1 #include "first.h" 2 3 #include "response.h" 4 #include "request.h" 5 #include "base.h" 6 #include "fdevent.h" 7 #include "http_header.h" 8 #include "http_kv.h" 9 #include "log.h" 10 #include "stat_cache.h" 11 #include "chunk.h" 12 #include "http_chunk.h" 13 14 #include "plugin.h" 15 16 #include <sys/types.h> 17 #include <sys/stat.h> 18 19 #include <limits.h> 20 #include <errno.h> 21 #include <stdlib.h> 22 #include <string.h> 23 #include <time.h> 24 25 26 int 27 http_response_omit_header (request_st * const r, const data_string * const ds) 28 { 29 const size_t klen = buffer_string_length(&ds->key); 30 if (klen == sizeof("X-Sendfile")-1 31 && buffer_eq_icase_ssn(ds->key.ptr, CONST_STR_LEN("X-Sendfile"))) 32 return 1; 33 if (klen >= sizeof("X-LIGHTTPD-")-1 34 && buffer_eq_icase_ssn(ds->key.ptr, CONST_STR_LEN("X-LIGHTTPD-"))) { 35 if (klen == sizeof("X-LIGHTTPD-KBytes-per-second")-1 36 && buffer_eq_icase_ssn(ds->key.ptr+sizeof("X-LIGHTTPD-")-1, 37 CONST_STR_LEN("KBytes-per-second"))) { 38 /* "X-LIGHTTPD-KBytes-per-second" */ 39 off_t limit = strtol(ds->value.ptr, NULL, 10) << 10; /*(*=1024)*/ 40 if (limit > 0 41 && (limit < r->conf.bytes_per_second 42 || 0 == r->conf.bytes_per_second)) { 43 r->conf.bytes_per_second = limit; 44 } 45 } 46 return 1; 47 } 48 return 0; 49 } 50 51 52 void 53 http_response_write_header (request_st * const r) 54 { 55 chunkqueue * const cq = r->write_queue; 56 buffer * const b = chunkqueue_prepend_buffer_open(cq); 57 58 const char * const httpv = (r->http_version == HTTP_VERSION_1_1) ? "HTTP/1.1 " : "HTTP/1.0 "; 59 buffer_copy_string_len(b, httpv, sizeof("HTTP/1.1 ")-1); 60 http_status_append(b, r->http_status); 61 62 /* disable keep-alive if requested */ 63 64 if (r->con->request_count > r->conf.max_keep_alive_requests || 0 == r->conf.max_keep_alive_idle) { 65 r->keep_alive = 0; 66 } else if (0 != r->reqbody_length 67 && r->reqbody_length != r->reqbody_queue->bytes_in 68 && (NULL == r->handler_module 69 || 0 == (r->conf.stream_request_body 70 & (FDEVENT_STREAM_REQUEST 71 | FDEVENT_STREAM_REQUEST_BUFMIN)))) { 72 r->keep_alive = 0; 73 } else { 74 r->con->keep_alive_idle = r->conf.max_keep_alive_idle; 75 } 76 77 if ((r->resp_htags & HTTP_HEADER_UPGRADE) && r->http_version == HTTP_VERSION_1_1) { 78 http_header_response_set(r, HTTP_HEADER_CONNECTION, CONST_STR_LEN("Connection"), CONST_STR_LEN("upgrade")); 79 } else if (0 == r->keep_alive) { 80 http_header_response_set(r, HTTP_HEADER_CONNECTION, CONST_STR_LEN("Connection"), CONST_STR_LEN("close")); 81 } else if (r->http_version == HTTP_VERSION_1_0) {/*(&& r->keep_alive != 0)*/ 82 http_header_response_set(r, HTTP_HEADER_CONNECTION, CONST_STR_LEN("Connection"), CONST_STR_LEN("keep-alive")); 83 } 84 85 if (304 == r->http_status && (r->resp_htags & HTTP_HEADER_CONTENT_ENCODING)) { 86 http_header_response_unset(r, HTTP_HEADER_CONTENT_ENCODING, CONST_STR_LEN("Content-Encoding")); 87 } 88 89 /* add all headers */ 90 for (size_t i = 0; i < r->resp_headers.used; ++i) { 91 const data_string * const ds = (data_string *)r->resp_headers.data[i]; 92 93 if (buffer_string_is_empty(&ds->value)) continue; 94 if (buffer_string_is_empty(&ds->key)) continue; 95 if ((ds->key.ptr[0] & 0xdf) == 'X' && http_response_omit_header(r, ds)) 96 continue; 97 98 buffer_append_string_len(b, CONST_STR_LEN("\r\n")); 99 buffer_append_string_buffer(b, &ds->key); 100 buffer_append_string_len(b, CONST_STR_LEN(": ")); 101 buffer_append_string_buffer(b, &ds->value); 102 } 103 104 if (!(r->resp_htags & HTTP_HEADER_DATE)) { 105 static time_t tlast; 106 static char tstr[32]; /* 30-chars for "%a, %d %b %Y %H:%M:%S GMT" */ 107 static size_t tlen; 108 109 /* cache the generated timestamp */ 110 const time_t cur_ts = log_epoch_secs; 111 if (tlast != cur_ts) { 112 tlast = cur_ts; 113 tlen = strftime(tstr, sizeof(tstr), 114 "%a, %d %b %Y %H:%M:%S GMT", gmtime(&tlast)); 115 } 116 117 /* HTTP/1.1 and later requires a Date: header */ 118 buffer_append_string_len(b, CONST_STR_LEN("\r\nDate: ")); 119 buffer_append_string_len(b, tstr, tlen); 120 } 121 122 if (!(r->resp_htags & HTTP_HEADER_SERVER)) { 123 if (!buffer_string_is_empty(r->conf.server_tag)) { 124 buffer_append_string_len(b, CONST_STR_LEN("\r\nServer: ")); 125 buffer_append_string_len(b, CONST_BUF_LEN(r->conf.server_tag)); 126 } 127 } 128 129 buffer_append_string_len(b, CONST_STR_LEN("\r\n\r\n")); 130 131 r->resp_header_len = buffer_string_length(b); 132 133 if (r->conf.log_response_header) { 134 log_error(r->conf.errh,__FILE__,__LINE__,"Response-Header:\n%s",b->ptr); 135 } 136 137 chunkqueue_prepend_buffer_commit(cq); 138 } 139 140 141 static handler_t http_response_physical_path_check(request_st * const r) { 142 stat_cache_entry *sce = stat_cache_get_entry(&r->physical.path); 143 144 if (sce) { 145 /* file exists */ 146 } else { 147 char *pathinfo = NULL; 148 switch (errno) { 149 case EACCES: 150 r->http_status = 403; 151 152 if (r->conf.log_request_handling) { 153 log_error(r->conf.errh, __FILE__, __LINE__, 154 "-- access denied"); 155 log_error(r->conf.errh, __FILE__, __LINE__, 156 "Path : %s", r->physical.path.ptr); 157 } 158 159 buffer_reset(&r->physical.path); 160 return HANDLER_FINISHED; 161 case ENAMETOOLONG: 162 /* file name to be read was too long. return 404 */ 163 case ENOENT: 164 if (r->http_method == HTTP_METHOD_OPTIONS 165 && NULL != http_header_response_get(r, HTTP_HEADER_OTHER, CONST_STR_LEN("Allow"))) { 166 r->http_status = 200; 167 return HANDLER_FINISHED; 168 } 169 170 r->http_status = 404; 171 172 if (r->conf.log_request_handling) { 173 log_error(r->conf.errh, __FILE__, __LINE__, 174 "-- file not found"); 175 log_error(r->conf.errh, __FILE__, __LINE__, 176 "Path : %s", r->physical.path.ptr); 177 } 178 179 buffer_reset(&r->physical.path); 180 return HANDLER_FINISHED; 181 case ENOTDIR: 182 /* PATH_INFO ! :) */ 183 break; 184 default: 185 /* we have no idea what happened. let's tell the user so. */ 186 log_error(r->conf.errh, __FILE__, __LINE__, 187 "file not found ... or so: %s -> %s", 188 r->uri.path.ptr, r->physical.path.ptr); 189 190 r->http_status = 500; 191 buffer_reset(&r->physical.path); 192 193 return HANDLER_FINISHED; 194 } 195 196 /* not found, perhaps PATHINFO */ 197 198 { 199 /*(might check at startup that s->document_root does not end in '/')*/ 200 size_t len = buffer_string_length(&r->physical.basedir); 201 if (len > 0 && '/' == r->physical.basedir.ptr[len-1]) --len; 202 pathinfo = r->physical.path.ptr + len; 203 if ('/' != *pathinfo) { 204 pathinfo = NULL; 205 } 206 else if (pathinfo == r->physical.path.ptr) { /*(basedir is "/")*/ 207 pathinfo = strchr(pathinfo+1, '/'); 208 } 209 } 210 211 buffer * const tb = r->tmp_buf; 212 for (char *pprev = pathinfo; pathinfo; pprev = pathinfo, pathinfo = strchr(pathinfo+1, '/')) { 213 buffer_copy_string_len(tb, r->physical.path.ptr, pathinfo - r->physical.path.ptr); 214 stat_cache_entry *nsce = stat_cache_get_entry(tb); 215 if (NULL == nsce) { 216 pathinfo = pathinfo != pprev ? pprev : NULL; 217 break; 218 } 219 sce = nsce; 220 if (!S_ISDIR(sce->st.st_mode)) break; 221 } 222 223 if (NULL == pathinfo || !S_ISREG(sce->st.st_mode)) { 224 /* no it really doesn't exists */ 225 r->http_status = 404; 226 227 if (r->conf.log_file_not_found) { 228 log_error(r->conf.errh, __FILE__, __LINE__, 229 "file not found: %s -> %s", 230 r->uri.path.ptr, r->physical.path.ptr); 231 } 232 233 buffer_reset(&r->physical.path); 234 235 return HANDLER_FINISHED; 236 } 237 238 /* we have a PATHINFO */ 239 if (pathinfo) { 240 size_t len = strlen(pathinfo), reqlen; 241 if (r->conf.force_lowercase_filenames 242 && len <= (reqlen = buffer_string_length(&r->target)) 243 && buffer_eq_icase_ssn(r->target.ptr + reqlen - len, pathinfo, len)) { 244 /* attempt to preserve case-insensitive PATH_INFO 245 * (works in common case where mod_alias, mod_magnet, and other modules 246 * have not modified the PATH_INFO portion of request URI, or did so 247 * with exactly the PATH_INFO desired) */ 248 buffer_copy_string_len(&r->pathinfo, r->target.ptr + reqlen - len, len); 249 } else { 250 buffer_copy_string_len(&r->pathinfo, pathinfo, len); 251 } 252 253 /* 254 * shorten uri.path 255 */ 256 257 buffer_string_set_length(&r->uri.path, buffer_string_length(&r->uri.path) - len); 258 buffer_string_set_length(&r->physical.path, (size_t)(pathinfo - r->physical.path.ptr)); 259 } 260 } 261 262 if (!r->conf.follow_symlink 263 && 0 != stat_cache_path_contains_symlink(&r->physical.path, r->conf.errh)) { 264 r->http_status = 403; 265 266 if (r->conf.log_request_handling) { 267 log_error(r->conf.errh, __FILE__, __LINE__, 268 "-- access denied due symlink restriction"); 269 log_error(r->conf.errh, __FILE__, __LINE__, 270 "Path : %s", r->physical.path.ptr); 271 } 272 273 buffer_reset(&r->physical.path); 274 return HANDLER_FINISHED; 275 } 276 277 if (S_ISDIR(sce->st.st_mode)) { 278 if (r->uri.path.ptr[buffer_string_length(&r->uri.path) - 1] != '/') { 279 /* redirect to .../ */ 280 281 http_response_redirect_to_directory(r, 301); 282 283 return HANDLER_FINISHED; 284 } 285 } else if (!S_ISREG(sce->st.st_mode)) { 286 /* any special handling of non-reg files ?*/ 287 } 288 289 return HANDLER_GO_ON; 290 } 291 292 __attribute_cold__ 293 __attribute_noinline__ 294 static handler_t http_status_set_error_close (request_st * const r, int status) { 295 r->keep_alive = 0; 296 r->resp_body_finished = 1; 297 r->handler_module = NULL; 298 r->http_status = status; 299 return HANDLER_FINISHED; 300 } 301 302 static handler_t http_response_config (request_st * const r) { 303 if (r->conf.log_condition_handling) 304 log_error(r->conf.errh, __FILE__, __LINE__, "run condition"); 305 306 config_cond_cache_reset(r); 307 config_patch_config(r); 308 309 /* do we have to downgrade from 1.1 to 1.0 ? (ignore for HTTP/2) */ 310 if (!r->conf.allow_http11 && r->http_version == HTTP_VERSION_1_1) 311 r->http_version = HTTP_VERSION_1_0; 312 313 /* r->conf.max_request_size is in kBytes */ 314 if (0 != r->conf.max_request_size && 315 (off_t)r->reqbody_length > ((off_t)r->conf.max_request_size << 10)) { 316 log_error(r->conf.errh, __FILE__, __LINE__, 317 "request-size too long: %lld -> 413", (long long) r->reqbody_length); 318 return /* 413 Payload Too Large */ 319 http_status_set_error_close(r, 413); 320 } 321 322 return HANDLER_GO_ON; 323 } 324 325 326 __attribute_cold__ 327 static handler_t http_response_comeback (request_st * const r); 328 329 330 static handler_t 331 http_response_prepare (request_st * const r) 332 { 333 handler_t rc; 334 335 do { 336 337 /* looks like someone has already made a decision */ 338 if (r->http_status != 0 && r->http_status != 200) { 339 if (0 == r->resp_body_finished) 340 http_response_body_clear(r, 0); 341 return HANDLER_FINISHED; 342 } 343 344 /* no decision yet, build conf->filename */ 345 if (buffer_is_empty(&r->physical.path)) { 346 347 if (!r->async_callback) { 348 rc = http_response_config(r); 349 if (HANDLER_GO_ON != rc) continue; 350 } 351 r->async_callback = 0; /* reset */ 352 353 /* we only come here when we have the parse the full request again 354 * 355 * a HANDLER_COMEBACK from mod_rewrite and mod_fastcgi might be a 356 * problem here as mod_setenv might get called multiple times 357 * 358 * fastcgi-auth might lead to a COMEBACK too 359 * fastcgi again dead server too 360 */ 361 362 if (r->conf.log_request_handling) { 363 log_error(r->conf.errh, __FILE__, __LINE__, 364 "-- parsed Request-URI"); 365 log_error(r->conf.errh, __FILE__, __LINE__, 366 "Request-URI : %s", r->target.ptr); 367 log_error(r->conf.errh, __FILE__, __LINE__, 368 "URI-scheme : %s", r->uri.scheme.ptr); 369 log_error(r->conf.errh, __FILE__, __LINE__, 370 "URI-authority : %s", r->uri.authority.ptr); 371 log_error(r->conf.errh, __FILE__, __LINE__, 372 "URI-path (clean): %s", r->uri.path.ptr); 373 log_error(r->conf.errh, __FILE__, __LINE__, 374 "URI-query : %.*s", 375 BUFFER_INTLEN_PTR(&r->uri.query)); 376 } 377 378 379 /** 380 * 381 * call plugins 382 * 383 * - based on the raw URL 384 * 385 */ 386 387 rc = plugins_call_handle_uri_raw(r); 388 if (HANDLER_GO_ON != rc) continue; 389 390 /** 391 * 392 * call plugins 393 * 394 * - based on the clean URL 395 * 396 */ 397 398 rc = plugins_call_handle_uri_clean(r); 399 if (HANDLER_GO_ON != rc) continue; 400 401 if (r->http_method == HTTP_METHOD_OPTIONS && 402 r->uri.path.ptr[0] == '*' && r->uri.path.ptr[1] == '\0') { 403 /* option requests are handled directly without checking of the path */ 404 405 http_header_response_append(r, HTTP_HEADER_OTHER, CONST_STR_LEN("Allow"), CONST_STR_LEN("OPTIONS, GET, HEAD, POST")); 406 407 r->http_status = 200; 408 r->resp_body_finished = 1; 409 410 return HANDLER_FINISHED; 411 } 412 413 if (r->http_method == HTTP_METHOD_CONNECT && NULL == r->handler_module) { 414 return /* 405 Method Not Allowed */ 415 http_status_set_error_close(r, 405); 416 } 417 418 /*** 419 * 420 * border 421 * 422 * logical filename (URI) becomes a physical filename here 423 * 424 * 425 * 426 */ 427 428 429 430 431 /* 1. stat() 432 * ... ISREG() -> ok, go on 433 * ... ISDIR() -> index-file -> redirect 434 * 435 * 2. pathinfo() 436 * ... ISREG() 437 * 438 * 3. -> 404 439 * 440 */ 441 442 /* 443 * SEARCH DOCUMENT ROOT 444 */ 445 446 /* set a default */ 447 448 buffer_copy_buffer(&r->physical.doc_root, r->conf.document_root); 449 buffer_copy_buffer(&r->physical.rel_path, &r->uri.path); 450 451 #if defined(__WIN32) || defined(__CYGWIN__) 452 /* strip dots from the end and spaces 453 * 454 * windows/dos handle those filenames as the same file 455 * 456 * foo == foo. == foo..... == "foo... " == "foo.. ./" 457 * 458 * This will affect in some cases PATHINFO 459 * 460 * on native windows we could prepend the filename with \\?\ to circumvent 461 * this behaviour. I have no idea how to push this through cygwin 462 * 463 * */ 464 465 if (!buffer_string_is_empty(&r->physical.rel_path)) { 466 buffer *b = &r->physical.rel_path; 467 size_t len = buffer_string_length(b); 468 469 /* strip trailing " /" or "./" once */ 470 if (len > 1 && 471 b->ptr[len - 1] == '/' && 472 (b->ptr[len - 2] == ' ' || b->ptr[len - 2] == '.')) { 473 len -= 2; 474 } 475 /* strip all trailing " " and "." */ 476 while (len > 0 && ( ' ' == b->ptr[len-1] || '.' == b->ptr[len-1] ) ) --len; 477 buffer_string_set_length(b, len); 478 } 479 #endif 480 481 if (r->conf.log_request_handling) { 482 log_error(r->conf.errh, __FILE__, __LINE__, 483 "-- before doc_root"); 484 log_error(r->conf.errh, __FILE__, __LINE__, 485 "Doc-Root : %s", r->physical.doc_root.ptr); 486 log_error(r->conf.errh, __FILE__, __LINE__, 487 "Rel-Path : %s", r->physical.rel_path.ptr); 488 log_error(r->conf.errh, __FILE__, __LINE__, 489 "Path : %s", r->physical.path.ptr); 490 } 491 /* the docroot plugin should set the doc_root and might also set the physical.path 492 * for us (all vhost-plugins are supposed to set the doc_root) 493 * */ 494 rc = plugins_call_handle_docroot(r); 495 if (HANDLER_GO_ON != rc) continue; 496 497 /* MacOS X and Windows can't distinguish between upper and lower-case 498 * 499 * convert to lower-case 500 */ 501 if (r->conf.force_lowercase_filenames) { 502 buffer_to_lower(&r->physical.rel_path); 503 } 504 505 /* the docroot plugins might set the servername, if they don't we take http-host */ 506 if (buffer_string_is_empty(r->server_name)) { 507 r->server_name = &r->uri.authority; 508 } 509 510 /** 511 * create physical filename 512 * -> physical.path = docroot + rel_path 513 * 514 */ 515 516 buffer_copy_buffer(&r->physical.basedir, &r->physical.doc_root); 517 buffer_copy_buffer(&r->physical.path, &r->physical.doc_root); 518 buffer_append_path_len(&r->physical.path, CONST_BUF_LEN(&r->physical.rel_path)); 519 520 if (r->conf.log_request_handling) { 521 log_error(r->conf.errh, __FILE__, __LINE__, 522 "-- after doc_root"); 523 log_error(r->conf.errh, __FILE__, __LINE__, 524 "Doc-Root : %s", r->physical.doc_root.ptr); 525 log_error(r->conf.errh, __FILE__, __LINE__, 526 "Rel-Path : %s", r->physical.rel_path.ptr); 527 log_error(r->conf.errh, __FILE__, __LINE__, 528 "Path : %s", r->physical.path.ptr); 529 } 530 531 if (r->http_method == HTTP_METHOD_CONNECT) { 532 /* do not permit CONNECT requests to hit filesystem hooks 533 * since the CONNECT URI bypassed path normalization */ 534 /* (This check is located here so that r->physical.path 535 * is filled in above to avoid repeating work next time 536 * http_response_prepare() is called while processing request) */ 537 } else { 538 rc = plugins_call_handle_physical(r); 539 if (HANDLER_GO_ON != rc) continue; 540 541 if (r->conf.log_request_handling) { 542 log_error(r->conf.errh, __FILE__, __LINE__, 543 "-- logical -> physical"); 544 log_error(r->conf.errh, __FILE__, __LINE__, 545 "Doc-Root : %s", r->physical.doc_root.ptr); 546 log_error(r->conf.errh, __FILE__, __LINE__, 547 "Basedir : %s", r->physical.basedir.ptr); 548 log_error(r->conf.errh, __FILE__, __LINE__, 549 "Rel-Path : %s", r->physical.rel_path.ptr); 550 log_error(r->conf.errh, __FILE__, __LINE__, 551 "Path : %s", r->physical.path.ptr); 552 } 553 } 554 } 555 556 if (NULL != r->handler_module) return HANDLER_GO_ON; 557 558 /* 559 * No module grabbed the request yet (like mod_access) 560 * 561 * Go on and check of the file exists at all 562 */ 563 564 if (r->conf.log_request_handling) { 565 log_error(r->conf.errh, __FILE__, __LINE__, 566 "-- handling physical path"); 567 log_error(r->conf.errh, __FILE__, __LINE__, 568 "Path : %s", r->physical.path.ptr); 569 } 570 571 rc = http_response_physical_path_check(r); 572 if (HANDLER_GO_ON != rc) continue; 573 574 if (r->conf.log_request_handling) { 575 log_error(r->conf.errh, __FILE__, __LINE__, 576 "-- handling subrequest"); 577 log_error(r->conf.errh, __FILE__, __LINE__, 578 "Path : %s", r->physical.path.ptr); 579 log_error(r->conf.errh, __FILE__, __LINE__, 580 "URI : %s", r->uri.path.ptr); 581 log_error(r->conf.errh, __FILE__, __LINE__, 582 "Pathinfo : %s", r->pathinfo.ptr); 583 } 584 585 /* call the handlers */ 586 rc = plugins_call_handle_subrequest_start(r); 587 if (HANDLER_GO_ON != rc) { 588 if (r->conf.log_request_handling) { 589 log_error(r->conf.errh, __FILE__, __LINE__, 590 "-- subrequest finished"); 591 } 592 continue; 593 } 594 595 /* if we are still here, no one wanted the file, status 403 is ok I think */ 596 if (NULL == r->handler_module && 0 == r->http_status) { 597 r->http_status = (r->http_method != HTTP_METHOD_OPTIONS) ? 403 : 200; 598 return HANDLER_FINISHED; 599 } 600 601 return HANDLER_GO_ON; 602 603 } while (HANDLER_COMEBACK == rc 604 && HANDLER_GO_ON ==(rc = http_response_comeback(r))); 605 606 return rc; 607 } 608 609 610 __attribute_cold__ 611 static handler_t http_response_comeback (request_st * const r) 612 { 613 if (NULL != r->handler_module || !buffer_is_empty(&r->physical.path)) 614 return HANDLER_GO_ON; 615 616 config_reset_config(r); 617 618 buffer_copy_buffer(&r->uri.authority,r->http_host);/*copy even if NULL*/ 619 buffer_to_lower(&r->uri.authority); 620 621 int status = http_request_parse_target(r, r->con->proto_default_port); 622 if (0 == status) { 623 r->conditional_is_valid = (1 << COMP_SERVER_SOCKET) 624 | (1 << COMP_HTTP_SCHEME) 625 | (1 << COMP_HTTP_HOST) 626 | (1 << COMP_HTTP_REMOTE_IP) 627 | (1 << COMP_HTTP_REQUEST_METHOD) 628 | (1 << COMP_HTTP_URL) 629 | (1 << COMP_HTTP_QUERY_STRING) 630 | (1 << COMP_HTTP_REQUEST_HEADER); 631 return HANDLER_GO_ON; 632 } 633 else { 634 r->conditional_is_valid = (1 << COMP_SERVER_SOCKET) 635 | (1 << COMP_HTTP_REMOTE_IP); 636 config_cond_cache_reset(r); 637 return http_status_set_error_close(r, status); 638 } 639 } 640 641 642 __attribute_cold__ 643 static void 644 http_response_errdoc_init (request_st * const r) 645 { 646 /* modules that produce headers required with error response should 647 * typically also produce an error document. Make an exception for 648 * mod_auth WWW-Authenticate response header. */ 649 buffer *www_auth = NULL; 650 if (401 == r->http_status) { 651 const buffer * const vb = 652 http_header_response_get(r, HTTP_HEADER_OTHER, 653 CONST_STR_LEN("WWW-Authenticate")); 654 if (NULL != vb) www_auth = buffer_init_buffer(vb); 655 } 656 657 buffer_reset(&r->physical.path); 658 r->resp_htags = 0; 659 array_reset_data_strings(&r->resp_headers); 660 http_response_body_clear(r, 0); 661 662 if (NULL != www_auth) { 663 http_header_response_set(r, HTTP_HEADER_OTHER, 664 CONST_STR_LEN("WWW-Authenticate"), 665 CONST_BUF_LEN(www_auth)); 666 buffer_free(www_auth); 667 } 668 } 669 670 671 __attribute_cold__ 672 static void 673 http_response_static_errdoc (request_st * const r) 674 { 675 if (NULL == r->handler_module 676 ? r->error_handler_saved_status >= 65535 677 : (!r->conf.error_intercept || r->error_handler_saved_status)) 678 return; 679 680 http_response_errdoc_init(r); 681 r->resp_body_finished = 1; 682 683 /* try to send static errorfile */ 684 if (!buffer_string_is_empty(r->conf.errorfile_prefix)) { 685 buffer_copy_buffer(&r->physical.path, r->conf.errorfile_prefix); 686 buffer_append_int(&r->physical.path, r->http_status); 687 buffer_append_string_len(&r->physical.path, CONST_STR_LEN(".html")); 688 if (0 == http_chunk_append_file(r, &r->physical.path)) { 689 stat_cache_entry *sce = stat_cache_get_entry(&r->physical.path); 690 const buffer *content_type = (NULL != sce) 691 ? stat_cache_content_type_get(sce, r) 692 : NULL; 693 if (content_type) 694 http_header_response_set(r, HTTP_HEADER_CONTENT_TYPE, 695 CONST_STR_LEN("Content-Type"), 696 CONST_BUF_LEN(content_type)); 697 return; 698 } 699 } 700 701 /* build default error-page */ 702 buffer_reset(&r->physical.path); 703 buffer * const b = r->tmp_buf; 704 buffer_copy_string_len(b, CONST_STR_LEN( 705 "<?xml version=\"1.0\" encoding=\"iso-8859-1\"?>\n" 706 "<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\"\n" 707 " \"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd\">\n" 708 "<html xmlns=\"http://www.w3.org/1999/xhtml\" xml:lang=\"en\" lang=\"en\">\n" 709 " <head>\n" 710 " <title>")); 711 http_status_append(b, r->http_status); 712 buffer_append_string_len(b, CONST_STR_LEN( 713 "</title>\n" 714 " </head>\n" 715 " <body>\n" 716 " <h1>")); 717 http_status_append(b, r->http_status); 718 buffer_append_string_len(b, CONST_STR_LEN( 719 "</h1>\n" 720 " </body>\n" 721 "</html>\n")); 722 (void)http_chunk_append_mem(r, CONST_BUF_LEN(b)); 723 724 http_header_response_set(r, HTTP_HEADER_CONTENT_TYPE, 725 CONST_STR_LEN("Content-Type"), 726 CONST_STR_LEN("text/html")); 727 } 728 729 730 __attribute_cold__ 731 static void 732 http_response_merge_trailers (request_st * const r) 733 { 734 /* attempt to merge trailers into headers; header not yet sent by caller */ 735 if (buffer_string_is_empty(&r->gw_dechunk->b)) return; 736 const int done = r->gw_dechunk->done; 737 if (!done) return; /* XXX: !done; could scan for '\n' and send only those */ 738 739 /* do not include trailers if success status (when response was read from 740 * backend) subsequently changed to error status. http_chunk could add the 741 * trailers, but such actions are better on a different code layer than in 742 * http_chunk.c */ 743 if (done < 400 && r->http_status >= 400) return; 744 745 /* XXX: trailers passed through; no sanity check currently done 746 * https://tools.ietf.org/html/rfc7230#section-4.1.2 747 * 748 * Not checking for disallowed fields 749 * Not handling (deprecated) line wrapping 750 * Not strictly checking fields 751 */ 752 const char *k = strchr(r->gw_dechunk->b.ptr, '\n'); /*(skip final chunk)*/ 753 if (NULL == k) return; /*(should not happen)*/ 754 ++k; 755 for (const char *v, *e; (e = strchr(k, '\n')); k = e+1) { 756 v = memchr(k, ':', (size_t)(e - k)); 757 if (NULL == v || v == k || *k == ' ' || *k == '\t') continue; 758 uint32_t klen = (uint32_t)(v - k); 759 do { ++v; } while (*v == ' ' || *v == '\t'); 760 if (*v == '\r' || *v == '\n') continue; 761 enum http_header_e id = http_header_hkey_get(k, klen); 762 http_header_response_insert(r, id, k, klen, v, (size_t)(e - v)); 763 } 764 http_header_response_unset(r, HTTP_HEADER_OTHER, CONST_STR_LEN("Trailer")); 765 buffer_clear(&r->gw_dechunk->b); 766 } 767 768 769 static handler_t 770 http_response_write_prepare(request_st * const r) 771 { 772 if (NULL == r->handler_module) { 773 /* static files */ 774 switch(r->http_method) { 775 case HTTP_METHOD_GET: 776 case HTTP_METHOD_POST: 777 case HTTP_METHOD_HEAD: 778 break; 779 case HTTP_METHOD_OPTIONS: 780 if ((!r->http_status || r->http_status == 200) 781 && !buffer_string_is_empty(&r->uri.path) 782 && r->uri.path.ptr[0] != '*') { 783 http_response_body_clear(r, 0); 784 http_header_response_append(r, HTTP_HEADER_OTHER, 785 CONST_STR_LEN("Allow"), 786 CONST_STR_LEN("OPTIONS, GET, HEAD, POST")); 787 r->http_status = 200; 788 r->resp_body_finished = 1; 789 } 790 break; 791 default: 792 if (r->http_status == 0) 793 r->http_status = 501; 794 break; 795 } 796 } 797 798 if (r->http_status == 0) 799 r->http_status = 403; 800 801 switch (r->http_status) { 802 case 204: /* class: header only */ 803 case 205: 804 case 304: 805 /* disable chunked encoding again as we have no body */ 806 http_response_body_clear(r, 1); 807 r->resp_body_finished = 1; 808 break; 809 default: /* class: header + body */ 810 /* only custom body for 4xx and 5xx */ 811 if (r->http_status >= 400 && r->http_status < 600) 812 http_response_static_errdoc(r); 813 break; 814 } 815 816 if (r->gw_dechunk) 817 http_response_merge_trailers(r); 818 819 /* Allow filter plugins to change response headers */ 820 switch (plugins_call_handle_response_start(r)) { 821 case HANDLER_GO_ON: 822 case HANDLER_FINISHED: 823 break; 824 default: 825 log_error(r->conf.errh, __FILE__, __LINE__, 826 "response_start plugin failed"); 827 return HANDLER_ERROR; 828 } 829 830 if (r->resp_body_finished) { 831 /* set content-length if length is known and not already set */ 832 if (!(r->resp_htags 833 & (HTTP_HEADER_CONTENT_LENGTH | HTTP_HEADER_TRANSFER_ENCODING))) { 834 off_t qlen = chunkqueue_length(r->write_queue); 835 836 /** 837 * The Content-Length header can only be sent if we have content: 838 * - HEAD does not have a content-body (but can have content-length) 839 * - 1xx, 204 and 304 does not have a content-body 840 * (RFC 2616 Section 4.3) 841 * 842 * Otherwise generate a Content-Length header 843 * (if chunked encoding is not available) 844 */ 845 if ( r->http_status < 200 846 || r->http_status == 204 847 || r->http_status == 304) { 848 /* no Content-Body, no Content-Length */ 849 http_header_response_unset(r, HTTP_HEADER_CONTENT_LENGTH, 850 CONST_STR_LEN("Content-Length")); 851 } 852 else if (qlen > 0) { 853 buffer * const tb = r->tmp_buf; 854 buffer_clear(tb); 855 buffer_append_int(tb, qlen); 856 http_header_response_set(r, HTTP_HEADER_CONTENT_LENGTH, 857 CONST_STR_LEN("Content-Length"), 858 CONST_BUF_LEN(tb)); 859 } 860 else if (r->http_method != HTTP_METHOD_HEAD) { 861 /* Content-Length: 0 is important for Redirects (301, ...) as 862 * there might be content. */ 863 http_header_response_set(r, HTTP_HEADER_CONTENT_LENGTH, 864 CONST_STR_LEN("Content-Length"), 865 CONST_STR_LEN("0")); 866 } 867 } 868 } 869 else if (r->http_version == HTTP_VERSION_2) { 870 /* handled by HTTP/2 framing */ 871 } 872 else { 873 /** 874 * response is not yet finished, but we have all headers 875 * 876 * keep-alive requires one of: 877 * - Content-Length: ... (HTTP/1.0 and HTTP/1.0) 878 * - Transfer-Encoding: chunked (HTTP/1.1) 879 * - Upgrade: ... (lighttpd then acts as transparent proxy) 880 */ 881 882 if (!(r->resp_htags 883 & (HTTP_HEADER_CONTENT_LENGTH 884 |HTTP_HEADER_TRANSFER_ENCODING 885 |HTTP_HEADER_UPGRADE))) { 886 if (r->http_method == HTTP_METHOD_CONNECT && r->http_status == 200){ 887 /*(no transfer-encoding if successful CONNECT)*/ 888 } 889 else if (r->http_version == HTTP_VERSION_1_1) { 890 off_t qlen = chunkqueue_length(r->write_queue); 891 r->resp_send_chunked = 1; 892 if (qlen) { 893 /* create initial Transfer-Encoding: chunked segment */ 894 buffer * const b = 895 chunkqueue_prepend_buffer_open(r->write_queue); 896 buffer_append_uint_hex(b, (uintmax_t)qlen); 897 buffer_append_string_len(b, CONST_STR_LEN("\r\n")); 898 chunkqueue_prepend_buffer_commit(r->write_queue); 899 chunkqueue_append_mem(r->write_queue,CONST_STR_LEN("\r\n")); 900 } 901 http_header_response_append(r, HTTP_HEADER_TRANSFER_ENCODING, 902 CONST_STR_LEN("Transfer-Encoding"), 903 CONST_STR_LEN("chunked")); 904 } 905 else { /* if (r->http_version == HTTP_VERSION_1_0) */ 906 r->keep_alive = 0; 907 } 908 } 909 } 910 911 if (r->http_method == HTTP_METHOD_HEAD) { 912 /* HEAD request is like a GET, but without the content */ 913 http_response_body_clear(r, 1); 914 r->resp_body_finished = 1; 915 } 916 917 return HANDLER_GO_ON; 918 } 919 920 921 __attribute_cold__ 922 static handler_t 923 http_response_call_error_handler (request_st * const r, const buffer * const error_handler) 924 { 925 /* call error-handler */ 926 927 /* set REDIRECT_STATUS to save current HTTP status code 928 * for access by dynamic handlers 929 * https://redmine.lighttpd.net/issues/1828 */ 930 buffer * const tb = r->tmp_buf; 931 buffer_clear(tb); 932 buffer_append_int(tb, r->http_status); 933 http_header_env_set(r, CONST_STR_LEN("REDIRECT_STATUS"), CONST_BUF_LEN(tb)); 934 935 if (error_handler == r->conf.error_handler) { 936 plugins_call_handle_request_reset(r); 937 938 if (r->reqbody_length) { 939 if (r->reqbody_length != r->reqbody_queue->bytes_in) 940 r->keep_alive = 0; 941 r->reqbody_length = 0; 942 chunkqueue_reset(r->reqbody_queue); 943 } 944 945 r->con->is_writable = 1; 946 r->resp_body_finished = 0; 947 r->resp_body_started = 0; 948 949 r->error_handler_saved_status = r->http_status; 950 r->error_handler_saved_method = r->http_method; 951 952 r->http_method = HTTP_METHOD_GET; 953 } 954 else { /*(preserve behavior for server.error-handler-404)*/ 955 /*(negative to flag old behavior)*/ 956 r->error_handler_saved_status = -r->http_status; 957 } 958 959 if (r->http_version == HTTP_VERSION_UNSET) 960 r->http_version = HTTP_VERSION_1_0; 961 962 buffer_copy_buffer(&r->target, error_handler); 963 http_response_errdoc_init(r); 964 r->http_status = 0; /*(after http_response_errdoc_init())*/ 965 http_response_comeback(r); 966 return HANDLER_COMEBACK; 967 } 968 969 970 handler_t 971 http_response_handler (request_st * const r) 972 { 973 const plugin *p = r->handler_module; 974 int rc; 975 if (NULL != p 976 || ((rc = http_response_prepare(r)) == HANDLER_GO_ON 977 && NULL != (p = r->handler_module))) 978 rc = p->handle_subrequest(r, p->data); 979 980 switch (rc) { 981 case HANDLER_WAIT_FOR_EVENT: 982 if (!r->resp_body_finished 983 && (!r->resp_body_started || 0 == r->conf.stream_response_body)) 984 return HANDLER_WAIT_FOR_EVENT; /* come back here */ 985 /* response headers received from backend; start response */ 986 __attribute_fallthrough__ 987 case HANDLER_GO_ON: 988 case HANDLER_FINISHED: /*(HANDLER_FINISHED if request not handled)*/ 989 if (r->http_status == 0) r->http_status = 200; 990 if (r->error_handler_saved_status > 0) 991 r->http_method = r->error_handler_saved_method; 992 if (NULL == r->handler_module || r->conf.error_intercept) { 993 if (r->error_handler_saved_status) { 994 const int subreq_status = r->http_status; 995 if (r->error_handler_saved_status > 0) 996 r->http_status = r->error_handler_saved_status; 997 else if (r->http_status == 404 || r->http_status == 403) 998 /* error-handler-404 is a 404 */ 999 r->http_status = -r->error_handler_saved_status; 1000 else { 1001 /* error-handler-404 is back and has generated content */ 1002 /* if Status: was set, take it otherwise use 200 */ 1003 } 1004 if (200 <= subreq_status && subreq_status <= 299) { 1005 /*(flag value to indicate that error handler succeeded) 1006 *(for (NULL == r->handler_module))*/ 1007 r->error_handler_saved_status = 65535; /* >= 1000 */ 1008 } 1009 } 1010 else if (r->http_status >= 400) { 1011 const buffer *error_handler = NULL; 1012 if (!buffer_string_is_empty(r->conf.error_handler)) 1013 error_handler = r->conf.error_handler; 1014 else if ((r->http_status == 404 || r->http_status == 403) 1015 && !buffer_string_is_empty(r->conf.error_handler_404)) 1016 error_handler = r->conf.error_handler_404; 1017 1018 if (error_handler) 1019 return http_response_call_error_handler(r, error_handler); 1020 } 1021 } 1022 1023 /* we have something to send; go on */ 1024 /*(CON_STATE_RESPONSE_START; transient state)*/ 1025 return http_response_write_prepare(r); 1026 case HANDLER_WAIT_FOR_FD: 1027 return HANDLER_WAIT_FOR_FD; 1028 case HANDLER_COMEBACK: 1029 http_response_comeback(r); 1030 return HANDLER_COMEBACK; 1031 /*case HANDLER_ERROR:*/ 1032 default: 1033 return HANDLER_ERROR; /* something went wrong */ 1034 } 1035 } 1036