lighttpd 1.4.x https://www.lighttpd.net/
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
lighttpd1.4/src/request.c

1177 lines
29 KiB

#include <sys/stat.h>
#include <limits.h>
#include <stdlib.h>
#include <string.h>
#include <stdio.h>
#include <ctype.h>
#include "request.h"
#include "keyvalue.h"
#include "log.h"
static int request_check_hostname(server *srv, connection *con, buffer *host) {
enum { DOMAINLABEL, TOPLABEL } stage = TOPLABEL;
size_t i;
int label_len = 0;
size_t host_len;
char *colon;
int is_ip = -1; /* -1 don't know yet, 0 no, 1 yes */
int level = 0;
UNUSED(srv);
UNUSED(con);
/*
* hostport = host [ ":" port ]
* host = hostname | IPv4address | IPv6address
* hostname = *( domainlabel "." ) toplabel [ "." ]
* domainlabel = alphanum | alphanum *( alphanum | "-" ) alphanum
* toplabel = alpha | alpha *( alphanum | "-" ) alphanum
* IPv4address = 1*digit "." 1*digit "." 1*digit "." 1*digit
* IPv6address = "[" ... "]"
* port = *digit
*/
/* no Host: */
if (!host || host->used == 0) return 0;
host_len = host->used - 1;
/* IPv6 adress */
if (host->ptr[0] == '[') {
char *c = host->ptr + 1;
int colon_cnt = 0;
/* check portnumber */
for (; *c && *c != ']'; c++) {
if (*c == ':') {
if (++colon_cnt > 7) {
return -1;
}
} else if (!light_isxdigit(*c)) {
return -1;
}
}
/* missing ] */
if (!*c) {
return -1;
}
/* check port */
if (*(c+1) == ':') {
for (c += 2; *c; c++) {
if (!light_isdigit(*c)) {
return -1;
}
}
}
return 0;
}
if (NULL != (colon = memchr(host->ptr, ':', host_len))) {
char *c = colon + 1;
/* check portnumber */
for (; *c; c++) {
if (!light_isdigit(*c)) return -1;
}
/* remove the port from the host-len */
host_len = colon - host->ptr;
}
/* Host is empty */
if (host_len == 0) return -1;
/* if the hostname ends in a "." strip it */
if (host->ptr[host_len-1] == '.') {
/* shift port info one left */
if (NULL != colon) memmove(colon-1, colon, host->used - host_len);
else host->ptr[host_len-1] = '\0';
host_len -= 1;
host->used -= 1;
}
if (host_len == 0) return -1;
/* scan from the right and skip the \0 */
for (i = host_len; i-- > 0; ) {
const char c = host->ptr[i];
switch (stage) {
case TOPLABEL:
if (c == '.') {
/* only switch stage, if this is not the last character */
if (i != host_len - 1) {
if (label_len == 0) {
return -1;
}
/* check the first character at right of the dot */
if (is_ip == 0) {
if (!light_isalnum(host->ptr[i+1])) {
return -1;
}
} else if (!light_isdigit(host->ptr[i+1])) {
is_ip = 0;
} else if ('-' == host->ptr[i+1]) {
return -1;
} else {
/* just digits */
is_ip = 1;
}
stage = DOMAINLABEL;
label_len = 0;
level++;
} else if (i == 0) {
/* just a dot and nothing else is evil */
return -1;
}
} else if (i == 0) {
/* the first character of the hostname */
if (!light_isalnum(c)) {
return -1;
}
label_len++;
} else {
if (c != '-' && !light_isalnum(c)) {
return -1;
}
if (is_ip == -1) {
if (!light_isdigit(c)) is_ip = 0;
}
label_len++;
}
break;
case DOMAINLABEL:
if (is_ip == 1) {
if (c == '.') {
if (label_len == 0) {
return -1;
}
label_len = 0;
level++;
} else if (!light_isdigit(c)) {
return -1;
} else {
label_len++;
}
} else {
if (c == '.') {
if (label_len == 0) {
return -1;
}
/* c is either - or alphanum here */
if ('-' == host->ptr[i+1]) {
return -1;
}
label_len = 0;
level++;
} else if (i == 0) {
if (!light_isalnum(c)) {
return -1;
}
label_len++;
} else {
if (c != '-' && !light_isalnum(c)) {
return -1;
}
label_len++;
}
}
break;
}
}
/* a IP has to consist of 4 parts */
if (is_ip == 1 && level != 3) {
return -1;
}
if (label_len == 0) {
return -1;
}
return 0;
}
#if 0
#define DUMP_HEADER
#endif
static int http_request_split_value(array *vals, buffer *b) {
char *s;
size_t i;
int state = 0;
/*
* parse
*
* val1, val2, val3, val4
*
* into a array (more or less a explode() incl. striping of whitespaces
*/
if (b->used == 0) return 0;
s = b->ptr;
for (i =0; i < b->used - 1; ) {
char *start = NULL, *end = NULL;
data_string *ds;
switch (state) {
case 0: /* ws */
/* skip ws */
for (; (*s == ' ' || *s == '\t') && i < b->used - 1; i++, s++);
state = 1;
break;
case 1: /* value */
start = s;
for (; *s != ',' && i < b->used - 1; i++, s++);
end = s - 1;
for (; (*end == ' ' || *end == '\t') && end > start; end--);
if (NULL == (ds = (data_string *)array_get_unused_element(vals, TYPE_STRING))) {
ds = data_string_init();
}
buffer_copy_string_len(ds->value, start, end-start+1);
array_insert_unique(vals, (data_unset *)ds);
if (*s == ',') {
state = 0;
i++;
s++;
} else {
/* end of string */
state = 2;
}
break;
default:
i++;
break;
}
}
return 0;
}
static int request_uri_is_valid_char(unsigned char c) {
if (c <= 32) return 0;
if (c == 127) return 0;
if (c == 255) return 0;
return 1;
}
int http_request_parse(server *srv, connection *con) {
char *uri = NULL, *proto = NULL, *method = NULL, con_length_set;
int is_key = 1, key_len = 0, is_ws_after_key = 0, in_folding;
char *value = NULL, *key = NULL;
enum { HTTP_CONNECTION_UNSET, HTTP_CONNECTION_KEEPALIVE, HTTP_CONNECTION_CLOSE } keep_alive_set = HTTP_CONNECTION_UNSET;
int line = 0;
int request_line_stage = 0;
size_t i, first;
int done = 0;
/*
* Request: "^(GET|POST|HEAD) ([^ ]+(\\?[^ ]+|)) (HTTP/1\\.[01])$"
* Option : "^([-a-zA-Z]+): (.+)$"
* End : "^$"
*/
if (con->conf.log_request_header) {
log_error_write(srv, __FILE__, __LINE__, "sdsdSb",
"fd:", con->fd,
"request-len:", con->request.request->used,
"\n", con->request.request);
}
if (con->request_count > 1 &&
con->request.request->ptr[0] == '\r' &&
con->request.request->ptr[1] == '\n') {
/* we are in keep-alive and might get \r\n after a previous POST request.*/
buffer_copy_string_len(con->parse_request, con->request.request->ptr + 2, con->request.request->used - 1 - 2);
} else {
/* fill the local request buffer */
buffer_copy_string_buffer(con->parse_request, con->request.request);
}
keep_alive_set = 0;
con_length_set = 0;
/* parse the first line of the request
*
* should be:
*
* <method> <uri> <protocol>\r\n
* */
for (i = 0, first = 0; i < con->parse_request->used && line == 0; i++) {
char *cur = con->parse_request->ptr + i;
switch(*cur) {
case '\r':
if (con->parse_request->ptr[i+1] == '\n') {
http_method_t r;
char *nuri = NULL;
size_t j;
/* \r\n -> \0\0 */
con->parse_request->ptr[i] = '\0';
con->parse_request->ptr[i+1] = '\0';
buffer_copy_string_len(con->request.request_line, con->parse_request->ptr, i);
if (request_line_stage != 2) {
con->http_status = 400;
con->response.keep_alive = 0;
con->keep_alive = 0;
if (srv->srvconf.log_request_header_on_error) {
log_error_write(srv, __FILE__, __LINE__, "s", "incomplete request line -> 400");
log_error_write(srv, __FILE__, __LINE__, "Sb",
"request-header:\n",
con->request.request);
}
return 0;
}
proto = con->parse_request->ptr + first;
*(uri - 1) = '\0';
*(proto - 1) = '\0';
/* we got the first one :) */
if (-1 == (r = get_http_method_key(method))) {
con->http_status = 501;
con->response.keep_alive = 0;
con->keep_alive = 0;
if (srv->srvconf.log_request_header_on_error) {
log_error_write(srv, __FILE__, __LINE__, "s", "unknown http-method -> 501");
log_error_write(srv, __FILE__, __LINE__, "Sb",
"request-header:\n",
con->request.request);
}
return 0;
}
con->request.http_method = r;
/*
* RFC2616 says:
*
* HTTP-Version = "HTTP" "/" 1*DIGIT "." 1*DIGIT
*
* */
if (0 == strncmp(proto, "HTTP/", sizeof("HTTP/") - 1)) {
char * major = proto + sizeof("HTTP/") - 1;
char * minor = strchr(major, '.');
char *err = NULL;
int major_num = 0, minor_num = 0;
int invalid_version = 0;
if (NULL == minor || /* no dot */
minor == major || /* no major */
*(minor + 1) == '\0' /* no minor */) {
invalid_version = 1;
} else {
*minor = '\0';
major_num = strtol(major, &err, 10);
if (*err != '\0') invalid_version = 1;
*minor++ = '.';
minor_num = strtol(minor, &err, 10);
if (*err != '\0') invalid_version = 1;
}
if (invalid_version) {
con->http_status = 400;
con->keep_alive = 0;
if (srv->srvconf.log_request_header_on_error) {
log_error_write(srv, __FILE__, __LINE__, "s", "unknown protocol -> 400");
log_error_write(srv, __FILE__, __LINE__, "Sb",
"request-header:\n",
con->request.request);
}
return 0;
}
if (major_num == 1 && minor_num == 1) {
con->request.http_version = con->conf.allow_http11 ? HTTP_VERSION_1_1 : HTTP_VERSION_1_0;
} else if (major_num == 1 && minor_num == 0) {
con->request.http_version = HTTP_VERSION_1_0;
} else {
con->http_status = 505;
if (srv->srvconf.log_request_header_on_error) {
log_error_write(srv, __FILE__, __LINE__, "s", "unknown HTTP version -> 505");
log_error_write(srv, __FILE__, __LINE__, "Sb",
"request-header:\n",
con->request.request);
}
return 0;
}
} else {
con->http_status = 400;
con->keep_alive = 0;
if (srv->srvconf.log_request_header_on_error) {
log_error_write(srv, __FILE__, __LINE__, "s", "unknown protocol -> 400");
log_error_write(srv, __FILE__, __LINE__, "Sb",
"request-header:\n",
con->request.request);
}
return 0;
}
if (0 == strncmp(uri, "http://", 7) &&
NULL != (nuri = strchr(uri + 7, '/'))) {
/* ignore the host-part */
buffer_copy_string_len(con->request.uri, nuri, proto - nuri - 1);
} else {
/* everything looks good so far */
buffer_copy_string_len(con->request.uri, uri, proto - uri - 1);
}
/* check uri for invalid characters */
for (j = 0; j < con->request.uri->used - 1; j++) {
if (!request_uri_is_valid_char(con->request.uri->ptr[j])) {
unsigned char buf[2];
con->http_status = 400;
con->keep_alive = 0;
if (srv->srvconf.log_request_header_on_error) {
buf[0] = con->request.uri->ptr[j];
buf[1] = '\0';
if (con->request.uri->ptr[j] > 32 &&
con->request.uri->ptr[j] != 127) {
/* the character is printable -> print it */
log_error_write(srv, __FILE__, __LINE__, "ss",
"invalid character in URI -> 400",
buf);
} else {
/* a control-character, print ascii-code */
log_error_write(srv, __FILE__, __LINE__, "sd",
"invalid character in URI -> 400",
con->request.uri->ptr[j]);
}
log_error_write(srv, __FILE__, __LINE__, "Sb",
"request-header:\n",
con->request.request);
}
return 0;
}
}
buffer_copy_string_buffer(con->request.orig_uri, con->request.uri);
con->http_status = 0;
i++;
line++;
first = i+1;
}
break;
case ' ':
switch(request_line_stage) {
case 0:
/* GET|POST|... */
method = con->parse_request->ptr + first;
first = i + 1;
break;
case 1:
/* /foobar/... */
uri = con->parse_request->ptr + first;
first = i + 1;
break;
default:
/* ERROR, one space to much */
con->http_status = 400;
con->response.keep_alive = 0;
con->keep_alive = 0;
if (srv->srvconf.log_request_header_on_error) {
log_error_write(srv, __FILE__, __LINE__, "s", "overlong request line -> 400");
log_error_write(srv, __FILE__, __LINE__, "Sb",
"request-header:\n",
con->request.request);
}
return 0;
}
request_line_stage++;
break;
}
}
in_folding = 0;
if (con->request.uri->used == 1) {
con->http_status = 400;
con->response.keep_alive = 0;
con->keep_alive = 0;
if (srv->srvconf.log_request_header_on_error) {
log_error_write(srv, __FILE__, __LINE__, "s", "no uri specified -> 400");
log_error_write(srv, __FILE__, __LINE__, "Sb",
"request-header:\n",
con->request.request);
}
return 0;
}
for (; i < con->parse_request->used && !done; i++) {
char *cur = con->parse_request->ptr + i;
if (is_key) {
size_t j;
int got_colon = 0;
/**
* 1*<any CHAR except CTLs or separators>
* CTLs == 0-31 + 127
*
*/
switch(*cur) {
case ':':
is_key = 0;
value = cur + 1;
if (is_ws_after_key == 0) {
key_len = i - first;
}
is_ws_after_key = 0;
break;
case '(':
case ')':
case '<':
case '>':
case '@':
case ',':
case ';':
case '\\':
case '\"':
case '/':
case '[':
case ']':
case '?':
case '=':
case '{':
case '}':
con->http_status = 400;
con->keep_alive = 0;
con->response.keep_alive = 0;
log_error_write(srv, __FILE__, __LINE__, "sbsds",
"invalid character in key", con->request.request, cur, *cur, "-> 400");
return 0;
case ' ':
case '\t':
if (i == first) {
is_key = 0;
in_folding = 1;
value = cur;
break;
}
key_len = i - first;
/* skip every thing up to the : */
for (j = 1; !got_colon; j++) {
switch(con->parse_request->ptr[j + i]) {
case ' ':
case '\t':
/* skip WS */
continue;
case ':':
/* ok, done */
i += j - 1;
got_colon = 1;
break;
default:
/* error */
if (srv->srvconf.log_request_header_on_error) {
log_error_write(srv, __FILE__, __LINE__, "s", "WS character in key -> 400");
log_error_write(srv, __FILE__, __LINE__, "Sb",
"request-header:\n",
con->request.request);
}
con->http_status = 400;
con->response.keep_alive = 0;
con->keep_alive = 0;
return 0;
}
}
break;
case '\r':
if (con->parse_request->ptr[i+1] == '\n' && i == first) {
/* End of Header */
con->parse_request->ptr[i] = '\0';
con->parse_request->ptr[i+1] = '\0';
i++;
done = 1;
break;
} else {
if (srv->srvconf.log_request_header_on_error) {
log_error_write(srv, __FILE__, __LINE__, "s", "CR without LF -> 400");
log_error_write(srv, __FILE__, __LINE__, "Sb",
"request-header:\n",
con->request.request);
}
con->http_status = 400;
con->keep_alive = 0;
con->response.keep_alive = 0;
return 0;
}
/* fall thru */
case 0: /* illegal characters (faster than a if () :) */
case 1:
case 2:
case 3:
case 4:
case 5:
case 6:
case 7:
case 8:
case 10:
case 11:
case 12:
case 14:
case 15:
case 16:
case 17:
case 18:
case 19:
case 20:
case 21:
case 22:
case 23:
case 24:
case 25:
case 26:
case 27:
case 28:
case 29:
case 30:
case 31:
case 127:
con->http_status = 400;
con->keep_alive = 0;
con->response.keep_alive = 0;
if (srv->srvconf.log_request_header_on_error) {
log_error_write(srv, __FILE__, __LINE__, "sbsds",
"CTL character in key", con->request.request, cur, *cur, "-> 400");
log_error_write(srv, __FILE__, __LINE__, "Sb",
"request-header:\n",
con->request.request);
}
return 0;
default:
/* ok */
break;
}
} else {
switch(*cur) {
case '\r':
if (con->parse_request->ptr[i+1] == '\n') {
data_string *ds = NULL;
/* End of Headerline */
con->parse_request->ptr[i] = '\0';
con->parse_request->ptr[i+1] = '\0';
if (in_folding) {
buffer *key_b;
/**
* we use a evil hack to handle the line-folding
*
* As array_insert_unique() deletes 'ds' in the case of a duplicate
* ds points somewhere and we get a evil crash. As a solution we keep the old
* "key" and get the current value from the hash and append us
*
* */
if (!key || !key_len) {
/* 400 */
if (srv->srvconf.log_request_header_on_error) {
log_error_write(srv, __FILE__, __LINE__, "s", "WS at the start of first line -> 400");
log_error_write(srv, __FILE__, __LINE__, "Sb",
"request-header:\n",
con->request.request);
}
con->http_status = 400;
con->keep_alive = 0;
con->response.keep_alive = 0;
return 0;
}
key_b = buffer_init();
buffer_copy_string_len(key_b, key, key_len);
if (NULL != (ds = (data_string *)array_get_element(con->request.headers, key_b->ptr))) {
buffer_append_string(ds->value, value);
}
buffer_free(key_b);
} else {
int s_len;