1 #include "first.h" 2 3 #include "response.h" 4 #include "request.h" 5 #include "base.h" 6 #include "burl.h" 7 #include "fdevent.h" 8 #include "http_header.h" 9 #include "http_kv.h" 10 #include "log.h" 11 #include "stat_cache.h" 12 #include "chunk.h" 13 14 #include "plugin.h" 15 16 #include <sys/types.h> 17 #include <sys/stat.h> 18 19 #include <limits.h> 20 #include <errno.h> 21 #include <stdlib.h> 22 #include <string.h> 23 #include <time.h> 24 25 __attribute_cold__ 26 static int http_response_omit_header(request_st * const r, const data_string * const ds) { 27 const size_t klen = buffer_string_length(&ds->key); 28 if (klen == sizeof("X-Sendfile")-1 29 && buffer_eq_icase_ssn(ds->key.ptr, CONST_STR_LEN("X-Sendfile"))) 30 return 1; 31 if (klen >= sizeof("X-LIGHTTPD-")-1 32 && buffer_eq_icase_ssn(ds->key.ptr, CONST_STR_LEN("X-LIGHTTPD-"))) { 33 if (klen == sizeof("X-LIGHTTPD-KBytes-per-second")-1 34 && buffer_eq_icase_ssn(ds->key.ptr+sizeof("X-LIGHTTPD-")-1, 35 CONST_STR_LEN("KBytes-per-second"))) { 36 /* "X-LIGHTTPD-KBytes-per-second" */ 37 off_t limit = strtol(ds->value.ptr, NULL, 10) << 10; /*(*=1024)*/ 38 if (limit > 0 39 && (limit < r->conf.bytes_per_second 40 || 0 == r->conf.bytes_per_second)) { 41 r->conf.bytes_per_second = limit; 42 } 43 } 44 return 1; 45 } 46 return 0; 47 } 48 49 int http_response_write_header(request_st * const r) { 50 chunkqueue * const cq = r->write_queue; 51 buffer * const b = chunkqueue_prepend_buffer_open(cq); 52 53 if (r->http_version == HTTP_VERSION_1_1) { 54 buffer_copy_string_len(b, CONST_STR_LEN("HTTP/1.1 ")); 55 } else { 56 buffer_copy_string_len(b, CONST_STR_LEN("HTTP/1.0 ")); 57 } 58 http_status_append(b, r->http_status); 59 60 /* disable keep-alive if requested */ 61 62 if (r->con->request_count > r->conf.max_keep_alive_requests || 0 == r->conf.max_keep_alive_idle) { 63 r->keep_alive = 0; 64 } else if (0 != r->reqbody_length 65 && r->reqbody_length != r->reqbody_queue->bytes_in 66 && (NULL == r->handler_module 67 || 0 == (r->conf.stream_request_body 68 & (FDEVENT_STREAM_REQUEST 69 | FDEVENT_STREAM_REQUEST_BUFMIN)))) { 70 r->keep_alive = 0; 71 } else { 72 r->con->keep_alive_idle = r->conf.max_keep_alive_idle; 73 } 74 75 if ((r->resp_htags & HTTP_HEADER_UPGRADE) && r->http_version == HTTP_VERSION_1_1) { 76 http_header_response_set(r, HTTP_HEADER_CONNECTION, CONST_STR_LEN("Connection"), CONST_STR_LEN("upgrade")); 77 } else if (0 == r->keep_alive) { 78 http_header_response_set(r, HTTP_HEADER_CONNECTION, CONST_STR_LEN("Connection"), CONST_STR_LEN("close")); 79 } else if (r->http_version == HTTP_VERSION_1_0) {/*(&& r->keep_alive != 0)*/ 80 http_header_response_set(r, HTTP_HEADER_CONNECTION, CONST_STR_LEN("Connection"), CONST_STR_LEN("keep-alive")); 81 } 82 83 if (304 == r->http_status && (r->resp_htags & HTTP_HEADER_CONTENT_ENCODING)) { 84 http_header_response_unset(r, HTTP_HEADER_CONTENT_ENCODING, CONST_STR_LEN("Content-Encoding")); 85 } 86 87 /* add all headers */ 88 for (size_t i = 0; i < r->resp_headers.used; ++i) { 89 const data_string * const ds = (data_string *)r->resp_headers.data[i]; 90 91 if (buffer_string_is_empty(&ds->value)) continue; 92 if (buffer_string_is_empty(&ds->key)) continue; 93 if ((ds->key.ptr[0] & 0xdf) == 'X' && http_response_omit_header(r, ds)) 94 continue; 95 96 buffer_append_string_len(b, CONST_STR_LEN("\r\n")); 97 buffer_append_string_buffer(b, &ds->key); 98 buffer_append_string_len(b, CONST_STR_LEN(": ")); 99 buffer_append_string_buffer(b, &ds->value); 100 } 101 102 if (!(r->resp_htags & HTTP_HEADER_DATE)) { 103 static time_t tlast; 104 static char tstr[32]; /* 30-chars for "%a, %d %b %Y %H:%M:%S GMT" */ 105 static size_t tlen; 106 107 /* HTTP/1.1 requires a Date: header */ 108 buffer_append_string_len(b, CONST_STR_LEN("\r\nDate: ")); 109 110 /* cache the generated timestamp */ 111 const time_t cur_ts = log_epoch_secs; 112 if (tlast != cur_ts) { 113 tlast = cur_ts; 114 tlen = strftime(tstr, sizeof(tstr), 115 "%a, %d %b %Y %H:%M:%S GMT", gmtime(&tlast)); 116 } 117 118 buffer_append_string_len(b, tstr, tlen); 119 } 120 121 if (!(r->resp_htags & HTTP_HEADER_SERVER)) { 122 if (!buffer_string_is_empty(r->conf.server_tag)) { 123 buffer_append_string_len(b, CONST_STR_LEN("\r\nServer: ")); 124 buffer_append_string_len(b, CONST_BUF_LEN(r->conf.server_tag)); 125 } 126 } 127 128 buffer_append_string_len(b, CONST_STR_LEN("\r\n\r\n")); 129 130 r->resp_header_len = buffer_string_length(b); 131 132 if (r->conf.log_response_header) { 133 log_error(r->conf.errh,__FILE__,__LINE__,"Response-Header:\n%s",b->ptr); 134 } 135 136 chunkqueue_prepend_buffer_commit(cq); 137 return 0; 138 } 139 140 static handler_t http_response_physical_path_check(request_st * const r) { 141 stat_cache_entry *sce = stat_cache_get_entry(&r->physical.path); 142 143 if (sce) { 144 /* file exists */ 145 } else { 146 char *pathinfo = NULL; 147 switch (errno) { 148 case EACCES: 149 r->http_status = 403; 150 151 if (r->conf.log_request_handling) { 152 log_error(r->conf.errh, __FILE__, __LINE__, 153 "-- access denied"); 154 log_error(r->conf.errh, __FILE__, __LINE__, 155 "Path : %s", r->physical.path.ptr); 156 } 157 158 buffer_reset(&r->physical.path); 159 return HANDLER_FINISHED; 160 case ENAMETOOLONG: 161 /* file name to be read was too long. return 404 */ 162 case ENOENT: 163 if (r->http_method == HTTP_METHOD_OPTIONS 164 && NULL != http_header_response_get(r, HTTP_HEADER_OTHER, CONST_STR_LEN("Allow"))) { 165 r->http_status = 200; 166 return HANDLER_FINISHED; 167 } 168 169 r->http_status = 404; 170 171 if (r->conf.log_request_handling) { 172 log_error(r->conf.errh, __FILE__, __LINE__, 173 "-- file not found"); 174 log_error(r->conf.errh, __FILE__, __LINE__, 175 "Path : %s", r->physical.path.ptr); 176 } 177 178 buffer_reset(&r->physical.path); 179 return HANDLER_FINISHED; 180 case ENOTDIR: 181 /* PATH_INFO ! :) */ 182 break; 183 default: 184 /* we have no idea what happened. let's tell the user so. */ 185 log_error(r->conf.errh, __FILE__, __LINE__, 186 "file not found ... or so: %s -> %s", 187 r->uri.path.ptr, r->physical.path.ptr); 188 189 r->http_status = 500; 190 buffer_reset(&r->physical.path); 191 192 return HANDLER_FINISHED; 193 } 194 195 /* not found, perhaps PATHINFO */ 196 197 { 198 /*(might check at startup that s->document_root does not end in '/')*/ 199 size_t len = buffer_string_length(&r->physical.basedir); 200 if (len > 0 && '/' == r->physical.basedir.ptr[len-1]) --len; 201 pathinfo = r->physical.path.ptr + len; 202 if ('/' != *pathinfo) { 203 pathinfo = NULL; 204 } 205 else if (pathinfo == r->physical.path.ptr) { /*(basedir is "/")*/ 206 pathinfo = strchr(pathinfo+1, '/'); 207 } 208 } 209 210 buffer * const tb = r->tmp_buf; 211 for (char *pprev = pathinfo; pathinfo; pprev = pathinfo, pathinfo = strchr(pathinfo+1, '/')) { 212 buffer_copy_string_len(tb, r->physical.path.ptr, pathinfo - r->physical.path.ptr); 213 stat_cache_entry *nsce = stat_cache_get_entry(tb); 214 if (NULL == nsce) { 215 pathinfo = pathinfo != pprev ? pprev : NULL; 216 break; 217 } 218 sce = nsce; 219 if (!S_ISDIR(sce->st.st_mode)) break; 220 } 221 222 if (NULL == pathinfo || !S_ISREG(sce->st.st_mode)) { 223 /* no it really doesn't exists */ 224 r->http_status = 404; 225 226 if (r->conf.log_file_not_found) { 227 log_error(r->conf.errh, __FILE__, __LINE__, 228 "file not found: %s -> %s", 229 r->uri.path.ptr, r->physical.path.ptr); 230 } 231 232 buffer_reset(&r->physical.path); 233 234 return HANDLER_FINISHED; 235 } 236 237 /* we have a PATHINFO */ 238 if (pathinfo) { 239 size_t len = strlen(pathinfo), reqlen; 240 if (r->conf.force_lowercase_filenames 241 && len <= (reqlen = buffer_string_length(&r->target)) 242 && buffer_eq_icase_ssn(r->target.ptr + reqlen - len, pathinfo, len)) { 243 /* attempt to preserve case-insensitive PATH_INFO 244 * (works in common case where mod_alias, mod_magnet, and other modules 245 * have not modified the PATH_INFO portion of request URI, or did so 246 * with exactly the PATH_INFO desired) */ 247 buffer_copy_string_len(&r->pathinfo, r->target.ptr + reqlen - len, len); 248 } else { 249 buffer_copy_string_len(&r->pathinfo, pathinfo, len); 250 } 251 252 /* 253 * shorten uri.path 254 */ 255 256 buffer_string_set_length(&r->uri.path, buffer_string_length(&r->uri.path) - len); 257 buffer_string_set_length(&r->physical.path, (size_t)(pathinfo - r->physical.path.ptr)); 258 } 259 } 260 261 if (!r->conf.follow_symlink 262 && 0 != stat_cache_path_contains_symlink(&r->physical.path, r->conf.errh)) { 263 r->http_status = 403; 264 265 if (r->conf.log_request_handling) { 266 log_error(r->conf.errh, __FILE__, __LINE__, 267 "-- access denied due symlink restriction"); 268 log_error(r->conf.errh, __FILE__, __LINE__, 269 "Path : %s", r->physical.path.ptr); 270 } 271 272 buffer_reset(&r->physical.path); 273 return HANDLER_FINISHED; 274 } 275 276 if (S_ISDIR(sce->st.st_mode)) { 277 if (r->uri.path.ptr[buffer_string_length(&r->uri.path) - 1] != '/') { 278 /* redirect to .../ */ 279 280 http_response_redirect_to_directory(r, 301); 281 282 return HANDLER_FINISHED; 283 } 284 } else if (!S_ISREG(sce->st.st_mode)) { 285 /* any special handling of non-reg files ?*/ 286 } 287 288 return HANDLER_GO_ON; 289 } 290 291 __attribute_cold__ 292 __attribute_noinline__ 293 static handler_t http_status_set_error_close (request_st * const r, int status) { 294 r->keep_alive = 0; 295 r->resp_body_finished = 1; 296 r->handler_module = NULL; 297 r->http_status = status; 298 return HANDLER_FINISHED; 299 } 300 301 static handler_t http_response_config (request_st * const r) { 302 if (r->conf.log_condition_handling) 303 log_error(r->conf.errh, __FILE__, __LINE__, "run condition"); 304 305 config_cond_cache_reset(r); 306 config_patch_config(r); 307 308 /* do we have to downgrade to 1.0 ? */ 309 if (!r->conf.allow_http11) 310 r->http_version = HTTP_VERSION_1_0; 311 312 /* r->conf.max_request_size is in kBytes */ 313 if (0 != r->conf.max_request_size && 314 (off_t)r->reqbody_length > ((off_t)r->conf.max_request_size << 10)) { 315 log_error(r->conf.errh, __FILE__, __LINE__, 316 "request-size too long: %lld -> 413", (long long) r->reqbody_length); 317 return /* 413 Payload Too Large */ 318 http_status_set_error_close(r, 413); 319 } 320 321 return HANDLER_GO_ON; 322 } 323 324 handler_t http_response_prepare(request_st * const r) { 325 handler_t rc; 326 327 do { 328 329 /* looks like someone has already made a decision */ 330 if (r->http_status != 0 && r->http_status != 200) { 331 if (0 == r->resp_body_finished) 332 http_response_body_clear(r, 0); 333 return HANDLER_FINISHED; 334 } 335 336 /* no decision yet, build conf->filename */ 337 if (buffer_is_empty(&r->physical.path)) { 338 339 if (!r->async_callback) { 340 rc = http_response_config(r); 341 if (HANDLER_GO_ON != rc) continue; 342 } 343 r->async_callback = 0; /* reset */ 344 345 /* we only come here when we have the parse the full request again 346 * 347 * a HANDLER_COMEBACK from mod_rewrite and mod_fastcgi might be a 348 * problem here as mod_setenv might get called multiple times 349 * 350 * fastcgi-auth might lead to a COMEBACK too 351 * fastcgi again dead server too 352 */ 353 354 if (r->conf.log_request_handling) { 355 log_error(r->conf.errh, __FILE__, __LINE__, 356 "-- parsed Request-URI"); 357 log_error(r->conf.errh, __FILE__, __LINE__, 358 "Request-URI : %s", r->target.ptr); 359 log_error(r->conf.errh, __FILE__, __LINE__, 360 "URI-scheme : %s", r->uri.scheme.ptr); 361 log_error(r->conf.errh, __FILE__, __LINE__, 362 "URI-authority : %s", r->uri.authority.ptr); 363 log_error(r->conf.errh, __FILE__, __LINE__, 364 "URI-path (clean): %s", r->uri.path.ptr); 365 log_error(r->conf.errh, __FILE__, __LINE__, 366 "URI-query : %.*s", 367 BUFFER_INTLEN_PTR(&r->uri.query)); 368 } 369 370 371 /** 372 * 373 * call plugins 374 * 375 * - based on the raw URL 376 * 377 */ 378 379 rc = plugins_call_handle_uri_raw(r); 380 if (HANDLER_GO_ON != rc) continue; 381 382 /** 383 * 384 * call plugins 385 * 386 * - based on the clean URL 387 * 388 */ 389 390 rc = plugins_call_handle_uri_clean(r); 391 if (HANDLER_GO_ON != rc) continue; 392 393 if (r->http_method == HTTP_METHOD_OPTIONS && 394 r->uri.path.ptr[0] == '*' && r->uri.path.ptr[1] == '\0') { 395 /* option requests are handled directly without checking of the path */ 396 397 http_header_response_append(r, HTTP_HEADER_OTHER, CONST_STR_LEN("Allow"), CONST_STR_LEN("OPTIONS, GET, HEAD, POST")); 398 399 r->http_status = 200; 400 r->resp_body_finished = 1; 401 402 return HANDLER_FINISHED; 403 } 404 405 if (r->http_method == HTTP_METHOD_CONNECT && NULL == r->handler_module) { 406 return /* 405 Method Not Allowed */ 407 http_status_set_error_close(r, 405); 408 } 409 410 /*** 411 * 412 * border 413 * 414 * logical filename (URI) becomes a physical filename here 415 * 416 * 417 * 418 */ 419 420 421 422 423 /* 1. stat() 424 * ... ISREG() -> ok, go on 425 * ... ISDIR() -> index-file -> redirect 426 * 427 * 2. pathinfo() 428 * ... ISREG() 429 * 430 * 3. -> 404 431 * 432 */ 433 434 /* 435 * SEARCH DOCUMENT ROOT 436 */ 437 438 /* set a default */ 439 440 buffer_copy_buffer(&r->physical.doc_root, r->conf.document_root); 441 buffer_copy_buffer(&r->physical.rel_path, &r->uri.path); 442 443 #if defined(__WIN32) || defined(__CYGWIN__) 444 /* strip dots from the end and spaces 445 * 446 * windows/dos handle those filenames as the same file 447 * 448 * foo == foo. == foo..... == "foo... " == "foo.. ./" 449 * 450 * This will affect in some cases PATHINFO 451 * 452 * on native windows we could prepend the filename with \\?\ to circumvent 453 * this behaviour. I have no idea how to push this through cygwin 454 * 455 * */ 456 457 if (!buffer_string_is_empty(&r->physical.rel_path)) { 458 buffer *b = &r->physical.rel_path; 459 size_t len = buffer_string_length(b); 460 461 /* strip trailing " /" or "./" once */ 462 if (len > 1 && 463 b->ptr[len - 1] == '/' && 464 (b->ptr[len - 2] == ' ' || b->ptr[len - 2] == '.')) { 465 len -= 2; 466 } 467 /* strip all trailing " " and "." */ 468 while (len > 0 && ( ' ' == b->ptr[len-1] || '.' == b->ptr[len-1] ) ) --len; 469 buffer_string_set_length(b, len); 470 } 471 #endif 472 473 if (r->conf.log_request_handling) { 474 log_error(r->conf.errh, __FILE__, __LINE__, 475 "-- before doc_root"); 476 log_error(r->conf.errh, __FILE__, __LINE__, 477 "Doc-Root : %s", r->physical.doc_root.ptr); 478 log_error(r->conf.errh, __FILE__, __LINE__, 479 "Rel-Path : %s", r->physical.rel_path.ptr); 480 log_error(r->conf.errh, __FILE__, __LINE__, 481 "Path : %s", r->physical.path.ptr); 482 } 483 /* the docroot plugin should set the doc_root and might also set the physical.path 484 * for us (all vhost-plugins are supposed to set the doc_root) 485 * */ 486 rc = plugins_call_handle_docroot(r); 487 if (HANDLER_GO_ON != rc) continue; 488 489 /* MacOS X and Windows can't distinguish between upper and lower-case 490 * 491 * convert to lower-case 492 */ 493 if (r->conf.force_lowercase_filenames) { 494 buffer_to_lower(&r->physical.rel_path); 495 } 496 497 /* the docroot plugins might set the servername, if they don't we take http-host */ 498 if (buffer_string_is_empty(r->server_name)) { 499 r->server_name = &r->uri.authority; 500 } 501 502 /** 503 * create physical filename 504 * -> physical.path = docroot + rel_path 505 * 506 */ 507 508 buffer_copy_buffer(&r->physical.basedir, &r->physical.doc_root); 509 buffer_copy_buffer(&r->physical.path, &r->physical.doc_root); 510 buffer_append_path_len(&r->physical.path, CONST_BUF_LEN(&r->physical.rel_path)); 511 512 if (r->conf.log_request_handling) { 513 log_error(r->conf.errh, __FILE__, __LINE__, 514 "-- after doc_root"); 515 log_error(r->conf.errh, __FILE__, __LINE__, 516 "Doc-Root : %s", r->physical.doc_root.ptr); 517 log_error(r->conf.errh, __FILE__, __LINE__, 518 "Rel-Path : %s", r->physical.rel_path.ptr); 519 log_error(r->conf.errh, __FILE__, __LINE__, 520 "Path : %s", r->physical.path.ptr); 521 } 522 523 if (r->http_method == HTTP_METHOD_CONNECT) { 524 /* do not permit CONNECT requests to hit filesystem hooks 525 * since the CONNECT URI bypassed path normalization */ 526 /* (This check is located here so that r->physical.path 527 * is filled in above to avoid repeating work next time 528 * http_response_prepare() is called while processing request) */ 529 } else { 530 rc = plugins_call_handle_physical(r); 531 if (HANDLER_GO_ON != rc) continue; 532 533 if (r->conf.log_request_handling) { 534 log_error(r->conf.errh, __FILE__, __LINE__, 535 "-- logical -> physical"); 536 log_error(r->conf.errh, __FILE__, __LINE__, 537 "Doc-Root : %s", r->physical.doc_root.ptr); 538 log_error(r->conf.errh, __FILE__, __LINE__, 539 "Basedir : %s", r->physical.basedir.ptr); 540 log_error(r->conf.errh, __FILE__, __LINE__, 541 "Rel-Path : %s", r->physical.rel_path.ptr); 542 log_error(r->conf.errh, __FILE__, __LINE__, 543 "Path : %s", r->physical.path.ptr); 544 } 545 } 546 } 547 548 if (NULL != r->handler_module) return HANDLER_GO_ON; 549 550 /* 551 * No module grabbed the request yet (like mod_access) 552 * 553 * Go on and check of the file exists at all 554 */ 555 556 if (r->conf.log_request_handling) { 557 log_error(r->conf.errh, __FILE__, __LINE__, 558 "-- handling physical path"); 559 log_error(r->conf.errh, __FILE__, __LINE__, 560 "Path : %s", r->physical.path.ptr); 561 } 562 563 rc = http_response_physical_path_check(r); 564 if (HANDLER_GO_ON != rc) continue; 565 566 if (r->conf.log_request_handling) { 567 log_error(r->conf.errh, __FILE__, __LINE__, 568 "-- handling subrequest"); 569 log_error(r->conf.errh, __FILE__, __LINE__, 570 "Path : %s", r->physical.path.ptr); 571 log_error(r->conf.errh, __FILE__, __LINE__, 572 "URI : %s", r->uri.path.ptr); 573 log_error(r->conf.errh, __FILE__, __LINE__, 574 "Pathinfo : %s", r->pathinfo.ptr); 575 } 576 577 /* call the handlers */ 578 rc = plugins_call_handle_subrequest_start(r); 579 if (HANDLER_GO_ON != rc) { 580 if (r->conf.log_request_handling) { 581 log_error(r->conf.errh, __FILE__, __LINE__, 582 "-- subrequest finished"); 583 } 584 continue; 585 } 586 587 /* if we are still here, no one wanted the file, status 403 is ok I think */ 588 if (NULL == r->handler_module && 0 == r->http_status) { 589 r->http_status = (r->http_method != HTTP_METHOD_OPTIONS) ? 403 : 200; 590 return HANDLER_FINISHED; 591 } 592 593 return HANDLER_GO_ON; 594 595 } while (HANDLER_COMEBACK == rc 596 && HANDLER_GO_ON ==(rc = http_response_comeback(r))); 597 598 return rc; 599 } 600 601 handler_t http_response_comeback (request_st * const r) 602 { 603 if (NULL != r->handler_module || !buffer_is_empty(&r->physical.path)) 604 return HANDLER_GO_ON; 605 606 config_reset_config(r); 607 608 buffer_copy_buffer(&r->uri.authority,r->http_host);/*copy even if NULL*/ 609 buffer_to_lower(&r->uri.authority); 610 611 int status = http_request_parse_target(r, r->con->proto_default_port); 612 if (0 == status) { 613 r->conditional_is_valid = (1 << COMP_SERVER_SOCKET) 614 | (1 << COMP_HTTP_SCHEME) 615 | (1 << COMP_HTTP_HOST) 616 | (1 << COMP_HTTP_REMOTE_IP) 617 | (1 << COMP_HTTP_REQUEST_METHOD) 618 | (1 << COMP_HTTP_URL) 619 | (1 << COMP_HTTP_QUERY_STRING) 620 | (1 << COMP_HTTP_REQUEST_HEADER); 621 return HANDLER_GO_ON; 622 } 623 else { 624 r->conditional_is_valid = (1 << COMP_SERVER_SOCKET) 625 | (1 << COMP_HTTP_REMOTE_IP); 626 config_cond_cache_reset(r); 627 return http_status_set_error_close(r, status); 628 } 629 } 630