1 #include "first.h" 2 3 #include "request.h" 4 #include "base.h" 5 #include "burl.h" 6 #include "http_header.h" 7 #include "http_kv.h" 8 #include "log.h" 9 #include "sock_addr.h" 10 11 #include <limits.h> 12 #include <stdlib.h> 13 #include <string.h> 14 15 static int request_check_hostname(buffer *host) { 16 enum { DOMAINLABEL, TOPLABEL } stage = TOPLABEL; 17 size_t i; 18 int label_len = 0; 19 size_t host_len, hostport_len; 20 char *colon; 21 int is_ip = -1; /* -1 don't know yet, 0 no, 1 yes */ 22 int level = 0; 23 24 /* 25 * hostport = host [ ":" port ] 26 * host = hostname | IPv4address | IPv6address 27 * hostname = *( domainlabel "." ) toplabel [ "." ] 28 * domainlabel = alphanum | alphanum *( alphanum | "-" ) alphanum 29 * toplabel = alpha | alpha *( alphanum | "-" ) alphanum 30 * IPv4address = 1*digit "." 1*digit "." 1*digit "." 1*digit 31 * IPv6address = "[" ... "]" 32 * port = *digit 33 */ 34 35 /* IPv6 adress */ 36 if (host->ptr[0] == '[') { 37 char *c = host->ptr + 1; 38 int colon_cnt = 0; 39 40 /* check the address inside [...] */ 41 for (; *c && *c != ']'; c++) { 42 if (*c == ':') { 43 if (++colon_cnt > 7) { 44 return -1; 45 } 46 } else if (!light_isxdigit(*c) && '.' != *c) { 47 return -1; 48 } 49 } 50 51 /* missing ] */ 52 if (!*c) { 53 return -1; 54 } 55 56 /* check port */ 57 if (*(c+1) == ':') { 58 for (c += 2; *c; c++) { 59 if (!light_isdigit(*c)) { 60 return -1; 61 } 62 } 63 } 64 else if ('\0' != *(c+1)) { 65 /* only a port is allowed to follow [...] */ 66 return -1; 67 } 68 return 0; 69 } 70 71 hostport_len = host_len = buffer_string_length(host); 72 73 if (NULL != (colon = memchr(host->ptr, ':', host_len))) { 74 char *c = colon + 1; 75 76 /* check portnumber */ 77 for (; *c; c++) { 78 if (!light_isdigit(*c)) return -1; 79 } 80 81 /* remove the port from the host-len */ 82 host_len = colon - host->ptr; 83 } 84 85 /* Host is empty */ 86 if (host_len == 0) return -1; 87 88 /* if the hostname ends in a "." strip it */ 89 if (host->ptr[host_len-1] == '.') { 90 /* shift port info one left */ 91 if (NULL != colon) memmove(colon-1, colon, hostport_len - host_len); 92 buffer_string_set_length(host, --hostport_len); 93 if (--host_len == 0) return -1; 94 } 95 96 97 /* scan from the right and skip the \0 */ 98 for (i = host_len; i-- > 0; ) { 99 const char c = host->ptr[i]; 100 101 switch (stage) { 102 case TOPLABEL: 103 if (c == '.') { 104 /* only switch stage, if this is not the last character */ 105 if (i != host_len - 1) { 106 if (label_len == 0) { 107 return -1; 108 } 109 110 /* check the first character at right of the dot */ 111 if (is_ip == 0) { 112 if (!light_isalnum(host->ptr[i+1])) { 113 return -1; 114 } 115 } else if (!light_isdigit(host->ptr[i+1])) { 116 is_ip = 0; 117 } else if ('-' == host->ptr[i+1]) { 118 return -1; 119 } else { 120 /* just digits */ 121 is_ip = 1; 122 } 123 124 stage = DOMAINLABEL; 125 126 label_len = 0; 127 level++; 128 } else if (i == 0) { 129 /* just a dot and nothing else is evil */ 130 return -1; 131 } 132 } else if (i == 0) { 133 /* the first character of the hostname */ 134 if (!light_isalnum(c)) { 135 return -1; 136 } 137 label_len++; 138 } else { 139 if (c != '-' && !light_isalnum(c)) { 140 return -1; 141 } 142 if (is_ip == -1) { 143 if (!light_isdigit(c)) is_ip = 0; 144 } 145 label_len++; 146 } 147 148 break; 149 case DOMAINLABEL: 150 if (is_ip == 1) { 151 if (c == '.') { 152 if (label_len == 0) { 153 return -1; 154 } 155 156 label_len = 0; 157 level++; 158 } else if (!light_isdigit(c)) { 159 return -1; 160 } else { 161 label_len++; 162 } 163 } else { 164 if (c == '.') { 165 if (label_len == 0) { 166 return -1; 167 } 168 169 /* c is either - or alphanum here */ 170 if ('-' == host->ptr[i+1]) { 171 return -1; 172 } 173 174 label_len = 0; 175 level++; 176 } else if (i == 0) { 177 if (!light_isalnum(c)) { 178 return -1; 179 } 180 label_len++; 181 } else { 182 if (c != '-' && !light_isalnum(c)) { 183 return -1; 184 } 185 label_len++; 186 } 187 } 188 189 break; 190 } 191 } 192 193 /* a IP has to consist of 4 parts */ 194 if (is_ip == 1 && level != 3) { 195 return -1; 196 } 197 198 if (label_len == 0) { 199 return -1; 200 } 201 202 return 0; 203 } 204 205 int http_request_host_normalize(buffer *b, int scheme_port) { 206 /* 207 * check for and canonicalize numeric IP address and portnum (optional) 208 * (IP address may be followed by ":portnum" (optional)) 209 * - IPv6: "[...]" 210 * - IPv4: "x.x.x.x" 211 * - IPv4: 12345678 (32-bit decimal number) 212 * - IPv4: 012345678 (32-bit octal number) 213 * - IPv4: 0x12345678 (32-bit hex number) 214 * 215 * allow any chars (except ':' and '\0' and stray '[' or ']') 216 * (other code may check chars more strictly or more pedantically) 217 * ':' delimits (optional) port at end of string 218 * "[]" wraps IPv6 address literal 219 * '\0' should have been rejected earlier were it present 220 * 221 * any chars includes, but is not limited to: 222 * - allow '-' any where, even at beginning of word 223 * (security caution: might be confused for cmd flag if passed to shell) 224 * - allow all-digit TLDs 225 * (might be mistaken for IPv4 addr by inet_aton() 226 * unless non-digits appear in subdomain) 227 */ 228 229 /* Note: not using getaddrinfo() since it does not support "[]" around IPv6 230 * and is not as lenient as inet_aton() and inet_addr() for IPv4 strings. 231 * Not using inet_pton() (when available) on IPv4 for similar reasons. */ 232 233 const char * const p = b->ptr; 234 const size_t blen = buffer_string_length(b); 235 long port = 0; 236 237 if (*p != '[') { 238 char * const colon = (char *)memchr(p, ':', blen); 239 if (colon) { 240 if (*p == ':') return -1; /*(empty host then port, or naked IPv6)*/ 241 if (colon[1] != '\0') { 242 char *e; 243 port = strtol(colon+1, &e, 0); /*(allow decimal, octal, hex)*/ 244 if (0 < port && port <= USHRT_MAX && *e == '\0') { 245 /* valid port */ 246 } else { 247 return -1; 248 } 249 } /*(else ignore stray colon at string end)*/ 250 buffer_string_set_length(b, (size_t)(colon - p)); /*(remove port str)*/ 251 } 252 253 if (light_isdigit(*p)) do { 254 /* (IPv4 address literal or domain starting w/ digit (e.g. 3com))*/ 255 /* (check one-element cache of normalized IPv4 address string) */ 256 static struct { char s[INET_ADDRSTRLEN]; size_t n; } laddr; 257 size_t n = colon ? (size_t)(colon - p) : blen; 258 sock_addr addr; 259 if (n == laddr.n && 0 == memcmp(p, laddr.s, n)) break; 260 if (1 == sock_addr_inet_pton(&addr, p, AF_INET, 0)) { 261 sock_addr_inet_ntop_copy_buffer(b, &addr); 262 n = buffer_string_length(b); 263 if (n < sizeof(laddr.s)) memcpy(laddr.s, b->ptr, (laddr.n = n)); 264 } 265 } while (0); 266 } else do { /* IPv6 addr */ 267 #if defined(HAVE_IPV6) && defined(HAVE_INET_PTON) 268 269 /* (check one-element cache of normalized IPv4 address string) */ 270 static struct { char s[INET6_ADDRSTRLEN]; size_t n; } laddr; 271 sock_addr addr; 272 char *bracket = b->ptr+blen-1; 273 char *percent = strchr(b->ptr+1, '%'); 274 size_t len; 275 int rc; 276 char buf[INET6_ADDRSTRLEN+16]; /*(+16 for potential %interface name)*/ 277 if (blen <= 2) return -1; /*(invalid "[]")*/ 278 if (*bracket != ']') { 279 bracket = (char *)memchr(b->ptr+1, ']', blen-1); 280 if (NULL == bracket || bracket[1] != ':' || bracket - b->ptr == 1){ 281 return -1; 282 } 283 if (bracket[2] != '\0') { /*(ignore stray colon at string end)*/ 284 char *e; 285 port = strtol(bracket+2, &e, 0); /*(allow decimal, octal, hex)*/ 286 if (0 < port && port <= USHRT_MAX && *e == '\0') { 287 /* valid port */ 288 } else { 289 return -1; 290 } 291 } 292 } 293 294 len = (size_t)((percent ? percent : bracket) - (b->ptr+1)); 295 if (laddr.n == len && 0 == memcmp(laddr.s, b->ptr+1, len)) { 296 /* truncate after ']' and re-add normalized port, if needed */ 297 buffer_string_set_length(b, (size_t)(bracket - b->ptr + 1)); 298 break; 299 } 300 301 *bracket = '\0';/*(terminate IPv6 string)*/ 302 if (percent) *percent = '\0'; /*(remove %interface from address)*/ 303 rc = sock_addr_inet_pton(&addr, b->ptr+1, AF_INET6, 0); 304 if (percent) *percent = '%'; /*(restore %interface)*/ 305 *bracket = ']'; /*(restore bracket)*/ 306 if (1 != rc) return -1; 307 308 sock_addr_inet_ntop(&addr, buf, sizeof(buf)); 309 len = strlen(buf); 310 if (percent) { 311 if (percent > bracket) return -1; 312 if (len + (size_t)(bracket - percent) >= sizeof(buf)) return -1; 313 if (len < sizeof(laddr.s)) memcpy(laddr.s, buf, (laddr.n = len)); 314 memcpy(buf+len, percent, (size_t)(bracket - percent)); 315 len += (size_t)(bracket - percent); 316 } 317 buffer_string_set_length(b, 1); /* truncate after '[' */ 318 buffer_append_string_len(b, buf, len); 319 buffer_append_string_len(b, CONST_STR_LEN("]")); 320 321 #else 322 323 return -1; 324 325 #endif 326 } while (0); 327 328 if (0 != port && port != scheme_port) { 329 buffer_append_string_len(b, CONST_STR_LEN(":")); 330 buffer_append_int(b, (int)port); 331 } 332 333 return 0; 334 } 335 336 static int scheme_port (const buffer *scheme) 337 { 338 return buffer_is_equal_string(scheme, CONST_STR_LEN("https")) ? 443 : 80; 339 } 340 341 int http_request_host_policy (connection *con, buffer *b, const buffer *scheme) { 342 return (((con->conf.http_parseopts & HTTP_PARSEOPT_HOST_STRICT) 343 && 0 != request_check_hostname(b)) 344 || ((con->conf.http_parseopts & HTTP_PARSEOPT_HOST_NORMALIZE) 345 && 0 != http_request_host_normalize(b, scheme_port(scheme)))); 346 } 347 348 static int http_request_split_value(array *vals, const char *current, size_t len) { 349 int state = 0; 350 const char *token_start = NULL, *token_end = NULL; 351 /* 352 * parse 353 * 354 * val1, val2, val3, val4 355 * 356 * into a array (more or less a explode() incl. stripping of whitespaces 357 */ 358 359 for (size_t i = 0; i <= len; ++i, ++current) { 360 switch (state) { 361 case 0: /* find start of a token */ 362 switch (*current) { 363 case ' ': 364 case '\t': /* skip white space */ 365 case ',': /* skip empty token */ 366 break; 367 case '\0': /* end of string */ 368 return 0; 369 default: 370 /* found real data, switch to state 1 to find the end of the token */ 371 token_start = token_end = current; 372 state = 1; 373 break; 374 } 375 break; 376 case 1: /* find end of token and last non white space character */ 377 switch (*current) { 378 case ' ': 379 case '\t': 380 /* space - don't update token_end */ 381 break; 382 case ',': 383 case '\0': /* end of string also marks the end of a token */ 384 array_insert_value(vals, token_start, token_end-token_start+1); 385 state = 0; 386 break; 387 default: 388 /* no white space, update token_end to include current character */ 389 token_end = current; 390 break; 391 } 392 break; 393 } 394 } 395 396 return 0; 397 } 398 399 static int request_uri_is_valid_char(unsigned char c) { 400 return (c > 32 && c != 127 && c != 255); 401 } 402 403 __attribute_cold__ 404 __attribute_noinline__ 405 static int http_request_header_line_invalid(server *srv, int status, const char *msg) { 406 if (srv->srvconf.log_request_header_on_error) { 407 if (msg) log_error_write(srv, __FILE__, __LINE__, "s", msg); 408 } 409 return status; 410 } 411 412 __attribute_cold__ 413 __attribute_noinline__ 414 static int http_request_header_char_invalid(server *srv, char ch, const char *msg) { 415 if (srv->srvconf.log_request_header_on_error) { 416 if ((unsigned char)ch > 32 && ch != 127) { 417 char buf[2] = { ch, '\0' }; 418 log_error_write(srv,__FILE__,__LINE__,"sSSS",msg,"('",buf,"')"); 419 } 420 else { 421 log_error_write(srv,__FILE__,__LINE__,"sSXS",msg,"(",ch,")"); 422 } 423 } 424 return 400; 425 } 426 427 enum keep_alive_set { 428 HTTP_CONNECTION_UNSET, 429 HTTP_CONNECTION_KEEPALIVE, 430 HTTP_CONNECTION_CLOSE, 431 }; 432 433 typedef struct { 434 enum keep_alive_set keep_alive_set; 435 char con_length_set; 436 char *reqline_host; 437 int reqline_hostlen; 438 size_t reqline_len; 439 } parse_header_state; 440 441 static void init_parse_header_state(parse_header_state* state) { 442 state->keep_alive_set = HTTP_CONNECTION_UNSET; 443 state->con_length_set = 0; 444 state->reqline_host = NULL; 445 state->reqline_hostlen = 0; 446 state->reqline_len = 0; 447 } 448 449 /* add header to list of headers 450 * certain headers are also parsed 451 * might drop a header if deemed unnecessary/broken 452 * 453 * returns 0 on success, HTTP status on error 454 */ 455 static int parse_single_header(server *srv, connection *con, parse_header_state *state, char *k, size_t klen, char *v, size_t vlen) { 456 const enum http_header_e id = http_header_hkey_get(k, klen); 457 buffer **saveb = NULL; 458 459 /* strip leading whitespace */ 460 for (; vlen > 0 && (v[0] == ' ' || v[0] == '\t'); ++v, --vlen) ; 461 462 /* strip trailing whitespace */ 463 while (vlen > 0 && (v[vlen - 1] == ' ' || v[vlen - 1] == '\t')) --vlen; 464 465 /* empty header-fields are not allowed by HTTP-RFC, we just ignore them */ 466 if (0 == vlen) return 0; /* ignore header */ 467 468 /* 469 * Note: k might not be '\0'-terminated 470 */ 471 472 switch (id) { 473 /*case HTTP_HEADER_OTHER:*/ 474 default: 475 break; 476 case HTTP_HEADER_HOST: 477 if (!(con->request.htags & HTTP_HEADER_HOST)) { 478 saveb = &con->request.http_host; 479 if (vlen >= 1024) { /*(expecting < 256)*/ 480 return http_request_header_line_invalid(srv, 400, "uri-authority too long -> 400"); 481 } 482 } 483 else if (state->reqline_host) { 484 /* ignore all Host: headers as we got Host in request line */ 485 return 0; /* ignore header */ 486 } 487 else { 488 return http_request_header_line_invalid(srv, 400, "duplicate Host header -> 400"); 489 } 490 break; 491 case HTTP_HEADER_CONNECTION: 492 { 493 array * const vals = srv->split_vals; 494 array_reset_data_strings(vals); 495 http_request_split_value(vals, v, vlen); /* split on , */ 496 for (size_t vi = 0; vi < vals->used; ++vi) { 497 data_string *dsv = (data_string *)vals->data[vi]; 498 if (buffer_eq_icase_slen(dsv->value, 499 CONST_STR_LEN("keep-alive"))) { 500 state->keep_alive_set = HTTP_CONNECTION_KEEPALIVE; 501 break; 502 } 503 else if (buffer_eq_icase_slen(dsv->value, 504 CONST_STR_LEN("close"))) { 505 state->keep_alive_set = HTTP_CONNECTION_CLOSE; 506 break; 507 } 508 } 509 } 510 break; 511 case HTTP_HEADER_CONTENT_TYPE: 512 if (con->request.htags & HTTP_HEADER_CONTENT_TYPE) { 513 return http_request_header_line_invalid(srv, 400, "duplicate Content-Type header -> 400"); 514 } 515 break; 516 case HTTP_HEADER_IF_NONE_MATCH: 517 /* if dup, only the first one will survive */ 518 if (con->request.htags & HTTP_HEADER_IF_NONE_MATCH) { 519 return 0; /* ignore header */ 520 } 521 break; 522 case HTTP_HEADER_CONTENT_LENGTH: 523 if (!(con->request.htags & HTTP_HEADER_CONTENT_LENGTH)) { 524 char *err; 525 off_t r = strtoll(v, &err, 10); 526 527 if (*err == '\0' && r >= 0) { 528 con->request.content_length = r; 529 } 530 else { 531 return http_request_header_line_invalid(srv, 400, "invalid Content-Length header -> 400"); 532 } 533 } 534 else { 535 return http_request_header_line_invalid(srv, 400, "duplicate Content-Length header -> 400"); 536 } 537 break; 538 case HTTP_HEADER_IF_MODIFIED_SINCE: 539 if (con->request.htags & HTTP_HEADER_IF_MODIFIED_SINCE) { 540 /* Proxies sometimes send dup headers 541 * if they are the same we ignore the second 542 * if not, we raise an error */ 543 buffer *vb = 544 http_header_request_get(con, HTTP_HEADER_IF_MODIFIED_SINCE, 545 CONST_STR_LEN("If-Modified-Since")); 546 if (vb && buffer_is_equal_caseless_string(vb, v, vlen)) { 547 /* ignore it if they are the same */ 548 return 0; /* ignore header */ 549 } 550 else { 551 return http_request_header_line_invalid(srv, 400, "duplicate If-Modified-Since header -> 400"); 552 } 553 } 554 break; 555 } 556 557 con->request.htags |= id; 558 http_header_request_append(con, id, k, klen, v, vlen); 559 560 if (saveb) { 561 *saveb = http_header_request_get(con, id, k, klen); 562 } 563 564 return 0; 565 } 566 567 static size_t http_request_parse_reqline(server *srv, connection *con, buffer *hdrs, parse_header_state *state) { 568 char * const ptr = hdrs->ptr; 569 char *uri = NULL, *proto = NULL; 570 571 size_t i; 572 const unsigned int http_header_strict = (con->conf.http_parseopts & HTTP_PARSEOPT_HEADER_STRICT); 573 574 /* hdrs must end with '\n' (already checked before parsing headers) */ 575 #ifdef __COVERITY__ 576 if (NULL == strchr(ptr, '\n')) return 400; 577 #endif 578 579 /* 580 * Request: "^(GET|POST|HEAD) ([^ ]+(\\?[^ ]+|)) (HTTP/1\\.[01])$" 581 * Option : "^([-a-zA-Z]+): (.+)$" 582 * End : "^$" 583 */ 584 585 /* parse the first line of the request 586 * 587 * should be: 588 * 589 * <method> <uri> <protocol>\r\n 590 * */ 591 for (i = 0; ptr[i] != '\n'; ++i) { 592 if (ptr[i] == ' ') { 593 if (NULL == uri) uri = ptr + i + 1; 594 else if (NULL == proto) proto = ptr + i + 1; 595 else return http_request_header_line_invalid(srv, 400, "overlong request line; extra space -> 400"); /* ERROR, one space to much */ 596 } 597 } 598 ptr[i] = '\0'; 599 state->reqline_len = i+1; 600 601 { 602 char *nuri = NULL; 603 size_t j, jlen; 604 605 /* \r\n -> \0\0 */ 606 #ifdef __COVERITY__ 607 if (0 == i) return 400; 608 #endif 609 if (ptr[i-1] == '\r') { 610 ptr[i-1] = '\0'; 611 } else if (http_header_strict) { /* '\n' */ 612 return http_request_header_line_invalid(srv, 400, "missing CR before LF in header -> 400"); 613 } 614 615 if (NULL == proto) { 616 return http_request_header_line_invalid(srv, 400, "incomplete request line -> 400"); 617 } 618 619 con->request.http_method = get_http_method_key(ptr, uri - 1 - ptr); 620 if (HTTP_METHOD_UNSET == con->request.http_method) { 621 return http_request_header_line_invalid(srv, 501, "unknown http-method -> 501"); 622 } 623 624 /* 625 * RFC7230: 626 * HTTP-version = HTTP-name "/" DIGIT "." DIGIT 627 * HTTP-name = %x48.54.54.50 ; "HTTP", case-sensitive 628 */ 629 if (proto[0]=='H' && proto[1]=='T' && proto[2]=='T' && proto[3]=='P' && proto[4] == '/') { 630 if (proto[5] == '1' && proto[6] == '.' && (proto[7] == '1' || proto[7] == '0')) { 631 con->request.http_version = (proto[7] == '1') ? HTTP_VERSION_1_1 : HTTP_VERSION_1_0; 632 } else { 633 return http_request_header_line_invalid(srv, 505, "unknown HTTP version -> 505"); 634 } 635 } else { 636 return http_request_header_line_invalid(srv, 400, "unknown protocol -> 400"); 637 } 638 639 jlen = (size_t)(proto - uri - 1); 640 641 if (*uri == '/') { 642 /* (common case) */ 643 buffer_copy_string_len(con->request.uri, uri, jlen); 644 } else if (jlen > 7 && buffer_eq_icase_ssn(uri, "http://", 7) && 645 NULL != (nuri = memchr(uri + 7, '/', jlen-7))) { 646 state->reqline_host = uri + 7; 647 state->reqline_hostlen = nuri - state->reqline_host; 648 649 buffer_copy_string_len(con->request.uri, nuri, proto - nuri - 1); 650 } else if (jlen > 8 && buffer_eq_icase_ssn(uri, "https://", 8) && 651 NULL != (nuri = memchr(uri + 8, '/', jlen-8))) { 652 state->reqline_host = uri + 8; 653 state->reqline_hostlen = nuri - state->reqline_host; 654 655 buffer_copy_string_len(con->request.uri, nuri, proto - nuri - 1); 656 } else if (!http_header_strict 657 || (HTTP_METHOD_CONNECT == con->request.http_method && (uri[0] == ':' || light_isdigit(uri[0]))) 658 || (HTTP_METHOD_OPTIONS == con->request.http_method && uri[0] == '*' && 1 == jlen)) { 659 buffer_copy_string_len(con->request.uri, uri, jlen); 660 } else { 661 return http_request_header_line_invalid(srv, 400, "request-URI parse error -> 400"); 662 } 663 664 /* check uri for invalid characters */ 665 jlen = buffer_string_length(con->request.uri); 666 if (0 == jlen) return http_request_header_line_invalid(srv, 400, "no uri specified -> 400"); 667 if ((con->conf.http_parseopts & HTTP_PARSEOPT_URL_NORMALIZE_CTRLS_REJECT)) { 668 j = jlen; /* URI will be checked in http_response_prepare() */ 669 } else if (http_header_strict) { 670 for (j = 0; j < jlen && request_uri_is_valid_char(con->request.uri->ptr[j]); j++) ; 671 } else { 672 char *z = memchr(con->request.uri->ptr, '\0', jlen); 673 j = (NULL == z) ? jlen : (size_t)(z - con->request.uri->ptr); 674 } 675 if (j < jlen) { 676 return http_request_header_char_invalid(srv, con->request.uri->ptr[j], "invalid character in URI -> 400"); 677 } 678 679 buffer_copy_buffer(con->request.orig_uri, con->request.uri); 680 } 681 682 if (state->reqline_host) { 683 /* Insert as host header */ 684 if (state->reqline_hostlen >= 1024) { /*(expecting < 256)*/ 685 return http_request_header_line_invalid(srv, 400, "uri-authority too long -> 400"); 686 } 687 http_header_request_set(con, HTTP_HEADER_HOST, CONST_STR_LEN("Host"), state->reqline_host, state->reqline_hostlen); 688 con->request.http_host = http_header_request_get(con, HTTP_HEADER_HOST, CONST_STR_LEN("Host")); 689 } 690 691 return 0; 692 } 693 694 int http_request_parse(server *srv, connection *con, buffer *hdrs) { 695 char * const ptr = hdrs->ptr; 696 char *value = NULL; 697 size_t i, first, ilen; 698 const unsigned int http_header_strict = (con->conf.http_parseopts & HTTP_PARSEOPT_HEADER_STRICT); 699 int status; 700 701 parse_header_state state; 702 init_parse_header_state(&state); 703 704 status = http_request_parse_reqline(srv, con, hdrs, &state); 705 if (0 != status) return status; 706 707 i = first = state.reqline_len; 708 709 if (ptr[i] == ' ' || ptr[i] == '\t') { 710 return http_request_header_line_invalid(srv, 400, "WS at the start of first line -> 400"); 711 } 712 713 ilen = buffer_string_length(hdrs); 714 for (int is_key = 1, key_len = 0; i < ilen; ++i) { 715 char *cur = ptr + i; 716 717 if (is_key) { 718 /** 719 * 1*<any CHAR except CTLs or separators> 720 * CTLs == 0-31 + 127, CHAR = 7-bit ascii (0..127) 721 * 722 */ 723 switch(*cur) { 724 case ' ': 725 case '\t': 726 /* RFC7230 Hypertext Transfer Protocol (HTTP/1.1): Message Syntax and Routing 727 * 3.2.4. Field Parsing 728 * [...] 729 * No whitespace is allowed between the header field-name and colon. In 730 * the past, differences in the handling of such whitespace have led to 731 * security vulnerabilities in request routing and response handling. A 732 * server MUST reject any received request message that contains 733 * whitespace between a header field-name and colon with a response code 734 * of 400 (Bad Request). A proxy MUST remove any such whitespace from a 735 * response message before forwarding the message downstream. 736 */ 737 if (http_header_strict) 738 return http_request_header_line_invalid(srv, 400, "invalid whitespace between field-name and colon -> 400"); 739 /* skip every thing up to the : */ 740 do { ++cur; } while (*cur == ' ' || *cur == '\t'); 741 if (*cur != ':') { 742 return http_request_header_line_invalid(srv, 400, "WS character in key -> 400"); 743 } 744 /* fall through */ 745 case ':': 746 is_key = 0; 747 key_len = i - first; 748 value = cur + 1; 749 i = cur - ptr; 750 break; 751 case '(': 752 case ')': 753 case '<': 754 case '>': 755 case '@': 756 case ',': 757 case ';': 758 case '\\': 759 case '\"': 760 case '/': 761 case '[': 762 case ']': 763 case '?': 764 case '=': 765 case '{': 766 case '}': 767 return http_request_header_char_invalid(srv, *cur, "invalid character in header key -> 400"); 768 case '\r': 769 if (ptr[i+1] == '\n' && i == first) { 770 /* End of Header */ 771 ++i; 772 } else { 773 return http_request_header_line_invalid(srv, 400, "CR without LF -> 400"); 774 } 775 break; 776 case '\n': 777 if (http_header_strict) { 778 return http_request_header_line_invalid(srv, 400, "missing CR before LF in header -> 400"); 779 } else if (i == first) { 780 /* End of Header */ 781 break; 782 } 783 /* fall through */ 784 default: 785 if (http_header_strict ? (*cur < 32 || ((unsigned char)*cur) >= 127) : *cur == '\0') { 786 return http_request_header_char_invalid(srv, *cur, "invalid character in header key -> 400"); 787 } 788 /* ok */ 789 break; 790 } 791 } else { 792 switch(*cur) { 793 case '\r': 794 if (cur[1] != '\n') { 795 return http_request_header_line_invalid(srv, 400, "CR without LF -> 400"); 796 } 797 if (cur[2] == ' ' || cur[2] == '\t') { /* header line folding */ 798 cur[0] = ' '; 799 cur[1] = ' '; 800 i += 2; 801 continue; 802 } 803 ++i; 804 /* fall through */ 805 case '\n': 806 if (*cur == '\n') { 807 if (http_header_strict) { 808 return http_request_header_line_invalid(srv, 400, "missing CR before LF in header -> 400"); 809 } 810 if (cur[1] == ' ' || cur[1] == '\t') { /* header line folding */ 811 cur[0] = ' '; 812 i += 1; 813 continue; 814 } 815 } 816 817 /* End of Headerline */ 818 *cur = '\0'; /*(for if value is further parsed and '\0' is expected at end of string)*/ 819 820 status = parse_single_header(srv, con, &state, ptr + first, key_len, value, cur - value); 821 if (0 != status) return status; 822 823 first = i+1; 824 is_key = 1; 825 value = NULL; 826 break; 827 case ' ': 828 case '\t': 829 break; 830 default: 831 if (http_header_strict ? (*cur >= 0 && *cur < 32) : *cur == '\0') { 832 return http_request_header_char_invalid(srv, *cur, "invalid character in header -> 400"); 833 } 834 break; 835 } 836 } 837 } 838 839 /* do some post-processing */ 840 841 if (con->request.http_version == HTTP_VERSION_1_1) { 842 if (state.keep_alive_set != HTTP_CONNECTION_CLOSE) { 843 /* no Connection-Header sent */ 844 845 /* HTTP/1.1 -> keep-alive default TRUE */ 846 con->keep_alive = 1; 847 } else { 848 con->keep_alive = 0; 849 } 850 851 /* RFC 2616, 14.23 */ 852 if (con->request.http_host == NULL || 853 buffer_string_is_empty(con->request.http_host)) { 854 return http_request_header_line_invalid(srv, 400, "HTTP/1.1 but Host missing -> 400"); 855 } 856 } else { 857 if (state.keep_alive_set == HTTP_CONNECTION_KEEPALIVE) { 858 /* no Connection-Header sent */ 859 860 /* HTTP/1.0 -> keep-alive default FALSE */ 861 con->keep_alive = 1; 862 } else { 863 con->keep_alive = 0; 864 } 865 } 866 867 /* check hostname field if it is set */ 868 if (!buffer_is_empty(con->request.http_host) && 869 0 != http_request_host_policy(con, con->request.http_host, con->proto)) { 870 return http_request_header_line_invalid(srv, 400, "Invalid Hostname -> 400"); 871 } 872 873 if (con->request.htags & HTTP_HEADER_TRANSFER_ENCODING) { 874 buffer *vb = http_header_request_get(con, HTTP_HEADER_TRANSFER_ENCODING, CONST_STR_LEN("Transfer-Encoding")); 875 if (NULL != vb) { 876 if (con->request.http_version == HTTP_VERSION_1_0) { 877 return http_request_header_line_invalid(srv, 400, "HTTP/1.0 with Transfer-Encoding (bad HTTP/1.0 proxy?) -> 400"); 878 } 879 880 if (!buffer_eq_icase_slen(vb, CONST_STR_LEN("chunked"))) { 881 /* Transfer-Encoding might contain additional encodings, 882 * which are not currently supported by lighttpd */ 883 return http_request_header_line_invalid(srv, 501, NULL); /* Not Implemented */ 884 } 885 886 /* reset value for Transfer-Encoding, a hop-by-hop header, 887 * which must not be blindly forwarded to backends */ 888 http_header_request_unset(con, HTTP_HEADER_TRANSFER_ENCODING, CONST_STR_LEN("Transfer-Encoding")); 889 890 if (con->request.htags & HTTP_HEADER_CONTENT_LENGTH) { 891 /* RFC7230 Hypertext Transfer Protocol (HTTP/1.1): Message Syntax and Routing 892 * 3.3.3. Message Body Length 893 * [...] 894 * If a message is received with both a Transfer-Encoding and a 895 * Content-Length header field, the Transfer-Encoding overrides the 896 * Content-Length. Such a message might indicate an attempt to 897 * perform request smuggling (Section 9.5) or response splitting 898 * (Section 9.4) and ought to be handled as an error. A sender MUST 899 * remove the received Content-Length field prior to forwarding such 900 * a message downstream. 901 */ 902 if (http_header_strict) { 903 return http_request_header_line_invalid(srv, 400, "invalid Transfer-Encoding + Content-Length -> 400"); 904 } 905 else { 906 /* ignore Content-Length */ 907 http_header_request_unset(con, HTTP_HEADER_CONTENT_LENGTH, CONST_STR_LEN("Content-Length")); 908 } 909 } 910 911 state.con_length_set = 1; 912 con->request.content_length = -1; 913 } 914 } 915 else if (con->request.htags & HTTP_HEADER_CONTENT_LENGTH) { 916 state.con_length_set = 1; 917 } 918 919 switch(con->request.http_method) { 920 case HTTP_METHOD_GET: 921 case HTTP_METHOD_HEAD: 922 /* content-length is forbidden for those */ 923 if (state.con_length_set && 0 != con->request.content_length 924 && !(con->conf.http_parseopts & HTTP_PARSEOPT_METHOD_GET_BODY)) { 925 return http_request_header_line_invalid(srv, 400, "GET/HEAD with content-length -> 400"); 926 } 927 break; 928 case HTTP_METHOD_POST: 929 /* content-length is required for them */ 930 if (!state.con_length_set) { 931 return http_request_header_line_invalid(srv, 411, "POST-request, but content-length missing -> 411"); 932 } 933 break; 934 default: 935 break; 936 } 937 938 return 0; 939 } 940