONST_STR_LEN("chunked"))) { 483 /* Transfer-Encoding might contain additional encodings, 484 * which are not currently supported by lighttpd */ 485 return http_request_header_line_invalid(r, 501, NULL); /* Not Implemented */ 486 } 487 r->reqbody_length = -1; 488 489 /* Transfer-Encoding is a hop-by-hop header, 490 * which must not be blindly forwarded to backends */ 491 return 0; /* skip header */ 492 } 493 494 http_header_request_append(r, id, k, klen, v, vlen); 495 496 if (saveb) { 497 *saveb = http_header_request_get(r, id, k, klen); 498 } 499 500 return 0; 501 } 502 503 __attribute_cold__ 504 static int http_request_parse_proto_loose(request_st * const restrict r, const char * const restrict ptr, const size_t len, const unsigned int http_parseopts) { 505 const char * proto = memchr(ptr, ' ', len); 506 if (NULL == proto) 507 return http_request_header_line_invalid(r, 400, "incomplete request line -> 400"); 508 proto = memchr(proto+1, ' ', len - (proto+1 - ptr)); 509 if (NULL == proto) 510 return http_request_header_line_invalid(r, 400, "incomplete request line -> 400"); 511 ++proto; 512 513 if (proto[0]=='H' && proto[1]=='T' && proto[2]=='T' && proto[3]=='P' && proto[4] == '/') { 514 if (proto[5] == '1' && proto[6] == '.' && (proto[7] == '1' || proto[7] == '0')) { 515 /* length already checked before calling this routine */ 516 /* (len != (size_t)(proto - ptr + 8)) */ 517 if (http_parseopts & HTTP_PARSEOPT_HEADER_STRICT) /*(http_header_strict)*/ 518 return http_request_header_line_invalid(r, 400, "incomplete request line -> 400"); 519 r->http_version = (proto[7] == '1') ? HTTP_VERSION_1_1 : HTTP_VERSION_1_0; 520 } 521 else 522 return http_request_header_line_invalid(r, 505, "unknown HTTP version -> 505"); 523 } 524 else 525 return http_request_header_line_invalid(r, 400, "unknown protocol -> 400"); 526 527 /* keep-alive default: HTTP/1.1 -> true; HTTP/1.0 -> false */ 528 r->keep_alive = (HTTP_VERSION_1_0 != r->http_version); 529 530 return 0; 531 } 532 533 __attribute_cold__ 534 static const char * http_request_parse_reqline_uri(request_st * const restrict r, const char * const restrict uri, const size_t len, const unsigned int http_parseopts) { 535 const char *nuri; 536 if ((len > 7 && buffer_eq_icase_ssn(uri, "http://", 7) 537 && NULL != (nuri = memchr(uri + 7, '/', len-7))) 538 || 539 (len > 8 && buffer_eq_icase_ssn(uri, "https://", 8) 540 && NULL != (nuri = memchr(uri + 8, '/', len-8)))) { 541 const char * const host = uri + (uri[4] == ':' ? 7 : 8); 542 const size_t hostlen = nuri - host; 543 if (0 == hostlen || hostlen >= 1024) { /*(expecting < 256)*/ 544 http_request_header_line_invalid(r, 400, "uri-authority empty or too long -> 400"); 545 return NULL; 546 } 547 /* Insert as host header */ 548 http_header_request_set(r, HTTP_HEADER_HOST, CONST_STR_LEN("Host"), host, hostlen); 549 r->http_host = http_header_request_get(r, HTTP_HEADER_HOST, CONST_STR_LEN("Host")); 550 return nuri; 551 } else if (!(http_parseopts & HTTP_PARSEOPT_HEADER_STRICT) /*(!http_header_strict)*/ 552 || (HTTP_METHOD_CONNECT == r->http_method && (uri[0] == ':' || light_isdigit(uri[0]))) 553 || (HTTP_METHOD_OPTIONS == r->http_method && uri[0] == '*' && 1 == len)) { 554 /* (permitted) */ 555 return uri; 556 } else { 557 http_request_header_line_invalid(r, 400, "request-URI parse error -> 400"); 558 return NULL; 559 } 560 } 561 562 563 __attribute_cold__ 564 __attribute_noinline__ 565 static int http_request_parse_header_other(request_st * const restrict r, const char * const restrict k, const int klen, const unsigned int http_header_strict); 566 567 568 int 569 http_request_validate_pseudohdrs (request_st * const restrict r, const int scheme, const unsigned int http_parseopts) 570 { 571 /* :method is required to indicate method 572 * CONNECT method must have :method and :authority 573 * All other methods must have at least :method :scheme :path */ 574 575 if (HTTP_METHOD_UNSET == r->http_method) 576 return http_request_header_line_invalid(r, 400, 577 "missing pseudo-header method -> 400"); 578 579 if (HTTP_METHOD_CONNECT != r->http_method) { 580 if (!scheme) 581 return http_request_header_line_invalid(r, 400, 582 "missing pseudo-header scheme -> 400"); 583 584 if (buffer_string_is_empty(&r->target)) 585 return http_request_header_line_invalid(r, 400, 586 "missing pseudo-header path -> 400"); 587 588 const char * const uri = r->target.ptr; 589 if (*uri != '/') { /* (common case: (*uri == '/')) */ 590 if (uri[0] != '*' || uri[1] != '\0' 591 || HTTP_METHOD_OPTIONS != r->http_method) 592 return http_request_header_line_invalid(r, 400, 593 "invalid pseudo-header path -> 400"); 594 } 595 } 596 else { /* HTTP_METHOD_CONNECT */ 597 if (NULL == r->http_host) 598 return http_request_header_line_invalid(r, 400, 599 "missing pseudo-header authority -> 400"); 600 if (!buffer_string_is_empty(&r->target) || scheme) 601 return http_request_header_line_invalid(r, 400, 602 "invalid pseudo-header with CONNECT -> 400"); 603 /*(reuse uri and ulen to assign to r->target)*/ 604 buffer_copy_buffer(&r->target, r->http_host); 605 } 606 buffer_copy_buffer(&r->target_orig, &r->target); 607 608 /* r->http_host, if set, is checked with http_request_host_policy() 609 * in http_request_parse() */ 610 611 /* copied and modified from end of http_request_parse_reqline() */ 612 613 /* check uri for invalid characters */ 614 const unsigned int http_header_strict = 615 (http_parseopts & HTTP_PARSEOPT_HEADER_STRICT); 616 if (http_header_strict 617 && (http_parseopts & HTTP_PARSEOPT_URL_NORMALIZE_CTRLS_REJECT)) 618 return 0; /* URI will be checked in http_request_parse_target() */ 619 620 const uint32_t ulen = buffer_string_length(&r->target); 621 const uint8_t * const uri = (uint8_t *)r->target.ptr; 622 if (http_header_strict) { 623 for (uint32_t i = 0; i < ulen; ++i) { 624 if (!request_uri_is_valid_char(uri[i])) 625 return http_request_header_char_invalid(r, uri[i], 626 "invalid character in URI -> 400"); 627 } 628 } 629 else { 630 if (NULL != memchr(uri, '\0', ulen)) 631 return http_request_header_char_invalid(r, '\0', 632 "invalid character in header -> 400"); 633 } 634 635 return 0; 636 } 637 638 639 int 640 http_request_parse_header (request_st * const restrict r, http_header_parse_ctx * const restrict hpctx) 641 { 642 const char * const restrict k = hpctx->k; 643 const char * const restrict v = hpctx->v; 644 const uint32_t klen = hpctx->klen; 645 const uint32_t vlen = hpctx->vlen; 646 647 if (0 == klen) 648 return http_request_header_line_invalid(r, 400, 649 "invalid header key -> 400"); 650 if (0 == vlen) 651 return http_request_header_line_invalid(r, 400, 652 "invalid header value -> 400"); 653 654 if ((hpctx->hlen += klen + vlen + 4) > hpctx->max_request_field_size) { 655 /*(configurable with server.max-request-field-size; default 8k)*/ 656 #if 1 /* emit to error log for people sending large headers */ 657 log_error(r->conf.errh, __FILE__, __LINE__, 658 "oversized request header -> 431"); 659 return 431; /* Request Header Fields Too Large */ 660 #else 661 /* 431 Request Header Fields Too Large */ 662 return http_request_header_line_invalid(r, 431, 663 "oversized request header -> 431"); 664 #endif 665 } 666 667 if (2 == klen && k[0] == 't' && k[1] == 'e' 668 && !buffer_eq_icase_ss(v, vlen, CONST_STR_LEN("trailers"))) 669 return http_request_header_line_invalid(r, 400, 670 "invalid TE header value with HTTP/2 -> 400"); 671 672 if (!hpctx->trailers) { 673 if (*k == ':') { 674 /* HTTP/2 request pseudo-header fields */ 675 if (!hpctx->pseudo) /*(pseudo header after non-pseudo header)*/ 676 return http_request_header_line_invalid(r, 400, 677 "invalid pseudo-header -> 400"); 678 switch (klen-1) { 679 case 4: 680 if (0 == memcmp(k+1, "path", 4)) { 681 if (!buffer_string_is_empty(&r->target)) 682 return http_request_header_line_invalid(r, 400, 683 "repeated pseudo-header -> 400"); 684 buffer_copy_string_len(&r->target, v, vlen); 685 return 0; 686 } 687 break; 688 case 6: 689 if (0 == memcmp(k+1, "method", 6)) { 690 if (HTTP_METHOD_UNSET != r->http_method) 691 return http_request_header_line_invalid(r, 400, 692 "repeated pseudo-header -> 400"); 693 r->http_method = get_http_method_key(v, vlen); 694 if (HTTP_METHOD_UNSET >= r->http_method) 695 return http_request_header_line_invalid(r, 501, 696 "unknown http-method -> 501"); 697 return 0; 698 } 699 else if (0 == memcmp(k+1, "scheme", 6)) { 700 if (hpctx->scheme) 701 return http_request_header_line_invalid(r, 400, 702 "repeated pseudo-header -> 400"); 703 switch (vlen) {/*(validated, but then ignored)*/ 704 case 5: /* "https" */ 705 if (v[4]!='s') break; 706 __attribute_fallthrough__ 707 case 4: /* "http" */ 708 if (v[0]=='h' && v[1]=='t' && v[2]=='t' && v[3]=='p') { 709 hpctx->scheme = 1; 710 return 0; 711 } 712 break; 713 default: 714 break; 715 } 716 return http_request_header_line_invalid(r, 400, 717 "unknown pseudo-header scheme -> 400"); 718 } 719 break; 720 case 9: 721 if (0 == memcmp(k+1, "authority", 9)) { 722 if (r->http_host) 723 return http_request_header_line_invalid(r, 400, 724 "repeated pseudo-header -> 400"); 725 if (vlen >= 1024) /*(expecting < 256)*/ 726 return http_request_header_line_invalid(r, 400, 727 "invalid pseudo-header authority too long -> 400"); 728 /* insert as host header */ 729 http_header_request_set(r, HTTP_HEADER_HOST, 730 CONST_STR_LEN("host"), v, vlen); 731 r->http_host = 732 http_header_request_get(r, HTTP_HEADER_HOST, 733 CONST_STR_LEN("Host")); 734 return 0; 735 } 736 break; 737 default: 738 break; 739 } 740 return http_request_header_line_invalid(r, 400, 741 "invalid pseudo-header -> 400"); 742 } 743 else { /*(non-pseudo headers)*/ 744 if (hpctx->pseudo) { /*(transition to non-pseudo headers)*/ 745 hpctx->pseudo = 0; 746 int status = 747 http_request_validate_pseudohdrs(r, hpctx->scheme, 748 hpctx->http_parseopts); 749 if (0 != status) return status; 750 } 751 752 const unsigned int http_header_strict = 753 (hpctx->http_parseopts & HTTP_PARSEOPT_HEADER_STRICT); 754 755 for (uint32_t j = 0; j < klen; ++j) { 756 if ((k[j] >= 'a' && k[j] <= 'z') || k[j] == '-') 757 continue; /*(common cases)*/ 758 if (k[j] >= 'A' && k[j] <= 'Z') 759 return 400; 760 if (0 != http_request_parse_header_other(r, k+j, klen-j, 761 http_header_strict)) 762 return 400; 763 break; 764 } 765 766 if (http_header_strict) { 767 for (uint32_t j = 0; j < vlen; ++j) { 768 if ((((uint8_t *)v)[j] < 32 && v[j] != '\t') || v[j]==127) 769 return http_request_header_char_invalid(r, v[j], 770 "invalid character in header -> 400"); 771 } 772 } 773 else { 774 if (NULL != memchr(v, '\0', vlen)) 775 return http_request_header_char_invalid(r, '\0', 776 "invalid character in header -> 400"); 777 } 778 779 const enum http_header_e id = http_header_hkey_get(k, klen); 780 return http_request_parse_single_header(r, id, k, klen, v, vlen); 781 } 782 } 783 else { /*(trailers)*/ 784 /* ignore trailers (after required HPACK decoding) if streaming 785 * request body to backend since headers have already been sent 786 * to backend via Common Gateway Interface (CGI) (CGI, FastCGI, 787 * SCGI, etc) or HTTP/1.1 (proxy) (mod_proxy does not currently 788 * support using HTTP/2 to connect to backends) */ 789 #if 0 /* (if needed, save flag in hpctx instead of fdevent.h dependency)*/ 790 if (r->conf.stream_request_body & FDEVENT_STREAM_REQUEST) 791 return 0; 792 #endif 793 /* Note: do not unconditionally merge into headers since if 794 * headers had already been sent to backend, then mod_accesslog 795 * logging of request headers might be inaccurate. 796 * Many simple backends do not support HTTP/1.1 requests sending 797 * Transfer-Encoding: chunked, and even those that do might not 798 * handle trailers. Some backends do not even support HTTP/1.1. 799 * For all these reasons, ignore trailers if streaming request 800 * body to backend. Revisit in future if adding support for 801 * connecting to backends using HTTP/2 (with explicit config 802 * option to force connecting to backends using HTTP/2) */ 803 804 /* XXX: TODO: request trailers not handled if streaming reqbody 805 * XXX: must ensure that trailers are not disallowed field-names 806 */ 807 808 return 0; 809 } 810 } 811 812 813 static int http_request_parse_reqline(request_st * const restrict r, const char * const restrict ptr, const unsigned short * const restrict hoff, const unsigned int http_parseopts) { 814 size_t len = hoff[2]; 815 816 /* parse the first line of the request 817 * <method> <uri> <protocol>\r\n 818 * */ 819 if (len < 13) /* minimum len with (!http_header_strict): "x x HTTP/1.0\n" */ 820 return http_request_header_line_invalid(r, 400, "invalid request line (too short) -> 400"); 821 if (ptr[len-2] == '\r') 822 len-=2; 823 else if (!(http_parseopts & HTTP_PARSEOPT_HEADER_STRICT)) /*(!http_header_strict)*/ 824 len-=1; 825 else 826 return http_request_header_line_invalid(r, 400, "missing CR before LF in header -> 400"); 827 828 /* 829 * RFC7230: 830 * HTTP-version = HTTP-name "/" DIGIT "." DIGIT 831 * HTTP-name = %x48.54.54.50 ; "HTTP", case-sensitive 832 */ 833 834 /* protocol is expected to be " HTTP/1.1" or " HTTP/1.0" at end of line */ 835 union proto_un { 836 char c[8]; 837 uint64_t u; 838 }; 839 static const union proto_un http_1_1 = {{'H','T','T','P','/','1','.','1'}}; 840 static const union proto_un http_1_0 = {{'H','T','T','P','/','1','.','0'}}; 841 const char *p = ptr + len - 8; 842 union proto_un proto8; 843 proto8.c[0]=p[0]; proto8.c[1]=p[1]; proto8.c[2]=p[2]; proto8.c[3]=p[3]; 844 proto8.c[4]=p[4]; proto8.c[5]=p[5]; proto8.c[6]=p[6]; proto8.c[7]=p[7]; 845 if (p[-1] == ' ' && http_1_1.u == proto8.u) { 846 r->http_version = HTTP_VERSION_1_1; 847 r->keep_alive = 1; /* keep-alive default: HTTP/1.1 -> true */ 848 } 849 else if (p[-1] == ' ' && http_1_0.u == proto8.u) { 850 r->http_version = HTTP_VERSION_1_0; 851 r->keep_alive = 0; /* keep-alive default: HTTP/1.0 -> false */ 852 } 853 else { 854 int status = http_request_parse_proto_loose(r,ptr,len,http_parseopts); 855 if (0 != status) return status; 856 /*(space char must exist if http_request_parse_proto_loose() succeeds)*/ 857 for (p = ptr + len - 9; p[-1] != ' '; --p) ; 858 } 859 860 /* method is expected to be a short string in the general case */ 861 size_t i = 0; 862 while (ptr[i] != ' ') ++i; 863 #if 0 /*(space must exist if protocol was parsed successfully)*/ 864 while (i < len && ptr[i] != ' ') ++i; 865 if (ptr[i] != ' ') 866 return http_request_header_line_invalid(r, 400, "incomplete request line -> 400"); 867 #endif 868 869 r->http_method = get_http_method_key(ptr, i); 870 if (HTTP_METHOD_UNSET >= r->http_method) 871 return http_request_header_line_invalid(r, 501, "unknown http-method -> 501"); 872 873 const char *uri = ptr + i + 1; 874 875 if (uri == p) 876 return http_request_header_line_invalid(r, 400, "no uri specified -> 400"); 877 len = (size_t)(p - uri - 1); 878 879 if (*uri != '/') { /* (common case: (*uri == '/')) */ 880 uri = http_request_parse_reqline_uri(r, uri, len, http_parseopts); 881 if (NULL == uri) return 400; 882 len = (size_t)(p - uri - 1); 883 } 884 885 if (0 == len) 886 return http_request_header_line_invalid(r, 400, "no uri specified -> 400"); 887 888 /* check uri for invalid characters */ 889 if (http_parseopts & HTTP_PARSEOPT_HEADER_STRICT) { /* http_header_strict */ 890 if ((http_parseopts & HTTP_PARSEOPT_URL_NORMALIZE_CTRLS_REJECT)) { 891 /* URI will be checked in http_request_parse_target() */ 892 } 893 else { 894 for (i = 0; i < len; ++i) { 895 if (!request_uri_is_valid_char(uri[i])) 896 return http_request_header_char_invalid(r, uri[i], "invalid character in URI -> 400"); 897 } 898 } 899 } 900 else { 901 /* check entire set of request headers for '\0' */ 902 if (NULL != memchr(ptr, '\0', hoff[hoff[0]])) 903 return http_request_header_char_invalid(r, '\0', "invalid character in header -> 400"); 904 } 905 906 buffer_copy_string_len(&r->target, uri, len); 907 buffer_copy_string_len(&r->target_orig, uri, len); 908 return 0; 909 } 910 911 int http_request_parse_target(request_st * const r, int scheme_port) { 912 /* URI is parsed into components at start of request and may 913 * also be re-parsed upon HANDLER_COMEBACK during the request 914 * r->target is expected to be a "/url-part?query-part" 915 * (and *not* a fully-qualified URI starting https://...) 916 * r->uri.authority is expected to be parsed elsewhere into r->http_host 917 */ 918 919 /** 920 * prepare strings 921 * 922 * - uri.path 923 * - uri.query 924 * 925 */ 926 927 /** 928 * Name according to RFC 2396 929 * 930 * - scheme 931 * - authority 932 * - path 933 * - query 934 * 935 * (scheme)://(authority)(path)?(query)#fragment 936 * 937 */ 938 939 /* take initial scheme value from connection-level state 940 * (request r->uri.scheme can be overwritten for later, 941 * for example by mod_extforward or mod_magnet) */ 942 if (scheme_port == 443) 943 buffer_copy_string_len(&r->uri.scheme, CONST_STR_LEN("https")); 944 else 945 buffer_copy_string_len(&r->uri.scheme, CONST_STR_LEN("http")); 946 947 buffer * const target = &r->target; 948 if (r->http_method == HTTP_METHOD_CONNECT 949 || (r->http_method == HTTP_METHOD_OPTIONS 950 && target->ptr[0] == '*' 951 && target->ptr[1] == '\0')) { 952 /* CONNECT ... (or) OPTIONS * ... */ 953 buffer_copy_buffer(&r->uri.path, target); 954 buffer_clear(&r->uri.query); 955 return 0; 956 } 957 958 char *qstr; 959 if (r->conf.http_parseopts & HTTP_PARSEOPT_URL_NORMALIZE) { 960 /*uint32_t len = (uint32_t)buffer_string_length(target);*/ 961 int qs = burl_normalize(target, r->tmp_buf, r->conf.http_parseopts); 962 if (-2 == qs) { 963 log_error(r->conf.errh, __FILE__, __LINE__, 964 "invalid character in URI -> 400 %s", 965 target->ptr); 966 return 400; /* Bad Request */ 967 } 968 qstr = (-1 == qs) ? NULL : target->ptr+qs; 969 #if 0 /* future: might enable here, or below for all requests */ 970 /* (Note: total header size not recalculated on HANDLER_COMEBACK 971 * even if other request headers changed during processing) 972 * (If (0 != r->loops_per_request), then the generated 973 * request is too large. Should a different error be returned?) */ 974 r->rqst_header_len -= len; 975 len = buffer_string_length(target); 976 r->rqst_header_len += len; 977 if (len > MAX_HTTP_REQUEST_URI) { 978 return 414; /* 414 Request-URI Too Long */ 979 } 980 if (r->rqst_header_len > MAX_HTTP_REQUEST_HEADER) { 981 log_error(r->conf.errh, __FILE__, __LINE__, 982 "request header fields too large: %u -> 431", 983 r->rqst_header_len); 984 return 431; /* Request Header Fields Too Large */ 985 } 986 #endif 987 } 988 else { 989 size_t rlen = buffer_string_length(target); 990 qstr = memchr(target->ptr, '#', rlen);/* discard fragment */ 991 if (qstr) { 992 rlen = (size_t)(qstr - target->ptr); 993 buffer_string_set_length(target, rlen); 994 } 995 qstr = memchr(target->ptr, '?', rlen); 996 } 997 998 /** extract query string from target */ 999 const char * const pstr = target->ptr; 1000 const uint32_t rlen = buffer_string_length(target); 1001 uint32_t plen; 1002 if (NULL != qstr) { 1003 plen = (uint32_t)(qstr - pstr); 1004 buffer_copy_string_len(&r->uri.query, qstr + 1, rlen - plen - 1); 1005 } 1006 else { 1007 plen = rlen; 1008 buffer_clear(&r->uri.query); 1009 } 1010 buffer_copy_string_len(&r->uri.path, pstr, plen); 1011 1012 /* decode url to path 1013 * 1014 * - decode url-encodings (e.g. %20 -> ' ') 1015 * - remove path-modifiers (e.g. /../) 1016 */ 1017 1018 buffer_urldecode_path(&r->uri.path); 1019 buffer_path_simplify(&r->uri.path, &r->uri.path); 1020 if (r->uri.path.ptr[0] != '/') { 1021 log_error(r->conf.errh, __FILE__, __LINE__, 1022 "uri-path does not begin with '/': %s -> 400", r->uri.path.ptr); 1023 return 400; /* Bad Request */ 1024 } 1025 1026 return 0; 1027 } 1028 1029 __attribute_cold__ 1030 __attribute_noinline__ 1031 static int http_request_parse_header_other(request_st * const restrict r, const char * const restrict k, const int klen, const unsigned int http_header_strict) { 1032 for (int i = 0; i < klen; ++i) { 1033 if (light_isalpha(k[i]) || k[i] == '-') continue; /*(common cases)*/ 1034 /** 1035 * 1*<any CHAR except CTLs or separators> 1036 * CTLs == 0-31 + 127, CHAR = 7-bit ascii (0..127) 1037 * 1038 */ 1039 switch(k[i]) { 1040 case ' ': 1041 case '\t': 1042 return http_request_header_line_invalid(r, 400, "WS character in key -> 400"); 1043 case '(': 1044 case ')': 1045 case '<': 1046 case '>': 1047 case '@': 1048 case ',': 1049 case ';': 1050 case '\\': 1051 case '\"': 1052 case '/': 1053 case '[': 1054 case ']': 1055 case '?': 1056 case '=': 1057 case '{': 1058 case '}': 1059 return http_request_header_char_invalid(r, k[i], "invalid character in header key -> 400"); 1060 default: 1061 if (http_header_strict ? (k[i] < 32 || ((unsigned char *)k)[i] >= 127) : k[i] == '\0') 1062 return http_request_header_char_invalid(r, k[i], "invalid character in header key -> 400"); 1063 break; /* ok */ 1064 } 1065 } 1066 return 0; 1067 } 1068 1069 static int http_request_parse_headers(request_st * const restrict r, char * const restrict ptr, const unsigned short * const restrict hoff, const unsigned int http_parseopts) { 1070 const unsigned int http_header_strict = (http_parseopts & HTTP_PARSEOPT_HEADER_STRICT); 1071 1072 #if 0 /*(not checked here; will later result in invalid label for HTTP header)*/ 1073 int i = hoff[2]; 1074 1075 if (ptr[i] == ' ' || ptr[i] == '\t') { 1076 return http_request_header_line_invalid(r, 400, "WS at the start of first line -> 400"); 1077 } 1078 #endif 1079 1080 for (int i = 2; i < hoff[0]; ++i) { 1081 const char *k = ptr + hoff[i]; 1082 /* one past last line hoff[hoff[0]] is to final "\r\n" */ 1083 char *end = ptr + hoff[i+1]; 1084 1085 const char *colon = memchr(k, ':', end - k); 1086 if (NULL == colon) 1087 return http_request_header_line_invalid(r, 400, "invalid header missing ':' -> 400"); 1088 1089 const char *v = colon + 1; 1090 1091 /* RFC7230 Hypertext Transfer Protocol (HTTP/1.1): Message Syntax and Routing 1092 * 3.2.4. Field Parsing 1093 * [...] 1094 * No whitespace is allowed between the header field-name and colon. In 1095 * the past, differences in the handling of such whitespace have led to 1096 * security vulnerabilities in request routing and response handling. A 1097 * server MUST reject any received request message that contains 1098 * whitespace between a header field-name and colon with a response code 1099 * of 400 (Bad Request). A proxy MUST remove any such whitespace from a 1100 * response message before forwarding the message downstream. 1101 */ 1102 /* (line k[-1] is always preceded by a '\n', 1103 * including first header after request-line, 1104 * so no need to check colon != k) */ 1105 if (colon[-1] == ' ' || colon[-1] == '\t') { 1106 if (http_header_strict) { 1107 return http_request_header_line_invalid(r, 400, "invalid whitespace between field-name and colon -> 400"); 1108 } 1109 else { 1110 /* remove trailing whitespace from key(if !http_header_strict)*/ 1111 do { --colon; } while (colon[-1] == ' ' || colon[-1] == '\t'); 1112 } 1113 } 1114 1115 const int klen = (int)(colon - k); 1116 if (0 == klen) 1117 return http_request_header_line_invalid(r, 400, "invalid header key -> 400"); 1118 const enum http_header_e id = http_header_hkey_get(k, klen); 1119 1120 if (id == HTTP_HEADER_OTHER) { 1121 for (int j = 0; j < klen; ++j) { 1122 if (light_isalpha(k[j]) || k[j] == '-') continue; /*(common cases)*/ 1123 if (0 != http_request_parse_header_other(r, k+j, klen-j, http_header_strict)) 1124 return 400; 1125 break; 1126 } 1127 } 1128 1129 /* remove leading whitespace from value */ 1130 while (*v == ' ' || *v == '\t') ++v; 1131 1132 for (; i+1 <= hoff[0]; ++i) { 1133 end = ptr + hoff[i+1]; 1134 if (end[0] != ' ' && end[0] != '\t') break; 1135 1136 /* line folding */ 1137 #ifdef __COVERITY__ 1138 force_assert(end - k >= 2); 1139 #endif 1140 if (end[-2] == '\r') 1141 end[-2] = ' '; 1142 else if (http_header_strict) 1143 return http_request_header_line_invalid(r, 400, "missing CR before LF in header -> 400"); 1144 end[-1] = ' '; 1145 } 1146 #ifdef __COVERITY__ 1147 /*(buf holding k has non-zero request-line, so end[-2] valid)*/ 1148 force_assert(end >= k + 2); 1149 #endif 1150 if (end[-2] == '\r') 1151 --end; 1152 else if (http_header_strict) 1153 return http_request_header_line_invalid(r, 400, "missing CR before LF in header -> 400"); 1154 /* remove trailing whitespace from value (+ remove '\r\n') */ 1155 /* (line k[-1] is always preceded by a '\n', 1156 * including first header after request-line, 1157 * so no need to check (end != k)) */ 1158 do { --end; } while (end[-1] == ' ' || end[-1] == '\t'); 1159 1160 const int vlen = (int)(end - v); 1161 /* empty header-fields are not allowed by HTTP-RFC, we just ignore them */ 1162 if (vlen <= 0) continue; /* ignore header */ 1163 1164 if (http_header_strict) { 1165 for (int j = 0; j < vlen; ++j) { 1166 if ((((unsigned char *)v)[j] < 32 && v[j] != '\t') || v[j]==127) 1167 return http_request_header_char_invalid(r, v[j], "invalid character in header -> 400"); 1168 } 1169 } /* else URI already checked in http_request_parse_reqline() for any '\0' */ 1170 1171 int status = http_request_parse_single_header(r, id, k, (size_t)klen, v, (size_t)vlen); 1172 if (0 != status) return status; 1173 } 1174 1175 return 0; 1176 } 1177 1178 1179 static int 1180 http_request_parse (request_st * const restrict r, const int scheme_port) 1181 { 1182 int status = http_request_parse_target(r, scheme_port); 1183 if (0 != status) return status; 1184 1185 /*(r->http_host might not be set until after parsing request headers)*/ 1186 buffer_copy_buffer(&r->uri.authority, r->http_host);/*(copy even if empty)*/ 1187 buffer_to_lower(&r->uri.authority); 1188 1189 /* post-processing */ 1190 const unsigned int http_parseopts = r->conf.http_parseopts; 1191 1192 /* check hostname field if it is set */ 1193 if (r->http_host) { 1194 if (0 != http_request_host_policy(r->http_host, 1195 http_parseopts, scheme_port)) 1196 return http_request_header_line_invalid(r, 400, "Invalid Hostname -> 400"); 1197 } 1198 else { 1199 if (r->http_version >= HTTP_VERSION_1_1) 1200 return http_request_header_line_invalid(r, 400, "HTTP/1.1 but Host missing -> 400"); 1201 } 1202 1203 if (0 == r->reqbody_length) { 1204 /* POST requires Content-Length (or Transfer-Encoding) 1205 * (-1 == r->reqbody_length when Transfer-Encoding: chunked)*/ 1206 if (HTTP_METHOD_POST == r->http_method 1207 && !(r->rqst_htags & HTTP_HEADER_CONTENT_LENGTH)) { 1208 return http_request_header_line_invalid(r, 411, "POST-request, but content-length missing -> 411"); 1209 } 1210 } 1211 else { 1212 /* (-1 == r->reqbody_length when Transfer-Encoding: chunked)*/ 1213 if (-1 == r->reqbody_length 1214 && (r->rqst_htags & HTTP_HEADER_CONTENT_LENGTH)) { 1215 /* RFC7230 Hypertext Transfer Protocol (HTTP/1.1): Message Syntax and Routing 1216 * 3.3.3. Message Body Length 1217 * [...] 1218 * If a message is received with both a Transfer-Encoding and a 1219 * Content-Length header field, the Transfer-Encoding overrides the 1220 * Content-Length. Such a message might indicate an attempt to 1221 * perform request smuggling (Section 9.5) or response splitting 1222 * (Section 9.4) and ought to be handled as an error. A sender MUST 1223 * remove the received Content-Length field prior to forwarding such 1224 * a message downstream. 1225 */ 1226 const unsigned int http_header_strict = 1227 (http_parseopts & HTTP_PARSEOPT_HEADER_STRICT); 1228 if (http_header_strict) { 1229 return http_request_header_line_invalid(r, 400, "invalid Transfer-Encoding + Content-Length -> 400"); 1230 } 1231 else { 1232 /* ignore Content-Length */ 1233 http_header_request_unset(r, HTTP_HEADER_CONTENT_LENGTH, CONST_STR_LEN("Content-Length")); 1234 } 1235 } 1236 if (http_method_get_or_head(r->http_method) 1237 && !(http_parseopts & HTTP_PARSEOPT_METHOD_GET_BODY)) { 1238 return http_request_header_line_invalid(r, 400, "GET/HEAD with content-length -> 400"); 1239 } 1240 } 1241 1242 return 0; 1243 } 1244 1245 1246 static int 1247 http_request_parse_hoff (request_st * const restrict r, char * const restrict hdrs, const unsigned short * const restrict hoff, const int scheme_port) 1248 { 1249 /* 1250 * Request: "^(GET|POST|HEAD|...) ([^ ]+(\\?[^ ]+|)) (HTTP/1\\.[01])$" 1251 * Header : "^([-a-zA-Z]+): (.+)$" 1252 * End : "^$" 1253 */ 1254 1255 int status; 1256 const unsigned int http_parseopts = r->conf.http_parseopts; 1257 1258 status = http_request_parse_reqline(r, hdrs, hoff, http_parseopts); 1259 if (0 != status) return status; 1260 1261 status = http_request_parse_headers(r, hdrs, hoff, http_parseopts); 1262 if (0 != status) return status; 1263 1264 return http_request_parse(r, scheme_port); 1265 } 1266 1267 1268 static void 1269 http_request_headers_fin (request_st * const restrict r) 1270 { 1271 if (0 == r->http_status) { 1272 #if 0 1273 r->conditional_is_valid = (1 << COMP_SERVER_SOCKET) 1274 | (1 << COMP_HTTP_SCHEME) 1275 | (1 << COMP_HTTP_HOST) 1276 | (1 << COMP_HTTP_REMOTE_IP) 1277 | (1 << COMP_HTTP_REQUEST_METHOD) 1278 | (1 << COMP_HTTP_URL) 1279 | (1 << COMP_HTTP_QUERY_STRING) 1280 | (1 << COMP_HTTP_REQUEST_HEADER); 1281 #else 1282 /* all config conditions are valid after parsing header 1283 * (set all bits; remove dependency on plugin_config.h) */ 1284 r->conditional_is_valid = ~0u; 1285 #endif 1286 } 1287 else { 1288 r->keep_alive = 0; 1289 r->reqbody_length = 0; 1290 } 1291 } 1292 1293 1294 void 1295 http_request_headers_process (request_st * const restrict r, char * const restrict hdrs, const unsigned short * const restrict hoff, const int scheme_port) 1296 { 1297 r->http_status = http_request_parse_hoff(r, hdrs, hoff, scheme_port); 1298 1299 http_request_headers_fin(r); 1300 1301 if (0 != r->http_status) { 1302 if (r->conf.log_request_header_on_error) { 1303 /*(http_request_parse_headers() modifies hdrs only to 1304 * undo line-wrapping in-place using spaces)*/ 1305 log_error(r->conf.errh, __FILE__, __LINE__, 1306 "request-header:\n%.*s", (int)r->rqst_header_len, hdrs); 1307 } 1308 } 1309 } 1310 1311 1312 void 1313 http_request_headers_process_h2 (request_st * const restrict r, const int scheme_port) 1314 { 1315 if (0 == r->http_status) 1316 r->http_status = http_request_parse(r, scheme_port); 1317 1318 if (0 == r->http_status) { 1319 if (r->rqst_htags & HTTP_HEADER_CONNECTION) 1320 r->http_status = http_request_header_line_invalid(r, 400, 1321 "invalid Connection header with HTTP/2 -> 400"); 1322 } 1323 1324 http_request_headers_fin(r); 1325 1326 #if 0 /* not supported; headers not collected into a single buf for HTTP/2 */ 1327 if (0 != r->http_status) { 1328 if (r->conf.log_request_header_on_error) { 1329 log_error(r->conf.errh, __FILE__, __LINE__, 1330 "request-header:\n%.*s", (int)r->rqst_header_len, hdrs); 1331 } 1332 } 1333 #endif 1334 1335 /* ignore Upgrade if using HTTP/2 */ 1336 if (r->rqst_htags & HTTP_HEADER_UPGRADE) 1337 http_header_request_unset(r, HTTP_HEADER_UPGRADE, 1338 CONST_STR_LEN("upgrade")); 1339 /* XXX: should filter out other hop-by-hop connection headers, too */ 1340 } 1341