Commit Graph

101 Commits

Author SHA1 Message Date
Glenn Strauss 9149b56418 [core] get_http_method_key() match by strlen first 2019-02-09 16:16:20 -05:00
Glenn Strauss b9a37291cb [core] lift code out of request line parse loop 2019-02-09 15:48:05 -05:00
Glenn Strauss e5d61e9a5f [core] http_request_parse() mark error paths cold 2019-02-09 14:30:00 -05:00
Glenn Strauss 25185d1de0 [core] pass req hdrs buffer to http_request_parse 2019-02-08 22:49:46 -05:00
Glenn Strauss 7493d628b9 [core] prefer buffer_caseless_compare()
prefer buffer_caseless_compare() to strcasecmp()
2019-02-08 22:49:46 -05:00
Glenn Strauss d7ad5819e6 [core] copy request only if might need for logging
copy request header only if we may need to log it upon error
2019-02-08 22:49:46 -05:00
Glenn Strauss a620f80b77 [core] log_request_header_on_error in one place 2019-02-08 22:49:46 -05:00
Glenn Strauss 9ab5469365 [core] parse request in connection_read_header() 2019-02-08 22:49:46 -05:00
Glenn Strauss cef6ee675d [core] limit con->uri.authority < 1024 octets
(expect < 256 octets for DNS name)

Since limit is imposed, can use buffer_clear() instead of buffer_reset()
for con->uri.authority and con->server_name.  (Also, con->uri.scheme is
limited to "http" and "https", so use buffer_clear() for it, too)
2018-11-25 19:52:08 -05:00
Glenn Strauss f13db69012 [core] fix setting of headers previously reset (fixes #2919)
bug may result in long delays when using mod_deflate on connections
with keep-alive, as the result is sent without Content-Length or

(regression in lighttpd 1.4.51)

(thx GilGalaad)

  "high latency on 1.4.51 + proxy + deflate"
2018-11-17 01:24:26 -05:00
Glenn Strauss 15277bf9e1 [core] perf: one-element cache for host normalize
one-element cache for http_request_host_normalize() on IP address
2018-10-24 00:16:14 -04:00
Glenn Strauss 062089ff14 [core] perf: array_reset_data_strings()
array_reset_data_strings() specialization
2018-10-22 20:28:53 -04:00
Glenn Strauss 3dd3cde902 [core] abstraction layer for HTTP header manip
convert existing calls to manip request/response headers
convert existing calls to manip environment array (often header-related)
2018-09-23 18:01:58 -04:00
Glenn Strauss c8159ee5f6 [core] http_request_parse_reqline() separate func
http_request_parse_reqline() separate func from http_request_parse()
600+ line http_request_parse() is now two routines with ~300 lines each
2018-09-16 05:18:05 -04:00
Glenn Strauss 28d6015b45 [core] simplify parsing hdr key whitespace then : 2018-09-16 05:18:05 -04:00
Glenn Strauss a7c27c9f99 [core] code reuse with array_insert_key_value()
code reuse with array_insert_key_value() and related array manipulation
2018-09-16 05:18:05 -04:00
Glenn Strauss 9d3cbaa74c [core] parse header line strings before copying 2018-09-16 05:18:05 -04:00
Glenn Strauss ad27206608 [core] redo HTTP header line folding
Replace separators between folded header lines in-place using spaces
and then process the single header line.

(Reverts change which replaces folding whitespace with single space)

Acknowledgement: Or Peles of VDOO  reference: VD-0871, VD-0872, VD-0873
(thx Or Peles)
2018-09-16 05:18:05 -04:00
Stefan Bühler 3be0707839 [core] replace folding whitespace with a single space
- previously the leading whitespace from folded lines was kept
- also ignore lines without any data
2018-08-26 18:52:22 +02:00
Stefan Bühler df8e4f9561 [core,security] process headers after combining folded headers
- this fixes various use-after-free scenarios (reported by Or Peles of
  VDOO): when parse_single_header stores pointers to header values in
  con->request, those pointers are not updated if the header value is
  reallocated when folded header lines are appended.
- also remove trailing white-space from folded lines
2018-08-26 18:44:46 +02:00
Stefan Bühler a2cc330fb4 [core] header parsing: use goto for error handling
- disable keep-alive for all failures
- default to 400 for status
2018-08-25 13:13:24 +02:00
Stefan Bühler 725d951247 [core] explicitly return 0 instead of constant result 2018-08-25 12:43:03 +02:00
Stefan Bühler ed0054c2d3 [core] split parsing header line into separate function 2018-08-25 12:35:23 +02:00
Glenn Strauss d161f53de0 [core] security: use-after-free invalid Range req
(thx Marcus Wengelin)
2018-08-12 14:43:22 -04:00
Glenn Strauss 3eb7902e10 [core] server.http-parseopts URL normalization opt (fixes #1720)
server.http-parseopts = ( ... ) URL normalization options

Note: *not applied* to CONNECT method

Note: In a future release, URL normalization likely enabled by default
  (normalize URL, reject control chars, remove . and .. path segments)
  To prepare for this change, lighttpd.conf configurations should
  explicitly select desired behavior by enabling or disabling:
    server.http-parseopts = ( "url-normalize" => "enable", ... )
    server.http-parseopts = ( "url-normalize" => "disable" )

  "lighttpd ... compares URIs to patterns in the (1) url.redirect and (2) url.rewrite configuration settings before performing URL decoding, which might allow remote attackers to bypass intended access restrictions, and obtain sensitive information or possibly modify data."
  "Rewrite/redirect rules and URL encoding"
2018-08-12 14:43:22 -04:00
Glenn Strauss c56b21084e [core] http_kv.[ch] method, status, version str
move method, status, version strings from keyvalue.[ch] to http_kv.[ch]
2018-08-05 03:44:15 -04:00
Glenn Strauss 04d76e7afd [core] some header cleanup
provide standard types in first.h instead of base.h
provide lighttpd types in base_decls.h instead of settings.h
reduce headers exposed by headers for core data structures
  do not expose <pcre.h> or <stdlib.h> in headers
move stat_cache_entry to stat_cache.h
reduce use of "server.h" and "base.h" in headers
2018-04-08 22:22:23 -04:00
Glenn Strauss cd2b51cb1a [core] fix CONNECT w strict header parsing enabled
fix CONNECT with strict header parsing enabled (default)
(or set server.http-parseopt-header-strict = "disabled")

  "ssh over https tunnel"
2018-02-26 00:44:14 -05:00
Glenn Strauss e6564641d8 [core] remove unused func 2018-01-19 22:13:58 -05:00
Glenn Strauss 1367f60626 [core] isolate sock_addr manipulation 2017-10-29 01:23:19 -04:00
Glenn Strauss 60b5826849 [core] stricter validation of request-URI begin
check that request-URI begins with '/', "http://", "https://",
or is OPTIONS * request, or else reject with 400 Bad Request unless
server.http-parseopt-header-strict  = "disable" (default is enabled)

2017-10-21 21:44:34 -04:00
Glenn Strauss fa1eef0071 [core] permit LF to end lines if !header-strict
permit LF to end header lines if
  server.http-parseopt-header-strict = "disable"
(instead of requiring CR LF)

(makes it easy to use 'openssl s_client -connect <IP:port>' on unix)

(Note: care taken to minimize diff in this commit,
 but header parsing code should be revisited and overhauled)
2017-10-16 02:17:07 -04:00
Glenn Strauss 513887fa52 [core] URI scheme is case-insensitive
check case-insensitive scheme if full URI provided in request-line

  The scheme and host are case-insensitive and normally provided
  in lowercase; all other components are compared in a case-sensitive

2017-10-03 21:16:03 -04:00
Glenn Strauss 9bc61f16cb [core] attempt to quiet coverity false positives 2017-08-12 15:39:12 -04:00
Glenn Strauss 86bb8be2c8 [core] perf: skip redundant strlen() if len known
performance: skip redundant strlen() if length is already known

introduce array_get_element_klen() to take key and klen params
2017-05-15 22:02:33 -04:00
Glenn Strauss 40f72a41b9 [core] omit default port from normalized host str
omit default scheme port from normalized host string
2017-04-25 11:12:53 -04:00
Glenn Strauss a448886485 [core] inet_pton(), inet_ntop() on (sock_addr *)
shared code to provide inet_pton() and inet_ntop() behavior on
lighttpd (sock_addr *) and (buffer *) data structures.
2017-04-06 00:22:42 -04:00
Glenn Strauss 1104afc49b [core] export http_request_host_policy() for reuse 2017-04-01 19:20:09 -04:00
Glenn Strauss a53f662a30 [core] remove some unused header includes
remove exposure of stdio.h in buffer.h for print_backtrace(), now static
2017-03-28 02:17:33 -04:00
Glenn Strauss 14890c1c89 [core] remove redundant Content-Length digit check 2017-03-23 21:18:15 -04:00
Glenn Strauss 37dac9a23c [core] support Expect: 100-continue with HTTP/1.1 (fixes #377, #1017, #1953, #2438)
support Expect: 100-continue with HTTP/1.1 requests

Ignore config option server.reject-expect-100-with-417;
server.reject-expect-100-with-417 will be removed in a future release.

  "Incorrect handling of the 100 (Continue) Status"
  "'Expect' header gives HTTP error 417"
  "Improve DAV support to be able to handle git as a client"
  "Change server.reject-expect-100-with-417 from flag to regular expression matching the URL"
2017-01-31 14:36:15 -05:00
Glenn Strauss 4d7f5737f1 [core] support Transfer-Encoding: chunked req body (fixes #2156)
support Transfer-Encoding: chunked request body in conjunction with = 0

dynamic handlers will still return 411 Length Required if = 1 or 2 (!= 0)
  since CGI-like env requires CONTENT_LENGTH be set
  (and mod_proxy currently sends HTTP/1.0 requests to backends,
   and Content-Length recommended for robust interaction with backend)

  "request: support Chunked Transfer Coding for HTTP PUT"
2016-12-16 16:58:04 -05:00
Glenn Strauss 8047c2f448 fix errors detected by Coverity Scan
fix potential NULL pointer dereference in mod_deflate.c
remove logically dead code in connection-glue.c
add coverity annotations to see if some issues will be reclassified
2016-09-23 09:09:57 -04:00
Glenn Strauss 38139fa1a9 [core] permit IPv6 address scope identifier
getaddrinfo() on permits a scope identifier to be part of the IPv6
address string, so permit this syntax in $SERVER["socket"] validation.

2016-07-25 01:01:10 -04:00
Glenn Strauss fe02be7e34 [core] make server.max-request-size scopeable (fixes #1901)
  "make server.max-request-size scopeable"
2016-07-09 11:01:13 -04:00
Glenn Strauss 28841bfc3d [core] fix server.max-request-size to be precise (fixes #2131)
(previously would allow up to 1k data above configured limit)

  "max-request-size comparing mistake"
2016-07-05 16:34:04 -04:00
Glenn Strauss 72b133f595 fix errors detected by Coverity Scan
buffer.c:itostr() undefined behavior taking modulus of negative number

additional minor code changes made to quiet other coverity warnings
(false positives)
2016-06-23 03:57:19 -04:00
Glenn Strauss 879a282de7 fix errors detected by Coverity Scan
fd leak in mod_dirlisting.c
use after free in error condition in mod_proxy.c
NULL pointer dereference in error message in chunk.c

additional minor code changes made to quiet other coverity warnings
2016-06-21 03:53:50 -04:00
Glenn Strauss f3e36ccdbb use buffer_string_set_length() to truncate strings 2016-05-23 14:33:09 -04:00
Glenn Strauss df8032a7c8 use buffer_string_set_length() to truncate strings 2016-05-23 14:12:24 -04:00