1 #include "first.h" 2 3 #include "response.h" 4 #include "request.h" 5 #include "base.h" 6 #include "fdevent.h" 7 #include "http_header.h" 8 #include "http_kv.h" 9 #include "log.h" 10 #include "stat_cache.h" 11 #include "chunk.h" 12 #include "http_chunk.h" 13 #include "http_date.h" 14 #include "http_range.h" 15 16 #include "plugin.h" 17 18 #include <sys/types.h> 19 #include <sys/stat.h> 20 21 #include <limits.h> 22 #include <errno.h> 23 #include <stdlib.h> 24 #include <string.h> 25 #include <time.h> 26 27 28 int 29 http_response_omit_header (request_st * const r, const data_string * const ds) 30 { 31 const size_t klen = buffer_string_length(&ds->key); 32 if (klen == sizeof("X-Sendfile")-1 33 && buffer_eq_icase_ssn(ds->key.ptr, CONST_STR_LEN("X-Sendfile"))) 34 return 1; 35 if (klen >= sizeof("X-LIGHTTPD-")-1 36 && buffer_eq_icase_ssn(ds->key.ptr, CONST_STR_LEN("X-LIGHTTPD-"))) { 37 if (klen == sizeof("X-LIGHTTPD-KBytes-per-second")-1 38 && buffer_eq_icase_ssn(ds->key.ptr+sizeof("X-LIGHTTPD-")-1, 39 CONST_STR_LEN("KBytes-per-second"))) { 40 /* "X-LIGHTTPD-KBytes-per-second" */ 41 off_t limit = strtol(ds->value.ptr, NULL, 10) << 10; /*(*=1024)*/ 42 if (limit > 0 43 && (limit < r->conf.bytes_per_second 44 || 0 == r->conf.bytes_per_second)) { 45 r->conf.bytes_per_second = limit; 46 } 47 } 48 return 1; 49 } 50 return 0; 51 } 52 53 54 __attribute_cold__ 55 static void 56 http_response_write_header_partial_1xx (request_st * const r, buffer * const b) 57 { 58 /* take data in con->write_queue and move into b 59 * (to be sent prior to final response headers in r->write_queue) */ 60 connection * const con = r->con; 61 /*assert(&r->write_queue != con->write_queue);*/ 62 chunkqueue * const cq = con->write_queue; 63 con->write_queue = &r->write_queue; 64 65 /*assert(0 == buffer_string_length(b));*//*expect empty buffer from caller*/ 66 uint32_t len = (uint32_t)chunkqueue_length(cq); 67 /*(expecting MEM_CHUNK(s), so not expecting error reading files)*/ 68 if (chunkqueue_read_data(cq, buffer_string_prepare_append(b, len), 69 len, r->conf.errh) < 0) 70 len = 0; 71 buffer_string_set_length(b, len);/*expect initial empty buffer from caller*/ 72 chunkqueue_free(cq); 73 } 74 75 76 void 77 http_response_write_header (request_st * const r) 78 { 79 chunkqueue * const cq = &r->write_queue; 80 buffer * const b = chunkqueue_prepend_buffer_open(cq); 81 82 if (cq != r->con->write_queue) 83 http_response_write_header_partial_1xx(r, b); 84 85 const char * const httpv = (r->http_version == HTTP_VERSION_1_1) ? "HTTP/1.1 " : "HTTP/1.0 "; 86 buffer_append_string_len(b, httpv, sizeof("HTTP/1.1 ")-1); 87 http_status_append(b, r->http_status); 88 89 /* disable keep-alive if requested */ 90 91 if (r->con->request_count > r->conf.max_keep_alive_requests || 0 == r->conf.max_keep_alive_idle) { 92 r->keep_alive = 0; 93 } else if (0 != r->reqbody_length 94 && r->reqbody_length != r->reqbody_queue.bytes_in 95 && (NULL == r->handler_module 96 || 0 == (r->conf.stream_request_body 97 & (FDEVENT_STREAM_REQUEST 98 | FDEVENT_STREAM_REQUEST_BUFMIN)))) { 99 r->keep_alive = 0; 100 } else { 101 r->con->keep_alive_idle = r->conf.max_keep_alive_idle; 102 } 103 104 if (light_btst(r->resp_htags, HTTP_HEADER_UPGRADE) 105 && r->http_version == HTTP_VERSION_1_1) { 106 http_header_response_set(r, HTTP_HEADER_CONNECTION, CONST_STR_LEN("Connection"), CONST_STR_LEN("upgrade")); 107 } else if (r->keep_alive <= 0) { 108 http_header_response_set(r, HTTP_HEADER_CONNECTION, CONST_STR_LEN("Connection"), CONST_STR_LEN("close")); 109 } else if (r->http_version == HTTP_VERSION_1_0) {/*(&& r->keep_alive > 0)*/ 110 http_header_response_set(r, HTTP_HEADER_CONNECTION, CONST_STR_LEN("Connection"), CONST_STR_LEN("keep-alive")); 111 } 112 113 if (304 == r->http_status 114 && light_btst(r->resp_htags, HTTP_HEADER_CONTENT_ENCODING)) { 115 http_header_response_unset(r, HTTP_HEADER_CONTENT_ENCODING, CONST_STR_LEN("Content-Encoding")); 116 } 117 118 /* add all headers */ 119 for (size_t i = 0; i < r->resp_headers.used; ++i) { 120 const data_string * const ds = (data_string *)r->resp_headers.data[i]; 121 const uint32_t klen = buffer_string_length(&ds->key); 122 const uint32_t vlen = buffer_string_length(&ds->value); 123 if (0 == klen || 0 == vlen) 124 continue; 125 if ((ds->key.ptr[0] & 0xdf) == 'X' && http_response_omit_header(r, ds)) 126 continue; 127 char * restrict s = buffer_extend(b, klen+vlen+4); 128 s[0] = '\r'; 129 s[1] = '\n'; 130 memcpy(s+2, ds->key.ptr, klen); 131 s += 2+klen; 132 s[0] = ':'; 133 s[1] = ' '; 134 memcpy(s+2, ds->value.ptr, vlen); 135 } 136 137 if (!light_btst(r->resp_htags, HTTP_HEADER_DATE)) { 138 /* HTTP/1.1 and later requires a Date: header */ 139 /* "\r\nDate: " 8-chars + 30-chars "%a, %d %b %Y %T GMT" + '\0' */ 140 static time_t tlast = 0; 141 static char tstr[40] = "\r\nDate: "; 142 143 /* cache the generated timestamp */ 144 const time_t cur_ts = log_epoch_secs; 145 if (__builtin_expect ( (tlast != cur_ts), 0)) 146 http_date_time_to_str(tstr+8, sizeof(tstr)-8, (tlast = cur_ts)); 147 148 buffer_append_string_len(b, tstr, 37); 149 } 150 151 if (!light_btst(r->resp_htags, HTTP_HEADER_SERVER) 152 && !buffer_string_is_empty(r->conf.server_tag)) 153 buffer_append_str2(b, CONST_STR_LEN("\r\nServer: "), 154 CONST_BUF_LEN(r->conf.server_tag)); 155 156 buffer_append_string_len(b, CONST_STR_LEN("\r\n\r\n")); 157 158 r->resp_header_len = buffer_string_length(b); 159 160 if (r->conf.log_response_header) { 161 log_error(r->conf.errh,__FILE__,__LINE__,"Response-Header:\n%s",b->ptr); 162 } 163 164 chunkqueue_prepend_buffer_commit(cq); 165 166 /*(optimization to use fewer syscalls to send a small response)*/ 167 off_t cqlen; 168 if (r->resp_body_finished 169 && light_btst(r->resp_htags, HTTP_HEADER_CONTENT_LENGTH) 170 && (cqlen = chunkqueue_length(cq) - r->resp_header_len) > 0 171 && cqlen <= 32768) 172 chunkqueue_small_resp_optim(cq); 173 } 174 175 176 __attribute_cold__ 177 static handler_t 178 http_response_physical_path_error (request_st * const r, const int code, const char * const msg) 179 { 180 r->http_status = code; 181 if ((code == 404 && r->conf.log_file_not_found) 182 || r->conf.log_request_handling) { 183 if (NULL == msg) 184 log_perror(r->conf.errh, __FILE__, __LINE__, "-- "); 185 else 186 log_error(r->conf.errh, __FILE__, __LINE__, "%s", msg); 187 log_error(r->conf.errh, __FILE__, __LINE__, 188 "Path : %s", r->physical.path.ptr); 189 log_error(r->conf.errh, __FILE__, __LINE__, 190 "URI : %s", r->uri.path.ptr); 191 } 192 return HANDLER_FINISHED; 193 } 194 195 196 static handler_t http_response_physical_path_check(request_st * const r) { 197 const stat_cache_st *st = stat_cache_path_stat(&r->physical.path); 198 199 if (st) { 200 /* file exists */ 201 } else { 202 switch (errno) { 203 case ENOTDIR: 204 /* PATH_INFO ! :) */ 205 break; 206 case EACCES: 207 return http_response_physical_path_error(r, 403, NULL); 208 case ENAMETOOLONG: 209 /* file name to be read was too long. return 404 */ 210 case ENOENT: 211 if (r->http_method == HTTP_METHOD_OPTIONS 212 && light_btst(r->resp_htags, HTTP_HEADER_ALLOW)) { 213 r->http_status = 200; 214 return HANDLER_FINISHED; 215 } 216 return http_response_physical_path_error(r, 404, NULL); 217 default: 218 /* we have no idea what happened. let's tell the user so. */ 219 return http_response_physical_path_error(r, 500, NULL); 220 } 221 222 /* not found, perhaps PATHINFO */ 223 224 char *pathinfo; 225 { 226 /*(might check at startup that s->document_root does not end in '/')*/ 227 size_t len = buffer_string_length(&r->physical.basedir) 228 - (buffer_has_pathsep_suffix(&r->physical.basedir)); 229 pathinfo = r->physical.path.ptr + len; 230 if ('/' != *pathinfo) { 231 pathinfo = NULL; 232 } 233 else if (pathinfo == r->physical.path.ptr) { /*(basedir is "/")*/ 234 pathinfo = strchr(pathinfo+1, '/'); 235 } 236 } 237 238 const uint32_t pathused = r->physical.path.used; 239 for (char *pprev = pathinfo; pathinfo; pprev = pathinfo, pathinfo = strchr(pathinfo+1, '/')) { 240 /*(temporarily modify r->physical.path in-place)*/ 241 r->physical.path.used = pathinfo - r->physical.path.ptr + 1; 242 *pathinfo = '\0'; 243 const stat_cache_st * const nst = stat_cache_path_stat(&r->physical.path); 244 *pathinfo = '/'; 245 r->physical.path.used = pathused; 246 if (NULL == nst) { 247 pathinfo = pathinfo != pprev ? pprev : NULL; 248 break; 249 } 250 st = nst; 251 if (!S_ISDIR(st->st_mode)) break; 252 } 253 254 if (NULL == pathinfo || !S_ISREG(st->st_mode)) { 255 /* no it really doesn't exists */ 256 return http_response_physical_path_error(r, 404, "-- file not found"); 257 } 258 259 /* we have a PATHINFO */ 260 if (pathinfo) { 261 size_t len = r->physical.path.ptr+pathused-1-pathinfo, reqlen; 262 if (r->conf.force_lowercase_filenames 263 && len <= (reqlen = buffer_string_length(&r->target)) 264 && buffer_eq_icase_ssn(r->target.ptr + reqlen - len, pathinfo, len)) { 265 /* attempt to preserve case-insensitive PATH_INFO 266 * (works in common case where mod_alias, mod_magnet, and other modules 267 * have not modified the PATH_INFO portion of request URI, or did so 268 * with exactly the PATH_INFO desired) */ 269 buffer_copy_string_len(&r->pathinfo, r->target.ptr + reqlen - len, len); 270 } else { 271 buffer_copy_string_len(&r->pathinfo, pathinfo, len); 272 } 273 274 /* 275 * shorten uri.path 276 */ 277 278 buffer_string_set_length(&r->uri.path, buffer_string_length(&r->uri.path) - len); 279 buffer_string_set_length(&r->physical.path, (size_t)(pathinfo - r->physical.path.ptr)); 280 } 281 } 282 283 if (!r->conf.follow_symlink 284 && 0 != stat_cache_path_contains_symlink(&r->physical.path, r->conf.errh)) { 285 return http_response_physical_path_error(r, 403, "-- access denied due to symlink restriction"); 286 } 287 288 if (S_ISREG(st->st_mode)) /*(common case)*/ 289 return HANDLER_GO_ON; 290 291 if (S_ISDIR(st->st_mode)) { 292 if (!buffer_has_slash_suffix(&r->uri.path)) { 293 http_response_redirect_to_directory(r, 301); 294 return HANDLER_FINISHED; 295 } 296 } else { 297 /* any special handling of other non-reg files ?*/ 298 } 299 300 return HANDLER_GO_ON; 301 } 302 303 __attribute_cold__ 304 __attribute_noinline__ 305 static handler_t http_status_set_error_close (request_st * const r, int status) { 306 r->keep_alive = 0; 307 r->resp_body_finished = 1; 308 r->handler_module = NULL; 309 r->http_status = status; 310 return HANDLER_FINISHED; 311 } 312 313 static handler_t http_response_config (request_st * const r) { 314 config_cond_cache_reset(r); 315 config_patch_config(r); 316 317 /* do we have to downgrade from 1.1 to 1.0 ? (ignore for HTTP/2) */ 318 if (!r->conf.allow_http11 && r->http_version == HTTP_VERSION_1_1) 319 r->http_version = HTTP_VERSION_1_0; 320 321 /* r->conf.max_request_size is in kBytes */ 322 if (0 != r->conf.max_request_size && 323 (off_t)r->reqbody_length > ((off_t)r->conf.max_request_size << 10)) { 324 log_error(r->conf.errh, __FILE__, __LINE__, 325 "request-size too long: %lld -> 413", (long long) r->reqbody_length); 326 return /* 413 Payload Too Large */ 327 http_status_set_error_close(r, 413); 328 } 329 330 return HANDLER_GO_ON; 331 } 332 333 334 __attribute_cold__ 335 static handler_t http_response_comeback (request_st * const r); 336 337 338 static handler_t 339 http_response_prepare (request_st * const r) 340 { 341 handler_t rc; 342 343 do { 344 345 /* looks like someone has already made a decision */ 346 if (r->http_status != 0 && r->http_status != 200) { 347 if (0 == r->resp_body_finished) 348 http_response_body_clear(r, 0); 349 return HANDLER_FINISHED; 350 } 351 352 /* no decision yet, build conf->filename */ 353 if (buffer_is_empty(&r->physical.path)) { 354 355 if (!r->async_callback) { 356 rc = http_response_config(r); 357 if (HANDLER_GO_ON != rc) continue; 358 } 359 r->async_callback = 0; /* reset */ 360 361 /* we only come here when we have the parse the full request again 362 * 363 * a HANDLER_COMEBACK from mod_rewrite and mod_fastcgi might be a 364 * problem here as mod_setenv might get called multiple times 365 * 366 * fastcgi-auth might lead to a COMEBACK too 367 * fastcgi again dead server too 368 */ 369 370 if (r->conf.log_request_handling) { 371 log_error(r->conf.errh, __FILE__, __LINE__, 372 "-- parsed Request-URI"); 373 log_error(r->conf.errh, __FILE__, __LINE__, 374 "Request-URI : %s", r->target.ptr); 375 log_error(r->conf.errh, __FILE__, __LINE__, 376 "URI-scheme : %s", r->uri.scheme.ptr); 377 log_error(r->conf.errh, __FILE__, __LINE__, 378 "URI-authority : %s", r->uri.authority.ptr); 379 log_error(r->conf.errh, __FILE__, __LINE__, 380 "URI-path (clean): %s", r->uri.path.ptr); 381 log_error(r->conf.errh, __FILE__, __LINE__, 382 "URI-query : %.*s", 383 BUFFER_INTLEN_PTR(&r->uri.query)); 384 } 385 386 387 /** 388 * 389 * call plugins 390 * 391 * - based on the raw URL 392 * 393 */ 394 395 rc = plugins_call_handle_uri_raw(r); 396 if (HANDLER_GO_ON != rc) continue; 397 398 /** 399 * 400 * call plugins 401 * 402 * - based on the clean URL 403 * 404 */ 405 406 rc = plugins_call_handle_uri_clean(r); 407 if (HANDLER_GO_ON != rc) continue; 408 409 if (r->http_method == HTTP_METHOD_OPTIONS && 410 r->uri.path.ptr[0] == '*' && r->uri.path.ptr[1] == '\0') { 411 /* option requests are handled directly without checking of the path */ 412 413 http_header_response_append(r, HTTP_HEADER_ALLOW, 414 CONST_STR_LEN("Allow"), 415 CONST_STR_LEN("OPTIONS, GET, HEAD, POST")); 416 417 r->http_status = 200; 418 r->resp_body_finished = 1; 419 420 return HANDLER_FINISHED; 421 } 422 423 if (r->http_method == HTTP_METHOD_CONNECT && NULL == r->handler_module) { 424 return /* 405 Method Not Allowed */ 425 http_status_set_error_close(r, 405); 426 } 427 428 /*** 429 * 430 * border 431 * 432 * logical filename (URI) becomes a physical filename here 433 * 434 * 435 * 436 */ 437 438 439 440 441 /* 1. stat() 442 * ... ISREG() -> ok, go on 443 * ... ISDIR() -> index-file -> redirect 444 * 445 * 2. pathinfo() 446 * ... ISREG() 447 * 448 * 3. -> 404 449 * 450 */ 451 452 /* 453 * SEARCH DOCUMENT ROOT 454 */ 455 456 /* set a default */ 457 458 buffer_copy_buffer(&r->physical.doc_root, r->conf.document_root); 459 buffer_copy_buffer(&r->physical.rel_path, &r->uri.path); 460 461 #if defined(__WIN32) || defined(__CYGWIN__) 462 /* strip dots from the end and spaces 463 * 464 * windows/dos handle those filenames as the same file 465 * 466 * foo == foo. == foo..... == "foo... " == "foo.. ./" 467 * 468 * This will affect in some cases PATHINFO 469 * 470 * on native windows we could prepend the filename with \\?\ to circumvent 471 * this behaviour. I have no idea how to push this through cygwin 472 * 473 * */ 474 475 if (!buffer_string_is_empty(&r->physical.rel_path)) { 476 buffer *b = &r->physical.rel_path; 477 size_t len = buffer_string_length(b); 478 479 /* strip trailing " /" or "./" once */ 480 if (len > 1 && 481 b->ptr[len - 1] == '/' && 482 (b->ptr[len - 2] == ' ' || b->ptr[len - 2] == '.')) { 483 len -= 2; 484 } 485 /* strip all trailing " " and "." */ 486 while (len > 0 && ( ' ' == b->ptr[len-1] || '.' == b->ptr[len-1] ) ) --len; 487 buffer_string_set_length(b, len); 488 } 489 #endif 490 491 if (r->conf.log_request_handling) { 492 log_error(r->conf.errh, __FILE__, __LINE__, 493 "-- before doc_root"); 494 log_error(r->conf.errh, __FILE__, __LINE__, 495 "Doc-Root : %s", r->physical.doc_root.ptr); 496 log_error(r->conf.errh, __FILE__, __LINE__, 497 "Rel-Path : %s", r->physical.rel_path.ptr); 498 log_error(r->conf.errh, __FILE__, __LINE__, 499 "Path : %s", r->physical.path.ptr); 500 } 501 /* the docroot plugin should set the doc_root and might also set the physical.path 502 * for us (all vhost-plugins are supposed to set the doc_root) 503 * */ 504 rc = plugins_call_handle_docroot(r); 505 if (HANDLER_GO_ON != rc) continue; 506 507 /* MacOS X and Windows can't distinguish between upper and lower-case 508 * 509 * convert to lower-case 510 */ 511 if (r->conf.force_lowercase_filenames) { 512 buffer_to_lower(&r->physical.rel_path); 513 } 514 515 /* the docroot plugins might set the servername, if they don't we take http-host */ 516 if (buffer_string_is_empty(r->server_name)) { 517 r->server_name = &r->uri.authority; 518 } 519 520 /** 521 * create physical filename 522 * -> physical.path = docroot + rel_path 523 * 524 */ 525 526 buffer_copy_buffer(&r->physical.basedir, &r->physical.doc_root); 527 buffer_copy_path_len2(&r->physical.path, 528 CONST_BUF_LEN(&r->physical.doc_root), 529 CONST_BUF_LEN(&r->physical.rel_path)); 530 531 if (r->conf.log_request_handling) { 532 log_error(r->conf.errh, __FILE__, __LINE__, 533 "-- after doc_root"); 534 log_error(r->conf.errh, __FILE__, __LINE__, 535 "Doc-Root : %s", r->physical.doc_root.ptr); 536 log_error(r->conf.errh, __FILE__, __LINE__, 537 "Rel-Path : %s", r->physical.rel_path.ptr); 538 log_error(r->conf.errh, __FILE__, __LINE__, 539 "Path : %s", r->physical.path.ptr); 540 } 541 542 if (r->http_method == HTTP_METHOD_CONNECT) { 543 /* do not permit CONNECT requests to hit filesystem hooks 544 * since the CONNECT URI bypassed path normalization */ 545 /* (This check is located here so that r->physical.path 546 * is filled in above to avoid repeating work next time 547 * http_response_prepare() is called while processing request) */ 548 } else { 549 rc = plugins_call_handle_physical(r); 550 if (HANDLER_GO_ON != rc) continue; 551 552 if (r->conf.log_request_handling) { 553 log_error(r->conf.errh, __FILE__, __LINE__, 554 "-- logical -> physical"); 555 log_error(r->conf.errh, __FILE__, __LINE__, 556 "Doc-Root : %s", r->physical.doc_root.ptr); 557 log_error(r->conf.errh, __FILE__, __LINE__, 558 "Basedir : %s", r->physical.basedir.ptr); 559 log_error(r->conf.errh, __FILE__, __LINE__, 560 "Rel-Path : %s", r->physical.rel_path.ptr); 561 log_error(r->conf.errh, __FILE__, __LINE__, 562 "Path : %s", r->physical.path.ptr); 563 } 564 } 565 } 566 567 if (NULL != r->handler_module) return HANDLER_GO_ON; 568 569 /* 570 * No module grabbed the request yet (like mod_access) 571 * 572 * Go on and check of the file exists at all 573 */ 574 575 if (r->conf.log_request_handling) { 576 log_error(r->conf.errh, __FILE__, __LINE__, 577 "-- handling physical path"); 578 log_error(r->conf.errh, __FILE__, __LINE__, 579 "Path : %s", r->physical.path.ptr); 580 } 581 582 rc = http_response_physical_path_check(r); 583 if (HANDLER_GO_ON != rc) continue; 584 585 if (r->conf.log_request_handling) { 586 log_error(r->conf.errh, __FILE__, __LINE__, 587 "-- handling subrequest"); 588 log_error(r->conf.errh, __FILE__, __LINE__, 589 "Path : %s", r->physical.path.ptr); 590 log_error(r->conf.errh, __FILE__, __LINE__, 591 "URI : %s", r->uri.path.ptr); 592 log_error(r->conf.errh, __FILE__, __LINE__, 593 "Pathinfo : %s", r->pathinfo.ptr); 594 } 595 596 /* call the handlers */ 597 rc = plugins_call_handle_subrequest_start(r); 598 if (HANDLER_GO_ON != rc) { 599 if (r->conf.log_request_handling) { 600 log_error(r->conf.errh, __FILE__, __LINE__, 601 "-- subrequest finished"); 602 } 603 continue; 604 } 605 606 /* if we are still here, no one wanted the file, status 403 is ok I think */ 607 if (NULL == r->handler_module && 0 == r->http_status) { 608 r->http_status = (r->http_method != HTTP_METHOD_OPTIONS) ? 403 : 200; 609 return HANDLER_FINISHED; 610 } 611 612 return HANDLER_GO_ON; 613 614 } while (HANDLER_COMEBACK == rc 615 && HANDLER_GO_ON ==(rc = http_response_comeback(r))); 616 617 return rc; 618 } 619 620 621 __attribute_cold__ 622 static handler_t http_response_comeback (request_st * const r) 623 { 624 if (NULL != r->handler_module || !buffer_is_empty(&r->physical.path)) 625 return HANDLER_GO_ON; 626 627 config_reset_config(r); 628 629 buffer_copy_buffer(&r->uri.authority,r->http_host);/*copy even if NULL*/ 630 buffer_to_lower(&r->uri.authority); 631 632 int status = http_request_parse_target(r, r->con->proto_default_port); 633 if (0 == status) { 634 r->conditional_is_valid = (1 << COMP_SERVER_SOCKET) 635 | (1 << COMP_HTTP_SCHEME) 636 | (1 << COMP_HTTP_HOST) 637 | (1 << COMP_HTTP_REMOTE_IP) 638 | (1 << COMP_HTTP_REQUEST_METHOD) 639 | (1 << COMP_HTTP_URL) 640 | (1 << COMP_HTTP_QUERY_STRING) 641 | (1 << COMP_HTTP_REQUEST_HEADER); 642 return HANDLER_GO_ON; 643 } 644 else { 645 r->conditional_is_valid = (1 << COMP_SERVER_SOCKET) 646 | (1 << COMP_HTTP_REMOTE_IP); 647 config_cond_cache_reset(r); 648 return http_status_set_error_close(r, status); 649 } 650 } 651 652 653 __attribute_cold__ 654 static void 655 http_response_errdoc_init (request_st * const r) 656 { 657 /* modules that produce headers required with error response should 658 * typically also produce an error document. Make an exception for 659 * mod_auth WWW-Authenticate response header. */ 660 buffer *www_auth = NULL; 661 if (401 == r->http_status) { 662 const buffer * const vb = 663 http_header_response_get(r, HTTP_HEADER_WWW_AUTHENTICATE, 664 CONST_STR_LEN("WWW-Authenticate")); 665 if (NULL != vb) www_auth = buffer_init_buffer(vb); 666 } 667 668 buffer_reset(&r->physical.path); 669 r->resp_htags = 0; 670 array_reset_data_strings(&r->resp_headers); 671 http_response_body_clear(r, 0); 672 673 if (NULL != www_auth) { 674 http_header_response_set(r, HTTP_HEADER_WWW_AUTHENTICATE, 675 CONST_STR_LEN("WWW-Authenticate"), 676 CONST_BUF_LEN(www_auth)); 677 buffer_free(www_auth); 678 } 679 } 680 681 682 __attribute_cold__ 683 static void 684 http_response_static_errdoc (request_st * const r) 685 { 686 if (NULL == r->handler_module 687 ? r->error_handler_saved_status >= 65535 688 : (!r->conf.error_intercept || r->error_handler_saved_status)) 689 return; 690 691 http_response_errdoc_init(r); 692 r->resp_body_finished = 1; 693 694 /* try to send static errorfile */ 695 if (!buffer_string_is_empty(r->conf.errorfile_prefix)) { 696 buffer_copy_buffer(&r->physical.path, r->conf.errorfile_prefix); 697 buffer_append_int(&r->physical.path, r->http_status); 698 buffer_append_string_len(&r->physical.path, CONST_STR_LEN(".html")); 699 stat_cache_entry *sce = 700 stat_cache_get_entry_open(&r->physical.path, r->conf.follow_symlink); 701 if (sce && 0 == http_chunk_append_file_ref(r, sce)) { 702 const buffer *content_type = stat_cache_content_type_get(sce, r); 703 if (content_type) 704 http_header_response_set(r, HTTP_HEADER_CONTENT_TYPE, 705 CONST_STR_LEN("Content-Type"), 706 CONST_BUF_LEN(content_type)); 707 return; 708 } 709 buffer_clear(&r->physical.path); 710 } 711 712 /* build default error-page */ 713 buffer * const b = chunkqueue_append_buffer_open(&r->write_queue); 714 buffer_copy_string_len(b, CONST_STR_LEN( 715 "<?xml version=\"1.0\" encoding=\"iso-8859-1\"?>\n" 716 "<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\"\n" 717 " \"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd\">\n" 718 "<html xmlns=\"http://www.w3.org/1999/xhtml\" xml:lang=\"en\" lang=\"en\">\n" 719 " <head>\n" 720 " <title>")); 721 http_status_append(b, r->http_status); 722 buffer_append_string_len(b, CONST_STR_LEN( 723 "</title>\n" 724 " </head>\n" 725 " <body>\n" 726 " <h1>")); 727 http_status_append(b, r->http_status); 728 buffer_append_string_len(b, CONST_STR_LEN( 729 "</h1>\n" 730 " </body>\n" 731 "</html>\n")); 732 chunkqueue_append_buffer_commit(&r->write_queue); 733 734 http_header_response_set(r, HTTP_HEADER_CONTENT_TYPE, 735 CONST_STR_LEN("Content-Type"), 736 CONST_STR_LEN("text/html")); 737 } 738 739 740 __attribute_cold__ 741 static void 742 http_response_merge_trailers (request_st * const r) 743 { 744 /* attempt to merge trailers into headers; header not yet sent by caller */ 745 if (buffer_string_is_empty(&r->gw_dechunk->b)) return; 746 const int done = r->gw_dechunk->done; 747 if (!done) return; /* XXX: !done; could scan for '\n' and send only those */ 748 749 /* do not include trailers if success status (when response was read from 750 * backend) subsequently changed to error status. http_chunk could add the 751 * trailers, but such actions are better on a different code layer than in 752 * http_chunk.c */ 753 if (done < 400 && r->http_status >= 400) return; 754 755 /* XXX: trailers passed through; no sanity check currently done 756 * https://tools.ietf.org/html/rfc7230#section-4.1.2 757 * 758 * Not checking for disallowed fields 759 * Not handling (deprecated) line wrapping 760 * Not strictly checking fields 761 */ 762 const char *k = strchr(r->gw_dechunk->b.ptr, '\n'); /*(skip final chunk)*/ 763 if (NULL == k) return; /*(should not happen)*/ 764 ++k; 765 for (const char *v, *e; (e = strchr(k, '\n')); k = e+1) { 766 v = memchr(k, ':', (size_t)(e - k)); 767 if (NULL == v || v == k || *k == ' ' || *k == '\t') continue; 768 uint32_t klen = (uint32_t)(v - k); 769 do { ++v; } while (*v == ' ' || *v == '\t'); 770 if (*v == '\r' || *v == '\n') continue; 771 enum http_header_e id = http_header_hkey_get(k, klen); 772 http_header_response_insert(r, id, k, klen, v, (size_t)(e - v)); 773 } 774 http_header_response_unset(r, HTTP_HEADER_OTHER, CONST_STR_LEN("Trailer")); 775 buffer_clear(&r->gw_dechunk->b); 776 } 777 778 779 static handler_t 780 http_response_write_prepare(request_st * const r) 781 { 782 if (NULL == r->handler_module) { 783 /* static files */ 784 switch(r->http_method) { 785 case HTTP_METHOD_GET: 786 case HTTP_METHOD_POST: 787 case HTTP_METHOD_HEAD: 788 break; 789 case HTTP_METHOD_OPTIONS: 790 if ((!r->http_status || r->http_status == 200) 791 && !buffer_string_is_empty(&r->uri.path) 792 && r->uri.path.ptr[0] != '*') { 793 http_response_body_clear(r, 0); 794 http_header_response_append(r, HTTP_HEADER_ALLOW, 795 CONST_STR_LEN("Allow"), 796 CONST_STR_LEN("OPTIONS, GET, HEAD, POST")); 797 r->http_status = 200; 798 r->resp_body_finished = 1; 799 } 800 break; 801 default: 802 if (r->http_status == 0) 803 r->http_status = 501; 804 break; 805 } 806 } 807 808 switch (r->http_status) { 809 case 200: /* common case */ 810 break; 811 case 204: /* class: header only */ 812 case 205: 813 case 304: 814 /* disable chunked encoding again as we have no body */ 815 http_response_body_clear(r, 1); 816 /* no Content-Body, no Content-Length */ 817 http_header_response_unset(r, HTTP_HEADER_CONTENT_LENGTH, 818 CONST_STR_LEN("Content-Length")); 819 r->resp_body_finished = 1; 820 break; 821 default: /* class: header + body */ 822 if (r->http_status == 0) 823 r->http_status = 403; 824 /* only custom body for 4xx and 5xx */ 825 if (r->http_status >= 400 && r->http_status < 600) 826 http_response_static_errdoc(r); 827 break; 828 } 829 830 if (r->gw_dechunk) 831 http_response_merge_trailers(r); 832 833 /* Allow filter plugins to change response headers */ 834 switch (plugins_call_handle_response_start(r)) { 835 case HANDLER_GO_ON: 836 case HANDLER_FINISHED: 837 break; 838 default: 839 log_error(r->conf.errh, __FILE__, __LINE__, 840 "response_start plugin failed"); 841 return HANDLER_ERROR; 842 } 843 844 if (r->resp_body_finished) { 845 /* check for Range request (current impl requires resp_body_finished) */ 846 if (r->conf.range_requests && http_range_rfc7233(r) >= 400) 847 http_response_static_errdoc(r); /* 416 Range Not Satisfiable */ 848 849 /* set content-length if length is known and not already set */ 850 if (!(r->resp_htags 851 & (light_bshift(HTTP_HEADER_CONTENT_LENGTH) 852 |light_bshift(HTTP_HEADER_TRANSFER_ENCODING)))) { 853 off_t qlen = chunkqueue_length(&r->write_queue); 854 /** 855 * The Content-Length header can only be sent if we have content: 856 * - HEAD does not have a content-body (but can have content-length) 857 * - 1xx, 204 and 304 does not have a content-body 858 * (RFC 2616 Section 4.3) 859 * 860 * Otherwise generate a Content-Length header 861 * (if chunked encoding is not available) 862 * 863 * (should not reach here if 1xx (r->http_status < 200)) 864 */ 865 if (qlen > 0) { 866 buffer_append_int( 867 http_header_response_set_ptr(r, HTTP_HEADER_CONTENT_LENGTH, 868 CONST_STR_LEN("Content-Length")), 869 qlen); 870 } 871 else if (r->http_method != HTTP_METHOD_HEAD 872 && r->http_status != 204 && r->http_status != 304) { 873 /* Content-Length: 0 is important for Redirects (301, ...) as 874 * there might be content. */ 875 http_header_response_set(r, HTTP_HEADER_CONTENT_LENGTH, 876 CONST_STR_LEN("Content-Length"), 877 CONST_STR_LEN("0")); 878 } 879 } 880 } 881 else if (r->http_version == HTTP_VERSION_2) { 882 /* handled by HTTP/2 framing */ 883 } 884 else { 885 /** 886 * response is not yet finished, but we have all headers 887 * 888 * keep-alive requires one of: 889 * - Content-Length: ... (HTTP/1.0 and HTTP/1.0) 890 * - Transfer-Encoding: chunked (HTTP/1.1) 891 * - Upgrade: ... (lighttpd then acts as transparent proxy) 892 */ 893 894 if (!(r->resp_htags 895 & (light_bshift(HTTP_HEADER_CONTENT_LENGTH) 896 |light_bshift(HTTP_HEADER_TRANSFER_ENCODING) 897 |light_bshift(HTTP_HEADER_UPGRADE)))) { 898 if (r->http_method == HTTP_METHOD_CONNECT && r->http_status == 200){ 899 /*(no transfer-encoding if successful CONNECT)*/ 900 } 901 else if (r->http_version == HTTP_VERSION_1_1) { 902 off_t qlen = chunkqueue_length(&r->write_queue); 903 r->resp_send_chunked = 1; 904 if (qlen) { 905 /* create initial Transfer-Encoding: chunked segment */ 906 buffer * const b = 907 chunkqueue_prepend_buffer_open(&r->write_queue); 908 if (r->resp_decode_chunked 909 && 0 != r->gw_dechunk->gw_chunked) { 910 /*(reconstitute initial partially-decoded chunk)*/ 911 off_t gw_chunked = r->gw_dechunk->gw_chunked; 912 if (gw_chunked > 2) 913 qlen += gw_chunked - 2; 914 else if (1 == gw_chunked) 915 chunkqueue_append_mem(&r->write_queue, 916 CONST_STR_LEN("\r")); 917 } 918 else { 919 chunkqueue_append_mem(&r->write_queue, 920 CONST_STR_LEN("\r\n")); 921 } 922 buffer_append_uint_hex(b, (uintmax_t)qlen); 923 buffer_append_string_len(b, CONST_STR_LEN("\r\n")); 924 chunkqueue_prepend_buffer_commit(&r->write_queue); 925 } 926 http_header_response_append(r, HTTP_HEADER_TRANSFER_ENCODING, 927 CONST_STR_LEN("Transfer-Encoding"), 928 CONST_STR_LEN("chunked")); 929 } 930 else { /* if (r->http_version == HTTP_VERSION_1_0) */ 931 r->keep_alive = 0; 932 } 933 } 934 } 935 936 if (r->http_method == HTTP_METHOD_HEAD) { 937 /* HEAD request is like a GET, but without the content */ 938 http_response_body_clear(r, 1); 939 r->resp_body_finished = 1; 940 } 941 942 return HANDLER_GO_ON; 943 } 944 945 946 __attribute_cold__ 947 static handler_t 948 http_response_call_error_handler (request_st * const r, const buffer * const error_handler) 949 { 950 /* call error-handler */ 951 952 /* set REDIRECT_STATUS to save current HTTP status code 953 * for access by dynamic handlers 954 * https://redmine.lighttpd.net/issues/1828 */ 955 buffer_append_int( 956 http_header_env_set_ptr(r, CONST_STR_LEN("REDIRECT_STATUS")), 957 r->http_status); 958 959 if (error_handler == r->conf.error_handler) { 960 plugins_call_handle_request_reset(r); 961 962 if (r->reqbody_length) { 963 if (r->reqbody_length != r->reqbody_queue.bytes_in) 964 r->keep_alive = 0; 965 r->reqbody_length = 0; 966 chunkqueue_reset(&r->reqbody_queue); 967 } 968 969 r->con->is_writable = 1; 970 r->resp_body_finished = 0; 971 r->resp_body_started = 0; 972 973 r->error_handler_saved_status = r->http_status; 974 r->error_handler_saved_method = r->http_method; 975 976 r->http_method = HTTP_METHOD_GET; 977 } 978 else { /*(preserve behavior for server.error-handler-404)*/ 979 /*(negative to flag old behavior)*/ 980 r->error_handler_saved_status = -r->http_status; 981 } 982 983 if (r->http_version == HTTP_VERSION_UNSET) 984 r->http_version = HTTP_VERSION_1_0; 985 986 buffer_copy_buffer(&r->target, error_handler); 987 http_response_errdoc_init(r); 988 r->http_status = 0; /*(after http_response_errdoc_init())*/ 989 http_response_comeback(r); 990 return HANDLER_COMEBACK; 991 } 992 993 994 handler_t 995 http_response_handler (request_st * const r) 996 { 997 const plugin *p = r->handler_module; 998 int rc; 999 if (NULL != p 1000 || ((rc = http_response_prepare(r)) == HANDLER_GO_ON 1001 && NULL != (p = r->handler_module))) 1002 rc = p->handle_subrequest(r, p->data); 1003 1004 switch (rc) { 1005 case HANDLER_WAIT_FOR_EVENT: 1006 if (!r->resp_body_finished 1007 && (!r->resp_body_started 1008 || 0 == (r->conf.stream_response_body 1009 & (FDEVENT_STREAM_RESPONSE 1010 |FDEVENT_STREAM_RESPONSE_BUFMIN)))) 1011 return HANDLER_WAIT_FOR_EVENT; /* come back here */ 1012 /* response headers received from backend; start response */ 1013 __attribute_fallthrough__ 1014 case HANDLER_GO_ON: 1015 case HANDLER_FINISHED: /*(HANDLER_FINISHED if request not handled)*/ 1016 if (r->http_status == 0) r->http_status = 200; 1017 if (r->error_handler_saved_status > 0) 1018 r->http_method = r->error_handler_saved_method; 1019 if (NULL == r->handler_module || r->conf.error_intercept) { 1020 if (r->error_handler_saved_status) { 1021 const int subreq_status = r->http_status; 1022 if (r->error_handler_saved_status > 0) 1023 r->http_status = r->error_handler_saved_status; 1024 else if (r->http_status == 404 || r->http_status == 403) 1025 /* error-handler-404 is a 404 */ 1026 r->http_status = -r->error_handler_saved_status; 1027 else { 1028 /* error-handler-404 is back and has generated content */ 1029 /* if Status: was set, take it otherwise use 200 */ 1030 } 1031 if (200 <= subreq_status && subreq_status <= 299) { 1032 /*(flag value to indicate that error handler succeeded) 1033 *(for (NULL == r->handler_module))*/ 1034 r->error_handler_saved_status = 65535; /* >= 1000 */ 1035 } 1036 } 1037 else if (r->http_status >= 400) { 1038 const buffer *error_handler = NULL; 1039 if (!buffer_string_is_empty(r->conf.error_handler)) 1040 error_handler = r->conf.error_handler; 1041 else if ((r->http_status == 404 || r->http_status == 403) 1042 && !buffer_string_is_empty(r->conf.error_handler_404)) 1043 error_handler = r->conf.error_handler_404; 1044 1045 if (error_handler) 1046 return http_response_call_error_handler(r, error_handler); 1047 } 1048 } 1049 1050 /* we have something to send; go on */ 1051 /*(CON_STATE_RESPONSE_START; transient state)*/ 1052 return http_response_write_prepare(r); 1053 case HANDLER_WAIT_FOR_FD: 1054 return HANDLER_WAIT_FOR_FD; 1055 case HANDLER_COMEBACK: 1056 http_response_comeback(r); 1057 return HANDLER_COMEBACK; 1058 /*case HANDLER_ERROR:*/ 1059 default: 1060 return HANDLER_ERROR; /* something went wrong */ 1061 } 1062 } 1063