lighttpd 1.4.x https://www.lighttpd.net/
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

1798 lines
60 KiB

#include "first.h"
#include "sys-time.h"
#include "base.h"
#include "array.h"
#include "buffer.h"
#include "chunk.h"
#include "fdevent.h"
#include "log.h"
#include "http_chunk.h"
#include "http_date.h"
#include "http_etag.h"
#include "http_header.h"
#include "response.h"
#include "sock_addr.h"
#include "stat_cache.h"
#include <stdlib.h>
#include <string.h>
#include <errno.h>
#include <fcntl.h>
#include "sys-socket.h"
#include <unistd.h>
/**
* max size of the HTTP response header from backends
* (differs from server.max-request-field-size for max request field size)
*/
#define MAX_HTTP_RESPONSE_FIELD_SIZE 65535
__attribute_cold__
int http_response_buffer_append_authority(request_st * const r, buffer * const o) {
if (!buffer_string_is_empty(&r->uri.authority)) {
buffer_append_string_buffer(o, &r->uri.authority);
} else {
/* get the name of the currently connected socket */
sock_addr our_addr;
socklen_t our_addr_len;
our_addr.plain.sa_family = 0;
our_addr_len = sizeof(our_addr);
if (-1 == getsockname(r->con->fd, (struct sockaddr *)&our_addr, &our_addr_len)
|| our_addr_len > (socklen_t)sizeof(our_addr)) {
r->http_status = 500;
log_perror(r->conf.errh, __FILE__, __LINE__, "can't get sockname");
return -1;
}
if (our_addr.plain.sa_family == AF_INET
&& our_addr.ipv4.sin_addr.s_addr == htonl(INADDR_LOOPBACK)) {
static char lhost[32];
static size_t lhost_len = 0;
if (0 != lhost_len) {
buffer_append_string_len(o, lhost, lhost_len);
}
else {
size_t olen = buffer_string_length(o);
if (0 == sock_addr_nameinfo_append_buffer(o, &our_addr, r->conf.errh)) {
lhost_len = buffer_string_length(o) - olen;
if (lhost_len < sizeof(lhost)) {
memcpy(lhost, o->ptr+olen, lhost_len+1); /*(+1 for '\0')*/
}
else {
lhost_len = 0;
}
}
else {
lhost_len = sizeof("localhost")-1;
memcpy(lhost, "localhost", lhost_len+1); /*(+1 for '\0')*/
buffer_append_string_len(o, lhost, lhost_len);
}
}
} else if (!buffer_string_is_empty(r->server_name)) {
buffer_append_string_buffer(o, r->server_name);
} else
/* Lookup name: secondly try to get hostname for bind address */
if (0 != sock_addr_nameinfo_append_buffer(o, &our_addr, r->conf.errh)) {
r->http_status = 500;
return -1;
}
{
unsigned short listen_port = sock_addr_get_port(&our_addr);
unsigned short default_port = 80;
if (buffer_is_equal_string(&r->uri.scheme, CONST_STR_LEN("https"))) {
default_port = 443;
}
if (0 == listen_port) listen_port = r->con->srv->srvconf.port;
if (default_port != listen_port) {
buffer_append_string_len(o, CONST_STR_LEN(":"));
buffer_append_int(o, listen_port);
}
}
}
return 0;
}
int http_response_redirect_to_directory(request_st * const r, int status) {
buffer *o = r->tmp_buf;
buffer_clear(o);
/* XXX: store flag in global at startup? */
if (r->con->srv->srvconf.absolute_dir_redirect) {
buffer_copy_buffer(o, &r->uri.scheme);
buffer_append_string_len(o, CONST_STR_LEN("://"));
if (0 != http_response_buffer_append_authority(r, o)) {
return -1;
}
}
buffer_append_string_encoded(o, CONST_BUF_LEN(&r->uri.path), ENCODING_REL_URI);
buffer_append_string_len(o, CONST_STR_LEN("/"));
if (!buffer_string_is_empty(&r->uri.query)) {
buffer_append_string_len(o, CONST_STR_LEN("?"));
buffer_append_string_buffer(o, &r->uri.query);
}
if (status >= 300) {
http_header_response_set(r, HTTP_HEADER_LOCATION,
CONST_STR_LEN("Location"),
CONST_BUF_LEN(o));
r->http_status = status;
r->resp_body_finished = 1;
}
else {
http_header_response_set(r, HTTP_HEADER_CONTENT_LOCATION,
CONST_STR_LEN("Content-Location"),
CONST_BUF_LEN(o));
}
return 0;
}
#define MTIME_CACHE_MAX 16
struct mtime_cache_type {
time_t mtime; /* key */
buffer str; /* buffer for string representation */
};
static struct mtime_cache_type mtime_cache[MTIME_CACHE_MAX];
static char mtime_cache_str[MTIME_CACHE_MAX][30];
/* 30-chars for "%a, %d %b %Y %H:%M:%S GMT" */
void strftime_cache_reset(void) {
for (int i = 0; i < MTIME_CACHE_MAX; ++i) {
mtime_cache[i].mtime = (time_t)-1;
mtime_cache[i].str.ptr = mtime_cache_str[i];
mtime_cache[i].str.used = sizeof(mtime_cache_str[0]);
mtime_cache[i].str.size = sizeof(mtime_cache_str[0]);
}
}
static const buffer * strftime_cache_get(const time_t last_mod) {
static int mtime_cache_idx;
for (int j = 0; j < MTIME_CACHE_MAX; ++j) {
if (mtime_cache[j].mtime == last_mod)
return &mtime_cache[j].str; /* found cache-entry */
}
if (++mtime_cache_idx == MTIME_CACHE_MAX) mtime_cache_idx = 0;
const int i = mtime_cache_idx;
http_date_time_to_str(mtime_cache[i].str.ptr, sizeof(mtime_cache_str[0]),
(mtime_cache[i].mtime = last_mod));
return &mtime_cache[i].str;
}
const buffer * http_response_set_last_modified(request_st * const r, const time_t lmtime) {
const buffer * const mtime = strftime_cache_get(lmtime);
http_header_response_set(r, HTTP_HEADER_LAST_MODIFIED,
CONST_STR_LEN("Last-Modified"),
CONST_BUF_LEN(mtime));
#if 0
return http_header_response_get(r, HTTP_HEADER_LAST_MODIFIED,
CONST_STR_LEN("Last-Modified"));
#else
return mtime;
#endif
}
int http_response_handle_cachable(request_st * const r, const buffer * const lmod, const time_t lmtime) {
const buffer *vb;
/*
* 14.26 If-None-Match
* [...]
* If none of the entity tags match, then the server MAY perform the
* requested method as if the If-None-Match header field did not exist,
* but MUST also ignore any If-Modified-Since header field(s) in the
* request. That is, if no entity tags match, then the server MUST NOT
* return a 304 (Not Modified) response.
*/
if ((vb = http_header_request_get(r, HTTP_HEADER_IF_NONE_MATCH,
CONST_STR_LEN("If-None-Match")))) {
/*(weak etag comparison must not be used for ranged requests)*/
int range_request = (0 != light_btst(r->rqst_htags, HTTP_HEADER_RANGE));
if (http_etag_matches(&r->physical.etag, vb->ptr, !range_request)) {
if (http_method_get_or_head(r->http_method)) {
r->http_status = 304;
return HANDLER_FINISHED;
} else {
r->http_status = 412;
r->handler_module = NULL;
return HANDLER_FINISHED;
}
}
} else if (http_method_get_or_head(r->http_method)
&& (vb = http_header_request_get(r, HTTP_HEADER_IF_MODIFIED_SINCE,
CONST_STR_LEN("If-Modified-Since")))) {
/* last-modified handling */
if (buffer_is_equal(lmod, vb)
|| !http_date_if_modified_since(CONST_BUF_LEN(vb), lmtime)) {
r->http_status = 304;
return HANDLER_FINISHED;
}
}
return HANDLER_GO_ON;
}
void http_response_body_clear (request_st * const r, int preserve_length) {
r->resp_send_chunked = 0;
r->resp_body_scratchpad = -1;
if (light_btst(r->resp_htags, HTTP_HEADER_TRANSFER_ENCODING)) {
http_header_response_unset(r, HTTP_HEADER_TRANSFER_ENCODING,
CONST_STR_LEN("Transfer-Encoding"));
}
if (!preserve_length) { /* preserve for HEAD responses and no-content responses (204, 205, 304) */
if (light_btst(r->resp_htags, HTTP_HEADER_CONTENT_LENGTH)) {
http_header_response_unset(r, HTTP_HEADER_CONTENT_LENGTH,
CONST_STR_LEN("Content-Length"));
}
/*(if not preserving Content-Length, do not preserve trailers, if any)*/
r->resp_decode_chunked = 0;
if (r->gw_dechunk) {
free(r->gw_dechunk->b.ptr);
free(r->gw_dechunk);
r->gw_dechunk = NULL;
}
}
chunkqueue_reset(&r->write_queue);
}
static void http_response_header_clear (request_st * const r) {
r->http_status = 0;
r->resp_htags = 0;
r->resp_header_len = 0;
r->resp_header_repeated = 0;
array_reset_data_strings(&r->resp_headers);
/* Note: http_response_body_clear(r, 0) is not called here
* r->write_queue should be preserved for additional data after 1xx response
* However, if http_response_process_headers() was called and response had
* Transfer-Encoding: chunked set, then other items need to be reset */
r->resp_send_chunked = 0;
r->resp_decode_chunked = 0;
r->resp_body_scratchpad = -1;
if (r->gw_dechunk) {
free(r->gw_dechunk->b.ptr);
free(r->gw_dechunk);
r->gw_dechunk = NULL;
}
}
void http_response_reset (request_st * const r) {
r->http_status = 0;
r->con->is_writable = 1;
r->resp_body_finished = 0;
r->resp_body_started = 0;
r->handler_module = NULL;
if (r->physical.path.ptr) { /*(skip for mod_fastcgi authorizer)*/
buffer_clear(&r->physical.doc_root);
buffer_clear(&r->physical.basedir);
buffer_clear(&r->physical.etag);
buffer_reset(&r->physical.path);
buffer_reset(&r->physical.rel_path);
}
r->resp_htags = 0;
r->resp_header_len = 0;
r->resp_header_repeated = 0;
array_reset_data_strings(&r->resp_headers);
http_response_body_clear(r, 0);
}
handler_t http_response_reqbody_read_error (request_st * const r, int http_status) {
r->keep_alive = 0;
/*(do not change status if response headers already set and possibly sent)*/
if (0 != r->resp_header_len) return HANDLER_ERROR;
http_response_body_clear(r, 0);
r->http_status = http_status;
r->handler_module = NULL;
return HANDLER_FINISHED;
}
static int http_response_coalesce_ranges (off_t * const ranges, int n)
{
/* coalesce/combine overlapping ranges and ranges separated by a
* gap which is smaller than the overhead of sending multiple parts
* (typically around 80 bytes) ([RFC7233] 4.1 206 Partial Content)
* (ranges are known to be positive, so subtract 80 instead of add 80
* to avoid any chance of integer overflow)
* (max n should be limited in caller since a malicious set of ranges has
* n^2 cost for the simplistic algorithm below)
* (sorting the ranges and then combining would lower the cost, but the
* cost should not be an issue since client should not send many ranges
* and caller should restrict the max number of ranges to limit abuse)
* [RFC7233] 4.1 206 Partial Content recommends:
* When a multipart response payload is generated, the server SHOULD send
* the parts in the same order that the corresponding byte-range-spec
* appeared in the received Range header field, excluding those ranges
* that were deemed unsatisfiable or that were coalesced into other ranges
*/
for (int i = 0; i+2 < n; i += 2) {
const off_t b = ranges[i];
const off_t e = ranges[i+1];
for (int j = i+2; j < n; j += 2) {
/* common case: ranges do not overlap */
if (b <= ranges[j] ? e < ranges[j]-80 : ranges[j+1] < b-80)
continue;
/* else ranges do overlap, so combine into first range */
ranges[i] = b <= ranges[j] ? b : ranges[j];
ranges[i+1] = e >= ranges[j+1] ? e : ranges[j+1];
memmove(ranges+j, ranges+j+2, (n-j-2)*sizeof(off_t));
/* restart outer loop from beginning */
n -= 2;
i = -2;
break;
}
}
return n;
}
static int http_response_parse_range(request_st * const r, stat_cache_entry * const sce, const char * const range) {
int n = 0;
int error;
off_t start, end;
const off_t st_size = sce->st.st_size;
const char *s, *minus;
static const char boundary[] = "fkj49sn38dcn3";
const buffer *content_type =
http_header_response_get(r, HTTP_HEADER_CONTENT_TYPE,
CONST_STR_LEN("Content-Type"));
off_t ranges[16];
start = 0;
end = st_size - 1;
for (s = range, error = 0;
!error && *s && NULL != (minus = strchr(s, '-')); ) {
char *err;
off_t la = 0, le;
*((const char **)&err) = s; /*(quiet clang --analyze)*/
if (s != minus) {
la = strtoll(s, &err, 10);
if (err != minus) {
/* should not have multiple range-unit in Range, but
* handle just in case multiple Range headers merged */
while (*s == ' ' || *s == '\t') ++s;
if (0 != strncmp(s, "bytes=", 6)) return -1;
s += 6;
if (s != minus) {
la = strtoll(s, &err, 10);
if (err != minus) return -1;
}
}
}
if (s == minus) {
/* -<stop> */
le = strtoll(s, &err, 10);
if (le == 0) {
/* RFC 2616 - 14.35.1 */
r->http_status = 416;
error = 1;
} else if (*err == '\0') {
/* end */
s = err;
end = st_size - 1;
start = st_size + le;
} else if (*err == ',') {
s = err + 1;
end = st_size - 1;
start = st_size + le;
} else {
error = 1;
}
} else if (*(minus+1) == '\0' || *(minus+1) == ',') {
/* <start>- */
/* ok */
if (*(err + 1) == '\0') {
s = err + 1;
end = st_size - 1;
start = la;
} else if (*(err + 1) == ',') {
s = err + 2;
end = st_size - 1;
start = la;
} else {
error = 1;
}
} else {
/* <start>-<stop> */
le = strtoll(minus+1, &err, 10);
/* RFC 2616 - 14.35.1 */
if (la > le) {
error = 1;
}
if (*err == '\0') {
/* ok, end*/
s = err;
end = le;
start = la;
} else if (*err == ',') {
s = err + 1;
end = le;
start = la;
} else {
/* error */
error = 1;
}
}
if (!error) {
if (start < 0) start = 0;
/* RFC 2616 - 14.35.1 */
if (end > st_size - 1) end = st_size - 1;
if (start > st_size - 1) {
error = 1;
r->http_status = 416;
}
}
if (!error) {
if (n < (int)(sizeof(ranges)/sizeof(*ranges))) {
ranges[n] = start;
ranges[n+1] = end;
n += 2;
}
else { /* excessive num ranges in request */
error = 1;
r->http_status = 416;
}
}
}
/* something went wrong */
if (error) return -1;
if (n > 2) n = http_response_coalesce_ranges(ranges, n);
for (int i = 0; i < n; i += 2) {
start = ranges[i];
end = ranges[i+1];
if (n > 2) {
/* write boundary-header */
buffer *b = r->tmp_buf;
buffer_copy_string_len(b, CONST_STR_LEN("\r\n--"));
buffer_append_string_len(b, boundary, sizeof(boundary)-1);
/* write Content-Range */
buffer_append_string_len(b, CONST_STR_LEN("\r\nContent-Range: bytes "));
buffer_append_int(b, start);
buffer_append_string_len(b, CONST_STR_LEN("-"));
buffer_append_int(b, end);
buffer_append_string_len(b, CONST_STR_LEN("/"));
buffer_append_int(b, st_size);
if (content_type) {
buffer_append_string_len(b, CONST_STR_LEN("\r\nContent-Type: "));
buffer_append_string_buffer(b, content_type);
}
/* write END-OF-HEADER */
buffer_append_string_len(b, CONST_STR_LEN("\r\n\r\n"));
http_chunk_append_mem(r, CONST_BUF_LEN(b));
}
http_chunk_append_file_ref_range(r, sce, start, end - start + 1);
}
buffer * const tb = r->tmp_buf;
if (n > 2) {
/* add boundary end */
buffer_copy_string_len(tb, "\r\n--", 4);
buffer_append_string_len(tb, boundary, sizeof(boundary)-1);
buffer_append_string_len(tb, "--\r\n", 4);
http_chunk_append_mem(r, CONST_BUF_LEN(tb));
/* set header-fields */
buffer_copy_string_len(tb, CONST_STR_LEN("multipart/byteranges; boundary="));
buffer_append_string_len(tb, boundary, sizeof(boundary)-1);
/* overwrite content-type */
http_header_response_set(r, HTTP_HEADER_CONTENT_TYPE,
CONST_STR_LEN("Content-Type"),
CONST_BUF_LEN(tb));
} else {
/* add Content-Range-header */
buffer_copy_string_len(tb, CONST_STR_LEN("bytes "));
buffer_append_int(tb, start);
buffer_append_string_len(tb, CONST_STR_LEN("-"));
buffer_append_int(tb, end);
buffer_append_string_len(tb, CONST_STR_LEN("/"));
buffer_append_int(tb, st_size);
http_header_response_set(r, HTTP_HEADER_CONTENT_RANGE,
CONST_STR_LEN("Content-Range"),
CONST_BUF_LEN(tb));
}
/* ok, the file is set-up */
return 0;
}
void http_response_send_file (request_st * const r, buffer * const path) {
stat_cache_entry * const sce = stat_cache_get_entry_open(path, r->conf.follow_symlink);
const buffer *mtime = NULL;
const buffer *vb;
int allow_caching = (0 == r->http_status || 200 == r->http_status);
if (NULL == sce) {
r->http_status = (errno == ENOENT) ? 404 : 403;
log_error(r->conf.errh, __FILE__, __LINE__,
"not a regular file: %s -> %s", r->uri.path.ptr, path->ptr);
return;
}
if (!r->conf.follow_symlink
&& 0 != stat_cache_path_contains_symlink(path, r->conf.errh)) {
r->http_status = 403;
if (r->conf.log_request_handling) {
log_error(r->conf.errh, __FILE__, __LINE__,
"-- access denied due symlink restriction");
log_error(r->conf.errh, __FILE__, __LINE__,
"Path : %s", path->ptr);
}
return;
}
/* we only handle regular files */
if (!S_ISREG(sce->st.st_mode)) {
r->http_status = 403;
if (r->conf.log_file_not_found) {
log_error(r->conf.errh, __FILE__, __LINE__,
"not a regular file: %s -> %s",
r->uri.path.ptr, path->ptr);
}
return;
}
if (sce->fd < 0 && 0 != sce->st.st_size) {
r->http_status = (errno == ENOENT) ? 404 : 403;
if (r->conf.log_request_handling) {
log_perror(r->conf.errh, __FILE__, __LINE__,
"file open failed: %s", path->ptr);
}
return;
}
/* set response content-type, if not set already */
if (!light_btst(r->resp_htags, HTTP_HEADER_CONTENT_TYPE)) {
const buffer *content_type = stat_cache_content_type_get(sce, r);
if (buffer_string_is_empty(content_type)) {
/* we are setting application/octet-stream, but also announce that
* this header field might change in the seconds few requests
*
* This should fix the aggressive caching of FF and the script download
* seen by the first installations
*/
http_header_response_set(r, HTTP_HEADER_CONTENT_TYPE,
CONST_STR_LEN("Content-Type"),
CONST_STR_LEN("application/octet-stream"));
allow_caching = 0;
} else {
http_header_response_set(r, HTTP_HEADER_CONTENT_TYPE,
CONST_STR_LEN("Content-Type"),
CONST_BUF_LEN(content_type));
}
}
if (!http_method_get_or_head(r->http_method)
|| r->http_version < HTTP_VERSION_1_1)
r->conf.range_requests = 0;
if (r->conf.range_requests) {
http_header_response_append(r, HTTP_HEADER_ACCEPT_RANGES,
CONST_STR_LEN("Accept-Ranges"),
CONST_STR_LEN("bytes"));
}
if (allow_caching) {
if (!light_btst(r->resp_htags, HTTP_HEADER_ETAG)
&& 0 != r->conf.etag_flags) {
const buffer *etag =
stat_cache_etag_get(sce, r->conf.etag_flags);
if (!buffer_string_is_empty(etag)) {
buffer_copy_buffer(&r->physical.etag, etag);
http_header_response_set(r, HTTP_HEADER_ETAG,
CONST_STR_LEN("ETag"),
CONST_BUF_LEN(&r->physical.etag));
}
}
/* prepare header */
mtime = http_header_response_get(r, HTTP_HEADER_LAST_MODIFIED,