1 /* 2 * request - HTTP request processing 3 * 4 * Fully-rewritten from original EXCEPT for request_check_hostname() 5 * Copyright(c) 2018 Glenn Strauss gstrauss()gluelogic.com All rights reserved 6 * License: BSD 3-clause (same as lighttpd) 7 */ 8 #include "first.h" 9 10 #include "request.h" 11 #include "burl.h" 12 #include "http_header.h" 13 #include "http_kv.h" 14 #include "log.h" 15 #include "sock_addr.h" 16 17 #include <limits.h> 18 #include <stdint.h> 19 #include <stdlib.h> 20 #include <string.h> 21 22 static int request_check_hostname(buffer * const host) { 23 enum { DOMAINLABEL, TOPLABEL } stage = TOPLABEL; 24 size_t i; 25 int label_len = 0; 26 size_t host_len, hostport_len; 27 char *colon; 28 int is_ip = -1; /* -1 don't know yet, 0 no, 1 yes */ 29 int level = 0; 30 31 /* 32 * hostport = host [ ":" port ] 33 * host = hostname | IPv4address | IPv6address 34 * hostname = *( domainlabel "." ) toplabel [ "." ] 35 * domainlabel = alphanum | alphanum *( alphanum | "-" ) alphanum 36 * toplabel = alpha | alpha *( alphanum | "-" ) alphanum 37 * IPv4address = 1*digit "." 1*digit "." 1*digit "." 1*digit 38 * IPv6address = "[" ... "]" 39 * port = *digit 40 */ 41 42 /* IPv6 address */ 43 if (host->ptr[0] == '[') { 44 char *c = host->ptr + 1; 45 int colon_cnt = 0; 46 47 /* check the address inside [...] */ 48 for (; *c && *c != ']'; c++) { 49 if (*c == ':') { 50 if (++colon_cnt > 7) { 51 return -1; 52 } 53 } else if (!light_isxdigit(*c) && '.' != *c) { 54 return -1; 55 } 56 } 57 58 /* missing ] */ 59 if (!*c) { 60 return -1; 61 } 62 63 /* check port */ 64 if (*(c+1) == ':') { 65 for (c += 2; *c; c++) { 66 if (!light_isdigit(*c)) { 67 return -1; 68 } 69 } 70 } 71 else if ('\0' != *(c+1)) { 72 /* only a port is allowed to follow [...] */ 73 return -1; 74 } 75 return 0; 76 } 77 78 hostport_len = host_len = buffer_string_length(host); 79 80 if (NULL != (colon = memchr(host->ptr, ':', host_len))) { 81 char *c = colon + 1; 82 83 /* check portnumber */ 84 for (; *c; c++) { 85 if (!light_isdigit(*c)) return -1; 86 } 87 88 /* remove the port from the host-len */ 89 host_len = colon - host->ptr; 90 } 91 92 /* Host is empty */ 93 if (host_len == 0) return -1; 94 95 /* if the hostname ends in a "." strip it */ 96 if (host->ptr[host_len-1] == '.') { 97 /* shift port info one left */ 98 if (NULL != colon) memmove(colon-1, colon, hostport_len - host_len); 99 buffer_string_set_length(host, --hostport_len); 100 if (--host_len == 0) return -1; 101 } 102 103 104 /* scan from the right and skip the \0 */ 105 for (i = host_len; i-- > 0; ) { 106 const char c = host->ptr[i]; 107 108 switch (stage) { 109 case TOPLABEL: 110 if (c == '.') { 111 /* only switch stage, if this is not the last character */ 112 if (i != host_len - 1) { 113 if (label_len == 0) { 114 return -1; 115 } 116 117 /* check the first character at right of the dot */ 118 if (is_ip == 0) { 119 if (!light_isalnum(host->ptr[i+1])) { 120 return -1; 121 } 122 } else if (!light_isdigit(host->ptr[i+1])) { 123 is_ip = 0; 124 } else if ('-' == host->ptr[i+1]) { 125 return -1; 126 } else { 127 /* just digits */ 128 is_ip = 1; 129 } 130 131 stage = DOMAINLABEL; 132 133 label_len = 0; 134 level++; 135 } else if (i == 0) { 136 /* just a dot and nothing else is evil */ 137 return -1; 138 } 139 } else if (i == 0) { 140 /* the first character of the hostname */ 141 if (!light_isalnum(c)) { 142 return -1; 143 } 144 label_len++; 145 } else { 146 if (c != '-' && !light_isalnum(c)) { 147 return -1; 148 } 149 if (is_ip == -1) { 150 if (!light_isdigit(c)) is_ip = 0; 151 } 152 label_len++; 153 } 154 155 break; 156 case DOMAINLABEL: 157 if (is_ip == 1) { 158 if (c == '.') { 159 if (label_len == 0) { 160 return -1; 161 } 162 163 label_len = 0; 164 level++; 165 } else if (!light_isdigit(c)) { 166 return -1; 167 } else { 168 label_len++; 169 } 170 } else { 171 if (c == '.') { 172 if (label_len == 0) { 173 return -1; 174 } 175 176 /* c is either - or alphanum here */ 177 if ('-' == host->ptr[i+1]) { 178 return -1; 179 } 180 181 label_len = 0; 182 level++; 183 } else if (i == 0) { 184 if (!light_isalnum(c)) { 185 return -1; 186 } 187 label_len++; 188 } else { 189 if (c != '-' && !light_isalnum(c)) { 190 return -1; 191 } 192 label_len++; 193 } 194 } 195 196 break; 197 } 198 } 199 200 /* a IP has to consist of 4 parts */ 201 if (is_ip == 1 && level != 3) { 202 return -1; 203 } 204 205 if (label_len == 0) { 206 return -1; 207 } 208 209 return 0; 210 } 211 212 int http_request_host_normalize(buffer * const b, const int scheme_port) { 213 /* 214 * check for and canonicalize numeric IP address and portnum (optional) 215 * (IP address may be followed by ":portnum" (optional)) 216 * - IPv6: "[...]" 217 * - IPv4: "x.x.x.x" 218 * - IPv4: 12345678 (32-bit decimal number) 219 * - IPv4: 012345678 (32-bit octal number) 220 * - IPv4: 0x12345678 (32-bit hex number) 221 * 222 * allow any chars (except ':' and '\0' and stray '[' or ']') 223 * (other code may check chars more strictly or more pedantically) 224 * ':' delimits (optional) port at end of string 225 * "[]" wraps IPv6 address literal 226 * '\0' should have been rejected earlier were it present 227 * 228 * any chars includes, but is not limited to: 229 * - allow '-' any where, even at beginning of word 230 * (security caution: might be confused for cmd flag if passed to shell) 231 * - allow all-digit TLDs 232 * (might be mistaken for IPv4 addr by inet_aton() 233 * unless non-digits appear in subdomain) 234 */ 235 236 /* Note: not using getaddrinfo() since it does not support "[]" around IPv6 237 * and is not as lenient as inet_aton() and inet_addr() for IPv4 strings. 238 * Not using inet_pton() (when available) on IPv4 for similar reasons. */ 239 240 const char * const p = b->ptr; 241 const size_t blen = buffer_string_length(b); 242 long port = 0; 243 244 if (*p != '[') { 245 char * const colon = (char *)memchr(p, ':', blen); 246 if (colon) { 247 if (*p == ':') return -1; /*(empty host then port, or naked IPv6)*/ 248 if (colon[1] != '\0') { 249 char *e; 250 port = strtol(colon+1, &e, 0); /*(allow decimal, octal, hex)*/ 251 if (0 < port && port <= USHRT_MAX && *e == '\0') { 252 /* valid port */ 253 } else { 254 return -1; 255 } 256 } /*(else ignore stray colon at string end)*/ 257 buffer_string_set_length(b, (size_t)(colon - p)); /*(remove port str)*/ 258 } 259 260 if (light_isdigit(*p)) do { 261 /* (IPv4 address literal or domain starting w/ digit (e.g. 3com))*/ 262 /* (check one-element cache of normalized IPv4 address string) */ 263 static struct { char s[INET_ADDRSTRLEN]; size_t n; } laddr; 264 size_t n = colon ? (size_t)(colon - p) : blen; 265 sock_addr addr; 266 if (n == laddr.n && 0 == memcmp(p, laddr.s, n)) break; 267 if (1 == sock_addr_inet_pton(&addr, p, AF_INET, 0)) { 268 sock_addr_inet_ntop_copy_buffer(b, &addr); 269 n = buffer_string_length(b); 270 if (n < sizeof(laddr.s)) memcpy(laddr.s, b->ptr, (laddr.n = n)); 271 } 272 } while (0); 273 } else do { /* IPv6 addr */ 274 #if defined(HAVE_IPV6) && defined(HAVE_INET_PTON) 275 276 /* (check one-element cache of normalized IPv4 address string) */ 277 static struct { char s[INET6_ADDRSTRLEN]; size_t n; } laddr; 278 sock_addr addr; 279 char *bracket = b->ptr+blen-1; 280 char *percent = strchr(b->ptr+1, '%'); 281 size_t len; 282 int rc; 283 char buf[INET6_ADDRSTRLEN+16]; /*(+16 for potential %interface name)*/ 284 if (blen <= 2) return -1; /*(invalid "[]")*/ 285 if (*bracket != ']') { 286 bracket = (char *)memchr(b->ptr+1, ']', blen-1); 287 if (NULL == bracket || bracket[1] != ':' || bracket - b->ptr == 1){ 288 return -1; 289 } 290 if (bracket[2] != '\0') { /*(ignore stray colon at string end)*/ 291 char *e; 292 port = strtol(bracket+2, &e, 0); /*(allow decimal, octal, hex)*/ 293 if (0 < port && port <= USHRT_MAX && *e == '\0') { 294 /* valid port */ 295 } else { 296 return -1; 297 } 298 } 299 } 300 301 len = (size_t)((percent ? percent : bracket) - (b->ptr+1)); 302 if (laddr.n == len && 0 == memcmp(laddr.s, b->ptr+1, len)) { 303 /* truncate after ']' and re-add normalized port, if needed */ 304 buffer_string_set_length(b, (size_t)(bracket - b->ptr + 1)); 305 break; 306 } 307 308 *bracket = '\0';/*(terminate IPv6 string)*/ 309 if (percent) *percent = '\0'; /*(remove %interface from address)*/ 310 rc = sock_addr_inet_pton(&addr, b->ptr+1, AF_INET6, 0); 311 if (percent) *percent = '%'; /*(restore %interface)*/ 312 *bracket = ']'; /*(restore bracket)*/ 313 if (1 != rc) return -1; 314 315 sock_addr_inet_ntop(&addr, buf, sizeof(buf)); 316 len = strlen(buf); 317 if (percent) { 318 if (percent > bracket) return -1; 319 if (len + (size_t)(bracket - percent) >= sizeof(buf)) return -1; 320 if (len < sizeof(laddr.s)) memcpy(laddr.s, buf, (laddr.n = len)); 321 memcpy(buf+len, percent, (size_t)(bracket - percent)); 322 len += (size_t)(bracket - percent); 323 } 324 buffer_string_set_length(b, 1); /* truncate after '[' */ 325 buffer_append_string_len(b, buf, len); 326 buffer_append_string_len(b, CONST_STR_LEN("]")); 327 328 #else 329 330 return -1; 331 332 #endif 333 } while (0); 334 335 if (0 != port && port != scheme_port) { 336 buffer_append_string_len(b, CONST_STR_LEN(":")); 337 buffer_append_int(b, (int)port); 338 } 339 340 return 0; 341 } 342 343 int http_request_host_policy (buffer * const b, const unsigned int http_parseopts, const int scheme_port) { 344 return (((http_parseopts & HTTP_PARSEOPT_HOST_STRICT) 345 && 0 != request_check_hostname(b)) 346 || ((http_parseopts & HTTP_PARSEOPT_HOST_NORMALIZE) 347 && 0 != http_request_host_normalize(b, scheme_port))); 348 } 349 350 __attribute_pure__ /*(could be even more strict and use __attribute_const__)*/ 351 static int request_uri_is_valid_char(const unsigned char c) { 352 return (c > 32 && c != 127 && c != 255); 353 } 354 355 __attribute_cold__ 356 __attribute_noinline__ 357 static int http_request_header_line_invalid(request_st * const restrict r, const int status, const char * const restrict msg) { 358 if (r->conf.log_request_header_on_error) { 359 if (msg) log_error(r->conf.errh, __FILE__, __LINE__, "%s", msg); 360 } 361 return status; 362 } 363 364 __attribute_cold__ 365 __attribute_noinline__ 366 static int http_request_header_char_invalid(request_st * const restrict r, const char ch, const char * const restrict msg) { 367 if (r->conf.log_request_header_on_error) { 368 if ((unsigned char)ch > 32 && ch != 127) { 369 log_error(r->conf.errh, __FILE__, __LINE__, "%s ('%c')", msg, ch); 370 } 371 else { 372 log_error(r->conf.errh, __FILE__, __LINE__, "%s (0x%x)", msg, ch); 373 } 374 } 375 return 400; 376 } 377 378 379 static int64_t 380 li_restricted_strtoint64 (const char *v, const uint32_t vlen, const char ** const err) 381 { 382 /* base 10 strtoll() parsing exactly vlen chars and requiring digits 0-9 */ 383 /* rejects negative numbers and considers values > INT64_MAX an error */ 384 /* note: errno is not set; detect error if *err != v+vlen upon return */ 385 /*(caller must check 0 == vlen if that is to be an error for caller)*/ 386 int64_t rv = 0; 387 uint32_t i; 388 for (i = 0; i < vlen; ++i) { 389 const uint8_t c = ((uint8_t *)v)[i] - '0'; /*(unsigned; underflow ok)*/ 390 if (c > 9) break; 391 if (rv > INT64_MAX/10) break; 392 rv *= 10; 393 if (rv > INT64_MAX - c) break; 394 rv += c; 395 } 396 *err = v+i; 397 return rv; 398 } 399 400 401 /* add header to list of headers 402 * certain headers are also parsed 403 * might drop a header if deemed unnecessary/broken 404 * 405 * returns 0 on success, HTTP status on error 406 */ 407 static int http_request_parse_single_header(request_st * const restrict r, const enum http_header_e id, const char * const restrict k, const size_t klen, const char * const restrict v, const size_t vlen) { 408 buffer **saveb = NULL; 409 410 /* 411 * Note: k might not be '\0'-terminated 412 * Note: v is not '\0'-terminated 413 * With lighttpd HTTP/1.1 parser, v ends with whitespace 414 * (one of '\r' '\n' ' ' '\t') 415 * With lighttpd HTTP/2 parser, v should not be accessed beyond vlen 416 * (care must be taken to avoid libc funcs which expect z-strings) 417 */ 418 /*assert(vlen);*//*(caller must not call this func with 0 klen or 0 vlen)*/ 419 420 switch (id) { 421 /*case HTTP_HEADER_OTHER:*/ 422 default: 423 break; 424 case HTTP_HEADER_HOST: 425 if (!light_btst(r->rqst_htags, HTTP_HEADER_HOST)) { 426 saveb = &r->http_host; 427 if (vlen >= 1024) { /*(expecting < 256)*/ 428 return http_request_header_line_invalid(r, 400, "uri-authority too long -> 400"); 429 } 430 } 431 else if (NULL != r->http_host 432 && buffer_is_equal_string(r->http_host, v, vlen)) { 433 /* ignore all Host: headers if match authority in request line */ 434 return 0; /* ignore header */ 435 } 436 else { 437 return http_request_header_line_invalid(r, 400, "duplicate Host header -> 400"); 438 } 439 break; 440 case HTTP_HEADER_CONNECTION: 441 /* "Connection: close" is common case if header is present */ 442 if ((vlen == 5 && buffer_eq_icase_ssn(v, CONST_STR_LEN("close"))) 443 || http_header_str_contains_token(v,vlen,CONST_STR_LEN("close"))) { 444 r->keep_alive = 0; 445 break; 446 } 447 if (http_header_str_contains_token(v,vlen,CONST_STR_LEN("keep-alive"))){ 448 r->keep_alive = 1; 449 break; 450 } 451 break; 452 case HTTP_HEADER_CONTENT_TYPE: 453 if (light_btst(r->rqst_htags, HTTP_HEADER_CONTENT_TYPE)) { 454 return http_request_header_line_invalid(r, 400, "duplicate Content-Type header -> 400"); 455 } 456 break; 457 case HTTP_HEADER_IF_NONE_MATCH: 458 /* if dup, only the first one will survive */ 459 if (light_btst(r->rqst_htags, HTTP_HEADER_IF_NONE_MATCH)) { 460 return 0; /* ignore header */ 461 } 462 break; 463 case HTTP_HEADER_CONTENT_LENGTH: 464 if (!light_btst(r->rqst_htags, HTTP_HEADER_CONTENT_LENGTH)) { 465 /*(trailing whitespace was removed from vlen)*/ 466 /*(not using strtoll() since v might not be z-string)*/ 467 const char *err; 468 off_t clen = (off_t)li_restricted_strtoint64(v, vlen, &err); 469 if (err == v+vlen) { 470 /* (set only if not set to -1 by Transfer-Encoding: chunked) */ 471 if (0 == r->reqbody_length) r->reqbody_length = clen; 472 } 473 else { 474 return http_request_header_line_invalid(r, 400, "invalid Content-Length header -> 400"); 475 } 476 } 477 else { 478 return http_request_header_line_invalid(r, 400, "duplicate Content-Length header -> 400"); 479 } 480 break; 481 case HTTP_HEADER_HTTP2_SETTINGS: 482 if (light_btst(r->rqst_htags, HTTP_HEADER_HTTP2_SETTINGS)) { 483 return http_request_header_line_invalid(r, 400, "duplicate HTTP2-Settings header -> 400"); 484 } 485 break; 486 case HTTP_HEADER_IF_MODIFIED_SINCE: 487 if (light_btst(r->rqst_htags, HTTP_HEADER_IF_MODIFIED_SINCE)) { 488 /* Proxies sometimes send dup headers 489 * if they are the same we ignore the second 490 * if not, we raise an error */ 491 const buffer *vb = 492 http_header_request_get(r, HTTP_HEADER_IF_MODIFIED_SINCE, 493 CONST_STR_LEN("If-Modified-Since")); 494 if (vb && buffer_is_equal_caseless_string(vb, v, vlen)) { 495 /* ignore it if they are the same */ 496 return 0; /* ignore header */ 497 } 498 else { 499 return http_request_header_line_invalid(r, 400, "duplicate If-Modified-Since header -> 400"); 500 } 501 } 502 break; 503 case HTTP_HEADER_TRANSFER_ENCODING: 504 if (HTTP_VERSION_1_1 != r->http_version) { 505 return http_request_header_line_invalid(r, 400, 506 HTTP_VERSION_1_0 == r->http_version 507 ? "HTTP/1.0 with Transfer-Encoding (bad HTTP/1.0 proxy?) -> 400" 508 : "HTTP/2 with Transfer-Encoding is invalid -> 400"); 509 } 510 511 if (!buffer_eq_icase_ss(v, vlen, CONST_STR_LEN("chunked"))) { 512 /* Transfer-Encoding might contain additional encodings, 513 * which are not currently supported by lighttpd */ 514 return http_request_header_line_invalid(r, 501, NULL); /* Not Implemented */ 515 } 516 r->reqbody_length = -1; 517 518 /* Transfer-Encoding is a hop-by-hop header, 519 * which must not be blindly forwarded to backends */ 520 return 0; /* skip header */ 521 } 522 523 http_header_request_append(r, id, k, klen, v, vlen); 524 525 if (saveb) { 526 *saveb = http_header_request_get(r, id, k, klen); 527 } 528 529 return 0; 530 } 531 532 __attribute_cold__ 533 static int http_request_parse_proto_loose(request_st * const restrict r, const char * const restrict ptr, const size_t len, const unsigned int http_parseopts) { 534 const char * proto = memchr(ptr, ' ', len); 535 if (NULL == proto) 536 return http_request_header_line_invalid(r, 400, "incomplete request line -> 400"); 537 proto = memchr(proto+1, ' ', len - (proto+1 - ptr)); 538 if (NULL == proto) 539 return http_request_header_line_invalid(r, 400, "incomplete request line -> 400"); 540 ++proto; 541 542 if (proto[0]=='H' && proto[1]=='T' && proto[2]=='T' && proto[3]=='P' && proto[4] == '/') { 543 if (proto[5] == '1' && proto[6] == '.' && (proto[7] == '1' || proto[7] == '0')) { 544 /* length already checked before calling this routine */ 545 /* (len != (size_t)(proto - ptr + 8)) */ 546 if (http_parseopts & HTTP_PARSEOPT_HEADER_STRICT) /*(http_header_strict)*/ 547 return http_request_header_line_invalid(r, 400, "incomplete request line -> 400"); 548 r->http_version = (proto[7] == '1') ? HTTP_VERSION_1_1 : HTTP_VERSION_1_0; 549 } 550 else 551 return http_request_header_line_invalid(r, 505, "unknown HTTP version -> 505"); 552 } 553 else 554 return http_request_header_line_invalid(r, 400, "unknown protocol -> 400"); 555 556 /* keep-alive default: HTTP/1.1 -> true; HTTP/1.0 -> false */ 557 r->keep_alive = (HTTP_VERSION_1_0 != r->http_version); 558 559 return 0; 560 } 561 562 __attribute_cold__ 563 static const char * http_request_parse_reqline_uri(request_st * const restrict r, const char * const restrict uri, const size_t len, const unsigned int http_parseopts) { 564 const char *nuri; 565 if ((len > 7 && buffer_eq_icase_ssn(uri, "http://", 7) 566 && NULL != (nuri = memchr(uri + 7, '/', len-7))) 567 || 568 (len > 8 && buffer_eq_icase_ssn(uri, "https://", 8) 569 && NULL != (nuri = memchr(uri + 8, '/', len-8)))) { 570 const char * const host = uri + (uri[4] == ':' ? 7 : 8); 571 const size_t hostlen = nuri - host; 572 if (0 == hostlen || hostlen >= 1024) { /*(expecting < 256)*/ 573 http_request_header_line_invalid(r, 400, "uri-authority empty or too long -> 400"); 574 return NULL; 575 } 576 /* Insert as host header */ 577 http_header_request_set(r, HTTP_HEADER_HOST, CONST_STR_LEN("Host"), host, hostlen); 578 r->http_host = http_header_request_get(r, HTTP_HEADER_HOST, CONST_STR_LEN("Host")); 579 return nuri; 580 } else if (!(http_parseopts & HTTP_PARSEOPT_HEADER_STRICT) /*(!http_header_strict)*/ 581 || (HTTP_METHOD_CONNECT == r->http_method && (uri[0] == ':' || light_isdigit(uri[0]))) 582 || (HTTP_METHOD_OPTIONS == r->http_method && uri[0] == '*' && 1 == len)) { 583 /* (permitted) */ 584 return uri; 585 } else { 586 http_request_header_line_invalid(r, 400, "request-URI parse error -> 400"); 587 return NULL; 588 } 589 } 590 591 592 __attribute_cold__ 593 __attribute_noinline__ 594 static int http_request_parse_header_other(request_st * const restrict r, const char * const restrict k, const int klen, const unsigned int http_header_strict); 595 596 597 int 598 http_request_validate_pseudohdrs (request_st * const restrict r, const int scheme, const unsigned int http_parseopts) 599 { 600 /* :method is required to indicate method 601 * CONNECT method must have :method and :authority 602 * All other methods must have at least :method :scheme :path */ 603 604 if (HTTP_METHOD_UNSET == r->http_method) 605 return http_request_header_line_invalid(r, 400, 606 "missing pseudo-header method -> 400"); 607 608 if (HTTP_METHOD_CONNECT != r->http_method) { 609 if (!scheme) 610 return http_request_header_line_invalid(r, 400, 611 "missing pseudo-header scheme -> 400"); 612 613 if (buffer_string_is_empty(&r->target)) 614 return http_request_header_line_invalid(r, 400, 615 "missing pseudo-header path -> 400"); 616 617 const char * const uri = r->target.ptr; 618 if (*uri != '/') { /* (common case: (*uri == '/')) */ 619 if (uri[0] != '*' || uri[1] != '\0' 620 || HTTP_METHOD_OPTIONS != r->http_method) 621 return http_request_header_line_invalid(r, 400, 622 "invalid pseudo-header path -> 400"); 623 } 624 } 625 else { /* HTTP_METHOD_CONNECT */ 626 if (NULL == r->http_host) 627 return http_request_header_line_invalid(r, 400, 628 "missing pseudo-header authority -> 400"); 629 if (!buffer_string_is_empty(&r->target) || scheme) 630 return http_request_header_line_invalid(r, 400, 631 "invalid pseudo-header with CONNECT -> 400"); 632 /*(reuse uri and ulen to assign to r->target)*/ 633 buffer_copy_buffer(&r->target, r->http_host); 634 } 635 buffer_copy_buffer(&r->target_orig, &r->target); 636 637 /* r->http_host, if set, is checked with http_request_host_policy() 638 * in http_request_parse() */ 639 640 /* copied and modified from end of http_request_parse_reqline() */ 641 642 /* check uri for invalid characters */ 643 const unsigned int http_header_strict = 644 (http_parseopts & HTTP_PARSEOPT_HEADER_STRICT); 645 if (http_header_strict 646 && (http_parseopts & HTTP_PARSEOPT_URL_NORMALIZE_CTRLS_REJECT)) 647 return 0; /* URI will be checked in http_request_parse_target() */ 648 649 const uint32_t ulen = buffer_string_length(&r->target); 650 const uint8_t * const uri = (uint8_t *)r->target.ptr; 651 if (http_header_strict) { 652 for (uint32_t i = 0; i < ulen; ++i) { 653 if (!request_uri_is_valid_char(uri[i])) 654 return http_request_header_char_invalid(r, uri[i], 655 "invalid character in URI -> 400"); 656 } 657 } 658 else { 659 if (NULL != memchr(uri, '\0', ulen)) 660 return http_request_header_char_invalid(r, '\0', 661 "invalid character in header -> 400"); 662 } 663 664 return 0; 665 } 666 667 668 int 669 http_request_parse_header (request_st * const restrict r, http_header_parse_ctx * const restrict hpctx) 670 { 671 /* Note: k and v might not be '\0' terminated strings; 672 * care must be taken to avoid libc funcs which expect z-strings */ 673 const char * const restrict k = hpctx->k; 674 const char * const restrict v = hpctx->v; 675 const uint32_t klen = hpctx->klen; 676 const uint32_t vlen = hpctx->vlen; 677 678 if (0 == klen) 679 return http_request_header_line_invalid(r, 400, 680 "invalid header key -> 400"); 681 if (0 == vlen) 682 return http_request_header_line_invalid(r, 400, 683 "invalid header value -> 400"); 684 685 if ((hpctx->hlen += klen + vlen + 4) > hpctx->max_request_field_size) { 686 /*(configurable with server.max-request-field-size; default 8k)*/ 687 #if 1 /* emit to error log for people sending large headers */ 688 log_error(r->conf.errh, __FILE__, __LINE__, 689 "oversized request header -> 431"); 690 return 431; /* Request Header Fields Too Large */ 691 #else 692 /* 431 Request Header Fields Too Large */ 693 return http_request_header_line_invalid(r, 431, 694 "oversized request header -> 431"); 695 #endif 696 } 697 698 if (2 == klen && k[0] == 't' && k[1] == 'e' 699 && !buffer_eq_icase_ss(v, vlen, CONST_STR_LEN("trailers"))) 700 return http_request_header_line_invalid(r, 400, 701 "invalid TE header value with HTTP/2 -> 400"); 702 703 if (!hpctx->trailers) { 704 if (*k == ':') { 705 /* HTTP/2 request pseudo-header fields */ 706 if (!hpctx->pseudo) /*(pseudo header after non-pseudo header)*/ 707 return http_request_header_line_invalid(r, 400, 708 "invalid pseudo-header -> 400"); 709 switch (klen-1) { 710 case 4: 711 if (0 == memcmp(k+1, "path", 4)) { 712 if (!buffer_string_is_empty(&r->target)) 713 return http_request_header_line_invalid(r, 400, 714 "repeated pseudo-header -> 400"); 715 buffer_copy_string_len(&r->target, v, vlen); 716 return 0; 717 } 718 break; 719 case 6: 720 if (0 == memcmp(k+1, "method", 6)) { 721 if (HTTP_METHOD_UNSET != r->http_method) 722 return http_request_header_line_invalid(r, 400, 723 "repeated pseudo-header -> 400"); 724 r->http_method = get_http_method_key(v, vlen); 725 if (HTTP_METHOD_UNSET >= r->http_method) 726 return http_request_header_line_invalid(r, 501, 727 "unknown http-method -> 501"); 728 return 0; 729 } 730 else if (0 == memcmp(k+1, "scheme", 6)) { 731 if (hpctx->scheme) 732 return http_request_header_line_invalid(r, 400, 733 "repeated pseudo-header -> 400"); 734 switch (vlen) {/*(validated, but then ignored)*/ 735 case 5: /* "https" */ 736 if (v[4]!='s') break; 737 __attribute_fallthrough__ 738 case 4: /* "http" */ 739 if (v[0]=='h' && v[1]=='t' && v[2]=='t' && v[3]=='p') { 740 hpctx->scheme = 1; 741 return 0; 742 } 743 break; 744 default: 745 break; 746 } 747 return http_request_header_line_invalid(r, 400, 748 "unknown pseudo-header scheme -> 400"); 749 } 750 break; 751 case 9: 752 if (0 == memcmp(k+1, "authority", 9)) { 753 if (r->http_host) 754 return http_request_header_line_invalid(r, 400, 755 "repeated pseudo-header -> 400"); 756 if (vlen >= 1024) /*(expecting < 256)*/ 757 return http_request_header_line_invalid(r, 400, 758 "invalid pseudo-header authority too long -> 400"); 759 /* insert as host header */ 760 http_header_request_set(r, HTTP_HEADER_HOST, 761 CONST_STR_LEN("host"), v, vlen); 762 r->http_host = 763 http_header_request_get(r, HTTP_HEADER_HOST, 764 CONST_STR_LEN("Host")); 765 return 0; 766 } 767 break; 768 default: 769 break; 770 } 771 return http_request_header_line_invalid(r, 400, 772 "invalid pseudo-header -> 400"); 773 } 774 else { /*(non-pseudo headers)*/ 775 if (hpctx->pseudo) { /*(transition to non-pseudo headers)*/ 776 hpctx->pseudo = 0; 777 int status = 778 http_request_validate_pseudohdrs(r, hpctx->scheme, 779 hpctx->http_parseopts); 780 if (0 != status) return status; 781 } 782 783 const unsigned int http_header_strict = 784 (hpctx->http_parseopts & HTTP_PARSEOPT_HEADER_STRICT); 785 786 for (uint32_t j = 0; j < klen; ++j) { 787 if (light_islower(k[j]) || k[j] == '-') 788 continue; /*(common cases)*/ 789 if (light_isupper(k[j])) 790 return 400; 791 if (0 != http_request_parse_header_other(r, k+j, klen-j, 792 http_header_strict)) 793 return 400; 794 break; 795 } 796 797 if (http_header_strict) { 798 for (uint32_t j = 0; j < vlen; ++j) { 799 if ((((uint8_t *)v)[j] < 32 && v[j] != '\t') || v[j]==127) 800 return http_request_header_char_invalid(r, v[j], 801 "invalid character in header -> 400"); 802 } 803 } 804 else { 805 if (NULL != memchr(v, '\0', vlen)) 806 return http_request_header_char_invalid(r, '\0', 807 "invalid character in header -> 400"); 808 } 809 810 const enum http_header_e id = 811 hpctx->id ? hpctx->id : http_header_hkey_get_lc(k, klen); 812 return http_request_parse_single_header(r, id, k, klen, v, vlen); 813 } 814 } 815 else { /*(trailers)*/ 816 /* ignore trailers (after required HPACK decoding) if streaming 817 * request body to backend since headers have already been sent 818 * to backend via Common Gateway Interface (CGI) (CGI, FastCGI, 819 * SCGI, etc) or HTTP/1.1 (proxy) (mod_proxy does not currently 820 * support using HTTP/2 to connect to backends) */ 821 #if 0 /* (if needed, save flag in hpctx instead of fdevent.h dependency)*/ 822 if (r->conf.stream_request_body & FDEVENT_STREAM_REQUEST) 823 return 0; 824 #endif 825 /* Note: do not unconditionally merge into headers since if 826 * headers had already been sent to backend, then mod_accesslog 827 * logging of request headers might be inaccurate. 828 * Many simple backends do not support HTTP/1.1 requests sending 829 * Transfer-Encoding: chunked, and even those that do might not 830 * handle trailers. Some backends do not even support HTTP/1.1. 831 * For all these reasons, ignore trailers if streaming request 832 * body to backend. Revisit in future if adding support for 833 * connecting to backends using HTTP/2 (with explicit config 834 * option to force connecting to backends using HTTP/2) */ 835 836 /* XXX: TODO: request trailers not handled if streaming reqbody 837 * XXX: must ensure that trailers are not disallowed field-names 838 */ 839 840 return 0; 841 } 842 } 843 844 845 static int http_request_parse_reqline(request_st * const restrict r, const char * const restrict ptr, const unsigned short * const restrict hoff, const unsigned int http_parseopts) { 846 size_t len = hoff[2]; 847 848 /* parse the first line of the request 849 * <method> <uri> <protocol>\r\n 850 * */ 851 if (len < 13) /* minimum len with (!http_header_strict): "x x HTTP/1.0\n" */ 852 return http_request_header_line_invalid(r, 400, "invalid request line (too short) -> 400"); 853 if (ptr[len-2] == '\r') 854 len-=2; 855 else if (!(http_parseopts & HTTP_PARSEOPT_HEADER_STRICT)) /*(!http_header_strict)*/ 856 len-=1; 857 else 858 return http_request_header_line_invalid(r, 400, "missing CR before LF in header -> 400"); 859 860 /* 861 * RFC7230: 862 * HTTP-version = HTTP-name "/" DIGIT "." DIGIT 863 * HTTP-name = %x48.54.54.50 ; "HTTP", case-sensitive 864 */ 865 866 /* protocol is expected to be " HTTP/1.1" or " HTTP/1.0" at end of line */ 867 union proto_un { 868 char c[8]; 869 uint64_t u; 870 }; 871 static const union proto_un http_1_1 = {{'H','T','T','P','/','1','.','1'}}; 872 static const union proto_un http_1_0 = {{'H','T','T','P','/','1','.','0'}}; 873 const char *p = ptr + len - 8; 874 union proto_un proto8; 875 proto8.c[0]=p[0]; proto8.c[1]=p[1]; proto8.c[2]=p[2]; proto8.c[3]=p[3]; 876 proto8.c[4]=p[4]; proto8.c[5]=p[5]; proto8.c[6]=p[6]; proto8.c[7]=p[7]; 877 if (p[-1] == ' ' && http_1_1.u == proto8.u) { 878 r->http_version = HTTP_VERSION_1_1; 879 r->keep_alive = 1; /* keep-alive default: HTTP/1.1 -> true */ 880 } 881 else if (p[-1] == ' ' && http_1_0.u == proto8.u) { 882 r->http_version = HTTP_VERSION_1_0; 883 r->keep_alive = 0; /* keep-alive default: HTTP/1.0 -> false */ 884 } 885 else { 886 int status = http_request_parse_proto_loose(r,ptr,len,http_parseopts); 887 if (0 != status) return status; 888 /*(space char must exist if http_request_parse_proto_loose() succeeds)*/ 889 for (p = ptr + len - 9; p[-1] != ' '; --p) ; 890 } 891 892 /* method is expected to be a short string in the general case */ 893 size_t i = 0; 894 while (ptr[i] != ' ') ++i; 895 #if 0 /*(space must exist if protocol was parsed successfully)*/ 896 while (i < len && ptr[i] != ' ') ++i; 897 if (ptr[i] != ' ') 898 return http_request_header_line_invalid(r, 400, "incomplete request line -> 400"); 899 #endif 900 901 r->http_method = get_http_method_key(ptr, i); 902 if (HTTP_METHOD_UNSET >= r->http_method) 903 return http_request_header_line_invalid(r, 501, "unknown http-method -> 501"); 904 905 const char *uri = ptr + i + 1; 906 907 if (uri == p) 908 return http_request_header_line_invalid(r, 400, "no uri specified -> 400"); 909 len = (size_t)(p - uri - 1); 910 911 if (*uri != '/') { /* (common case: (*uri == '/')) */ 912 uri = http_request_parse_reqline_uri(r, uri, len, http_parseopts); 913 if (NULL == uri) return 400; 914 len = (size_t)(p - uri - 1); 915 } 916 917 if (0 == len) 918 return http_request_header_line_invalid(r, 400, "no uri specified -> 400"); 919 920 /* check uri for invalid characters */ 921 if (http_parseopts & HTTP_PARSEOPT_HEADER_STRICT) { /* http_header_strict */ 922 if ((http_parseopts & HTTP_PARSEOPT_URL_NORMALIZE_CTRLS_REJECT)) { 923 /* URI will be checked in http_request_parse_target() */ 924 } 925 else { 926 for (i = 0; i < len; ++i) { 927 if (!request_uri_is_valid_char(uri[i])) 928 return http_request_header_char_invalid(r, uri[i], "invalid character in URI -> 400"); 929 } 930 } 931 } 932 else { 933 /* check entire set of request headers for '\0' */ 934 if (NULL != memchr(ptr, '\0', hoff[hoff[0]])) 935 return http_request_header_char_invalid(r, '\0', "invalid character in header -> 400"); 936 } 937 938 buffer_copy_string_len(&r->target, uri, len); 939 buffer_copy_string_len(&r->target_orig, uri, len); 940 return 0; 941 } 942 943 int http_request_parse_target(request_st * const r, int scheme_port) { 944 /* URI is parsed into components at start of request and may 945 * also be re-parsed upon HANDLER_COMEBACK during the request 946 * r->target is expected to be a "/url-part?query-part" 947 * (and *not* a fully-qualified URI starting https://...) 948 * r->uri.authority is expected to be parsed elsewhere into r->http_host 949 */ 950 951 /** 952 * prepare strings 953 * 954 * - uri.path 955 * - uri.query 956 * 957 */ 958 959 /** 960 * Name according to RFC 2396 961 * 962 * - scheme 963 * - authority 964 * - path 965 * - query 966 * 967 * (scheme)://(authority)(path)?(query)#fragment 968 * 969 */ 970 971 /* take initial scheme value from connection-level state 972 * (request r->uri.scheme can be overwritten for later, 973 * for example by mod_extforward or mod_magnet) */ 974 if (scheme_port == 443) 975 buffer_copy_string_len(&r->uri.scheme, CONST_STR_LEN("https")); 976 else 977 buffer_copy_string_len(&r->uri.scheme, CONST_STR_LEN("http")); 978 979 buffer * const target = &r->target; 980 if (r->http_method == HTTP_METHOD_CONNECT 981 || (r->http_method == HTTP_METHOD_OPTIONS 982 && target->ptr[0] == '*' 983 && target->ptr[1] == '\0')) { 984 /* CONNECT ... (or) OPTIONS * ... */ 985 buffer_copy_buffer(&r->uri.path, target); 986 buffer_clear(&r->uri.query); 987 return 0; 988 } 989 990 char *qstr; 991 if (r->conf.http_parseopts & HTTP_PARSEOPT_URL_NORMALIZE) { 992 /*uint32_t len = (uint32_t)buffer_string_length(target);*/ 993 int qs = burl_normalize(target, r->tmp_buf, r->conf.http_parseopts); 994 if (-2 == qs) 995 return http_request_header_line_invalid(r, 400, 996 "invalid character in URI -> 400"); /* Bad Request */ 997 qstr = (-1 == qs) ? NULL : target->ptr+qs; 998 #if 0 /* future: might enable here, or below for all requests */ 999 /* (Note: total header size not recalculated on HANDLER_COMEBACK 1000 * even if other request headers changed during processing) 1001 * (If (0 != r->loops_per_request), then the generated 1002 * request is too large. Should a different error be returned?) */ 1003 r->rqst_header_len -= len; 1004 len = buffer_string_length(target); 1005 r->rqst_header_len += len; 1006 if (len > MAX_HTTP_REQUEST_URI) { 1007 return 414; /* 414 URI Too Long */ 1008 } 1009 if (r->rqst_header_len > MAX_HTTP_REQUEST_HEADER) { 1010 log_error(r->conf.errh, __FILE__, __LINE__, 1011 "request header fields too large: %u -> 431", 1012 r->rqst_header_len); 1013 return 431; /* Request Header Fields Too Large */ 1014 } 1015 #endif 1016 } 1017 else { 1018 size_t rlen = buffer_string_length(target); 1019 qstr = memchr(target->ptr, '#', rlen);/* discard fragment */ 1020 if (qstr) { 1021 rlen = (size_t)(qstr - target->ptr); 1022 buffer_string_set_length(target, rlen); 1023 } 1024 qstr = memchr(target->ptr, '?', rlen); 1025 } 1026 1027 /** extract query string from target */ 1028 const char * const pstr = target->ptr; 1029 const uint32_t rlen = buffer_string_length(target); 1030 uint32_t plen; 1031 if (NULL != qstr) { 1032 plen = (uint32_t)(qstr - pstr); 1033 buffer_copy_string_len(&r->uri.query, qstr + 1, rlen - plen - 1); 1034 } 1035 else { 1036 plen = rlen; 1037 buffer_clear(&r->uri.query); 1038 } 1039 buffer_copy_string_len(&r->uri.path, pstr, plen); 1040 1041 /* decode url to path 1042 * 1043 * - decode url-encodings (e.g. %20 -> ' ') 1044 * - remove path-modifiers (e.g. /../) 1045 */ 1046 1047 buffer_urldecode_path(&r->uri.path); 1048 buffer_path_simplify(&r->uri.path, &r->uri.path); 1049 if (r->uri.path.ptr[0] != '/') 1050 return http_request_header_line_invalid(r, 400, 1051 "uri-path does not begin with '/' -> 400"); /* Bad Request */ 1052 1053 return 0; 1054 } 1055 1056 __attribute_cold__ 1057 __attribute_noinline__ 1058 static int http_request_parse_header_other(request_st * const restrict r, const char * const restrict k, const int klen, const unsigned int http_header_strict) { 1059 for (int i = 0; i < klen; ++i) { 1060 if (light_isalpha(k[i]) || k[i] == '-') continue; /*(common cases)*/ 1061 /** 1062 * 1*<any CHAR except CTLs or separators> 1063 * CTLs == 0-31 + 127, CHAR = 7-bit ascii (0..127) 1064 * 1065 */ 1066 switch(k[i]) { 1067 case ' ': 1068 case '\t': 1069 return http_request_header_line_invalid(r, 400, "WS character in key -> 400"); 1070 case '(': 1071 case ')': 1072 case '<': 1073 case '>': 1074 case '@': 1075 case ',': 1076 case ';': 1077 case '\\': 1078 case '\"': 1079 case '/': 1080 case '[': 1081 case ']': 1082 case '?': 1083 case '=': 1084 case '{': 1085 case '}': 1086 return http_request_header_char_invalid(r, k[i], "invalid character in header key -> 400"); 1087 default: 1088 if (http_header_strict ? (k[i] < 32 || ((unsigned char *)k)[i] >= 127) : k[i] == '\0') 1089 return http_request_header_char_invalid(r, k[i], "invalid character in header key -> 400"); 1090 break; /* ok */ 1091 } 1092 } 1093 return 0; 1094 } 1095 1096 static int http_request_parse_headers(request_st * const restrict r, char * const restrict ptr, const unsigned short * const restrict hoff, const unsigned int http_parseopts) { 1097 const unsigned int http_header_strict = (http_parseopts & HTTP_PARSEOPT_HEADER_STRICT); 1098 1099 #if 0 /*(not checked here; will later result in invalid label for HTTP header)*/ 1100 int i = hoff[2]; 1101 1102 if (ptr[i] == ' ' || ptr[i] == '\t') { 1103 return http_request_header_line_invalid(r, 400, "WS at the start of first line -> 400"); 1104 } 1105 #endif 1106 1107 for (int i = 2; i < hoff[0]; ++i) { 1108 const char *k = ptr + hoff[i]; 1109 /* one past last line hoff[hoff[0]] is to final "\r\n" */ 1110 char *end = ptr + hoff[i+1]; 1111 1112 const char *colon = memchr(k, ':', end - k); 1113 if (NULL == colon) 1114 return http_request_header_line_invalid(r, 400, "invalid header missing ':' -> 400"); 1115 1116 const char *v = colon + 1; 1117 1118 /* RFC7230 Hypertext Transfer Protocol (HTTP/1.1): Message Syntax and Routing 1119 * 3.2.4. Field Parsing 1120 * [...] 1121 * No whitespace is allowed between the header field-name and colon. In 1122 * the past, differences in the handling of such whitespace have led to 1123 * security vulnerabilities in request routing and response handling. A 1124 * server MUST reject any received request message that contains 1125 * whitespace between a header field-name and colon with a response code 1126 * of 400 (Bad Request). A proxy MUST remove any such whitespace from a 1127 * response message before forwarding the message downstream. 1128 */ 1129 /* (line k[-1] is always preceded by a '\n', 1130 * including first header after request-line, 1131 * so no need to check colon != k) */ 1132 if (colon[-1] == ' ' || colon[-1] == '\t') { 1133 if (http_header_strict) { 1134 return http_request_header_line_invalid(r, 400, "invalid whitespace between field-name and colon -> 400"); 1135 } 1136 else { 1137 /* remove trailing whitespace from key(if !http_header_strict)*/ 1138 do { --colon; } while (colon[-1] == ' ' || colon[-1] == '\t'); 1139 } 1140 } 1141 1142 const int klen = (int)(colon - k); 1143 if (0 == klen) 1144 return http_request_header_line_invalid(r, 400, "invalid header key -> 400"); 1145 const enum http_header_e id = http_header_hkey_get(k, klen); 1146 1147 if (id == HTTP_HEADER_OTHER) { 1148 for (int j = 0; j < klen; ++j) { 1149 if (light_isalpha(k[j]) || k[j] == '-') continue; /*(common cases)*/ 1150 if (0 != http_request_parse_header_other(r, k+j, klen-j, http_header_strict)) 1151 return 400; 1152 break; 1153 } 1154 } 1155 1156 /* remove leading whitespace from value */ 1157 while (*v == ' ' || *v == '\t') ++v; 1158 1159 for (; i+1 <= hoff[0]; ++i) { 1160 end = ptr + hoff[i+1]; 1161 if (end[0] != ' ' && end[0] != '\t') break; 1162 1163 /* line folding */ 1164 #ifdef __COVERITY__ 1165 force_assert(end - k >= 2); 1166 #endif 1167 if (end[-2] == '\r') 1168 end[-2] = ' '; 1169 else if (http_header_strict) 1170 return http_request_header_line_invalid(r, 400, "missing CR before LF in header -> 400"); 1171 end[-1] = ' '; 1172 } 1173 #ifdef __COVERITY__ 1174 /*(buf holding k has non-zero request-line, so end[-2] valid)*/ 1175 force_assert(end >= k + 2); 1176 #endif 1177 if (end[-2] == '\r') 1178 --end; 1179 else if (http_header_strict) 1180 return http_request_header_line_invalid(r, 400, "missing CR before LF in header -> 400"); 1181 /* remove trailing whitespace from value (+ remove '\r\n') */ 1182 /* (line k[-1] is always preceded by a '\n', 1183 * including first header after request-line, 1184 * so no need to check (end != k)) */ 1185 do { --end; } while (end[-1] == ' ' || end[-1] == '\t'); 1186 1187 const int vlen = (int)(end - v); 1188 /* empty header-fields are not allowed by HTTP-RFC, we just ignore them */ 1189 if (vlen <= 0) continue; /* ignore header */ 1190 1191 if (http_header_strict) { 1192 for (int j = 0; j < vlen; ++j) { 1193 if ((((unsigned char *)v)[j] < 32 && v[j] != '\t') || v[j]==127) 1194 return http_request_header_char_invalid(r, v[j], "invalid character in header -> 400"); 1195 } 1196 } /* else URI already checked in http_request_parse_reqline() for any '\0' */ 1197 1198 int status = http_request_parse_single_header(r, id, k, (size_t)klen, v, (size_t)vlen); 1199 if (0 != status) return status; 1200 } 1201 1202 return 0; 1203 } 1204 1205 1206 static int 1207 http_request_parse (request_st * const restrict r, const int scheme_port) 1208 { 1209 int status = http_request_parse_target(r, scheme_port); 1210 if (0 != status) return status; 1211 1212 /*(r->http_host might not be set until after parsing request headers)*/ 1213 buffer_copy_buffer(&r->uri.authority, r->http_host);/*(copy even if empty)*/ 1214 buffer_to_lower(&r->uri.authority); 1215 1216 /* post-processing */ 1217 const unsigned int http_parseopts = r->conf.http_parseopts; 1218 1219 /* check hostname field if it is set */ 1220 if (r->http_host) { 1221 if (0 != http_request_host_policy(r->http_host, 1222 http_parseopts, scheme_port)) 1223 return http_request_header_line_invalid(r, 400, "Invalid Hostname -> 400"); 1224 } 1225 else { 1226 if (r->http_version >= HTTP_VERSION_1_1) 1227 return http_request_header_line_invalid(r, 400, "HTTP/1.1 but Host missing -> 400"); 1228 } 1229 1230 if (0 == r->reqbody_length) { 1231 /* POST requires Content-Length (or Transfer-Encoding) 1232 * (-1 == r->reqbody_length when Transfer-Encoding: chunked)*/ 1233 if (HTTP_METHOD_POST == r->http_method 1234 && !light_btst(r->rqst_htags, HTTP_HEADER_CONTENT_LENGTH)) { 1235 return http_request_header_line_invalid(r, 411, "POST-request, but content-length missing -> 411"); 1236 } 1237 } 1238 else { 1239 /* (-1 == r->reqbody_length when Transfer-Encoding: chunked)*/ 1240 if (-1 == r->reqbody_length 1241 && light_btst(r->rqst_htags, HTTP_HEADER_CONTENT_LENGTH)) { 1242 /* RFC7230 Hypertext Transfer Protocol (HTTP/1.1): Message Syntax and Routing 1243 * 3.3.3. Message Body Length 1244 * [...] 1245 * If a message is received with both a Transfer-Encoding and a 1246 * Content-Length header field, the Transfer-Encoding overrides the 1247 * Content-Length. Such a message might indicate an attempt to 1248 * perform request smuggling (Section 9.5) or response splitting 1249 * (Section 9.4) and ought to be handled as an error. A sender MUST 1250 * remove the received Content-Length field prior to forwarding such 1251 * a message downstream. 1252 */ 1253 const unsigned int http_header_strict = 1254 (http_parseopts & HTTP_PARSEOPT_HEADER_STRICT); 1255 if (http_header_strict) { 1256 return http_request_header_line_invalid(r, 400, "invalid Transfer-Encoding + Content-Length -> 400"); 1257 } 1258 else { 1259 /* ignore Content-Length */ 1260 http_header_request_unset(r, HTTP_HEADER_CONTENT_LENGTH, CONST_STR_LEN("Content-Length")); 1261 } 1262 } 1263 if (http_method_get_or_head(r->http_method) 1264 && !(http_parseopts & HTTP_PARSEOPT_METHOD_GET_BODY)) { 1265 return http_request_header_line_invalid(r, 400, "GET/HEAD with content-length -> 400"); 1266 } 1267 } 1268 1269 return 0; 1270 } 1271 1272 1273 static int 1274 http_request_parse_hoff (request_st * const restrict r, char * const restrict hdrs, const unsigned short * const restrict hoff, const int scheme_port) 1275 { 1276 /* 1277 * Request: "^(GET|POST|HEAD|...) ([^ ]+(\\?[^ ]+|)) (HTTP/1\\.[01])$" 1278 * Header : "^([-a-zA-Z]+): (.+)$" 1279 * End : "^$" 1280 */ 1281 1282 int status; 1283 const unsigned int http_parseopts = r->conf.http_parseopts; 1284 1285 status = http_request_parse_reqline(r, hdrs, hoff, http_parseopts); 1286 if (0 != status) return status; 1287 1288 status = http_request_parse_headers(r, hdrs, hoff, http_parseopts); 1289 if (0 != status) return status; 1290 1291 return http_request_parse(r, scheme_port); 1292 } 1293 1294 1295 static void 1296 http_request_headers_fin (request_st * const restrict r) 1297 { 1298 if (0 == r->http_status) { 1299 #if 0 1300 r->conditional_is_valid = (1 << COMP_SERVER_SOCKET) 1301 | (1 << COMP_HTTP_SCHEME) 1302 | (1 << COMP_HTTP_HOST) 1303 | (1 << COMP_HTTP_REMOTE_IP) 1304 | (1 << COMP_HTTP_REQUEST_METHOD) 1305 | (1 << COMP_HTTP_URL) 1306 | (1 << COMP_HTTP_QUERY_STRING) 1307 | (1 << COMP_HTTP_REQUEST_HEADER); 1308 #else 1309 /* all config conditions are valid after parsing header 1310 * (set all bits; remove dependency on plugin_config.h) */ 1311 r->conditional_is_valid = ~0u; 1312 #endif 1313 } 1314 else { 1315 r->keep_alive = 0; 1316 r->reqbody_length = 0; 1317 } 1318 } 1319 1320 1321 void 1322 http_request_headers_process (request_st * const restrict r, char * const restrict hdrs, const unsigned short * const restrict hoff, const int scheme_port) 1323 { 1324 r->http_status = http_request_parse_hoff(r, hdrs, hoff, scheme_port); 1325 1326 http_request_headers_fin(r); 1327 1328 if (0 != r->http_status) { 1329 if (r->conf.log_request_header_on_error) { 1330 /*(http_request_parse_headers() modifies hdrs only to 1331 * undo line-wrapping in-place using spaces)*/ 1332 log_error(r->conf.errh, __FILE__, __LINE__, 1333 "request-header:\n%.*s", (int)r->rqst_header_len, hdrs); 1334 } 1335 } 1336 } 1337 1338 1339 void 1340 http_request_headers_process_h2 (request_st * const restrict r, const int scheme_port) 1341 { 1342 if (0 == r->http_status) 1343 r->http_status = http_request_parse(r, scheme_port); 1344 1345 if (0 == r->http_status) { 1346 if (light_btst(r->rqst_htags, HTTP_HEADER_CONNECTION)) 1347 r->http_status = http_request_header_line_invalid(r, 400, 1348 "invalid Connection header with HTTP/2 -> 400"); 1349 } 1350 1351 http_request_headers_fin(r); 1352 1353 /* limited; headers not collected into a single buf for HTTP/2 */ 1354 if (__builtin_expect( (0 != r->http_status), 0)) { 1355 if (r->conf.log_request_header_on_error) { 1356 log_error(r->conf.errh, __FILE__, __LINE__, 1357 "request-header:\n:authority: %s\n:method: %s\n:path: %s", 1358 r->http_host ? r->http_host->ptr : "", 1359 (HTTP_METHOD_UNSET != r->http_method) 1360 ? get_http_method_name(r->http_method) 1361 : "", 1362 !buffer_string_is_empty(&r->target) ? r->target.ptr : ""); 1363 } 1364 } 1365 1366 /* ignore Upgrade if using HTTP/2 */ 1367 if (light_btst(r->rqst_htags, HTTP_HEADER_UPGRADE)) 1368 http_header_request_unset(r, HTTP_HEADER_UPGRADE, 1369 CONST_STR_LEN("upgrade")); 1370 /* XXX: should filter out other hop-by-hop connection headers, too */ 1371 } 1372