varnish-cache/bin/varnishd/http1/cache_http1_proto.c
0
/*-
1
 * Copyright (c) 2006 Verdens Gang AS
2
 * Copyright (c) 2006-2015 Varnish Software AS
3
 * All rights reserved.
4
 *
5
 * Author: Poul-Henning Kamp <phk@phk.freebsd.dk>
6
 *
7
 * SPDX-License-Identifier: BSD-2-Clause
8
 *
9
 * Redistribution and use in source and binary forms, with or without
10
 * modification, are permitted provided that the following conditions
11
 * are met:
12
 * 1. Redistributions of source code must retain the above copyright
13
 *    notice, this list of conditions and the following disclaimer.
14
 * 2. Redistributions in binary form must reproduce the above copyright
15
 *    notice, this list of conditions and the following disclaimer in the
16
 *    documentation and/or other materials provided with the distribution.
17
 *
18
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
19
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21
 * ARE DISCLAIMED.  IN NO EVENT SHALL AUTHOR OR CONTRIBUTORS BE LIABLE
22
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28
 * SUCH DAMAGE.
29
 *
30
 * HTTP protocol requests
31
 *
32
 * The trouble with the "until magic sequence" design of HTTP protocol messages
33
 * is that either you have to read a single character at a time, which is
34
 * inefficient, or you risk reading too much, and pre-read some of the object,
35
 * or even the next pipelined request, which follows the one you want.
36
 *
37
 * HTC reads a HTTP protocol header into a workspace, subject to limits,
38
 * and stops when we see the magic marker (double [CR]NL), and if we overshoot,
39
 * it keeps track of the "pipelined" data.
40
 *
41
 * We use this both for client and backend connections.
42
 */
43
44
#include "config.h"
45
46
#include "cache/cache_varnishd.h"
47
#include "cache/cache_transport.h"
48
49
#include "cache_http1.h"
50
51
#include "vct.h"
52
53
const int HTTP1_Req[3] = {
54
        HTTP_HDR_METHOD, HTTP_HDR_URL, HTTP_HDR_PROTO
55
};
56
57
const int HTTP1_Resp[3] = {
58
        HTTP_HDR_PROTO, HTTP_HDR_STATUS, HTTP_HDR_REASON
59
};
60
61
/*--------------------------------------------------------------------
62
 * Check if we have a complete HTTP request or response yet
63
 */
64
65
enum htc_status_e v_matchproto_(htc_complete_f)
66 503835
HTTP1_Complete(struct http_conn *htc)
67
{
68
        char *p;
69
        enum htc_status_e retval;
70
71 503835
        CHECK_OBJ_NOTNULL(htc, HTTP_CONN_MAGIC);
72 503835
        AN(WS_Reservation(htc->ws));
73 503835
        assert(pdiff(htc->rxbuf_b, htc->rxbuf_e) <= WS_ReservationSize(htc->ws));
74
75
        /* Skip any leading white space */
76 505315
        for (p = htc->rxbuf_b ; p < htc->rxbuf_e && vct_islws(*p); p++)
77 1480
                continue;
78 503835
        if (p == htc->rxbuf_e)
79 274577
                return (HTC_S_EMPTY);
80
81
        /* Do not return a partial H2 connection preface */
82 229258
        retval = H2_prism_complete(htc);
83 229258
        if (retval != HTC_S_JUNK)
84 10959
                return (retval);
85
86
        /*
87
         * Here we just look for NL[CR]NL to see that reception
88
         * is completed.  More stringent validation happens later.
89
         */
90 790100
        while (1) {
91 790100
                p = memchr(p, '\n', htc->rxbuf_e - p);
92 790100
                if (p == NULL)
93 11186
                        return (HTC_S_MORE);
94 778914
                if (++p == htc->rxbuf_e)
95 894
                        return (HTC_S_MORE);
96 778020
                if (*p == '\r' && ++p == htc->rxbuf_e)
97 80
                        return (HTC_S_MORE);
98 777940
                if (*p == '\n')
99 206139
                        break;
100
        }
101 206139
        return (HTC_S_COMPLETE);
102 503835
}
103
104
/*--------------------------------------------------------------------
105
 * Dissect the headers of the HTTP protocol message.
106
 */
107
108
static uint16_t
109 205997
http1_dissect_hdrs(struct http *hp, char *p, struct http_conn *htc,
110
    unsigned maxhdr)
111
{
112
        char *q, *r, *s;
113
        int i;
114
115 205997
        assert(p > htc->rxbuf_b);
116 205997
        assert(p <= htc->rxbuf_e);
117 205997
        hp->nhd = HTTP_HDR_FIRST;
118 205997
        r = NULL;               /* For FlexeLint */
119 768549
        for (; p < htc->rxbuf_e; p = r) {
120
121
                /* Find end of next header */
122 768548
                q = r = p;
123 768548
                if (vct_iscrlf(p, htc->rxbuf_e))
124 205206
                        break;
125 11955960
                while (r < htc->rxbuf_e) {
126 11955926
                        if (vct_ishdrval(*r)) {
127 11392304
                                r++;
128 11392304
                                continue;
129
                        }
130 563622
                        i = vct_iscrlf(r, htc->rxbuf_e);
131 563622
                        if (i == 0) {
132 320
                                VSLb(hp->vsl, SLT_BogoHeader,
133 160
                                    "Header has ctrl char 0x%02x", *r);
134 160
                                return (400);
135
                        }
136 563462
                        q = r;
137 563462
                        r += i;
138 563462
                        assert(r <= htc->rxbuf_e);
139 563462
                        if (r == htc->rxbuf_e)
140 0
                                break;
141 563462
                        if (vct_iscrlf(r, htc->rxbuf_e))
142 204903
                                break;
143
                        /* If line does not continue: got it. */
144 358559
                        if (!vct_issp(*r))
145 358199
                                break;
146
147
                        /* Clear line continuation LWS to spaces */
148 720
                        while (q < r)
149 360
                                *q++ = ' ';
150 760
                        while (q < htc->rxbuf_e && vct_issp(*q))
151 400
                                *q++ = ' ';
152
                }
153
154
                /* Empty header = end of headers */
155 563136
                if (p == q)
156 0
                        break;
157
158 563100
                if (q - p > maxhdr) {
159 320
                        VSLb(hp->vsl, SLT_BogoHeader, "Header too long: %.*s",
160 160
                            (int)(q - p > 20 ? 20 : q - p), p);
161 160
                        return (400);
162
                }
163
164 562940
                if (vct_islws(*p)) {
165 160
                        VSLb(hp->vsl, SLT_BogoHeader,
166
                            "1st header has white space: %.*s",
167 80
                            (int)(q - p > 20 ? 20 : q - p), p);
168 80
                        return (400);
169
                }
170
171 562860
                if (*p == ':') {
172 80
                        VSLb(hp->vsl, SLT_BogoHeader,
173
                            "Missing header name: %.*s",
174 40
                            (int)(q - p > 20 ? 20 : q - p), p);
175 40
                        return (400);
176
                }
177
178 563540
                while (q > p && vct_issp(q[-1]))
179 720
                        q--;
180 562792
                *q = '\0';
181
182 4889373
                for (s = p; *s != ':' && s < q; s++) {
183 4326781
                        if (!vct_istchar(*s)) {
184 400
                                VSLb(hp->vsl, SLT_BogoHeader,
185 200
                                    "Illegal char 0x%02x in header name", *s);
186 200
                                return (400);
187
                        }
188 4326581
                }
189 562592
                if (*s != ':') {
190 80
                        VSLb(hp->vsl, SLT_BogoHeader, "Header without ':' %.*s",
191 40
                            (int)(q - p > 20 ? 20 : q - p), p);
192 40
                        return (400);
193
                }
194
195 562552
                if (hp->nhd < hp->shd) {
196 562552
                        hp->hdf[hp->nhd] = 0;
197 562552
                        hp->hd[hp->nhd].b = p;
198 562552
                        hp->hd[hp->nhd].e = q;
199 562552
                        hp->nhd++;
200 562552
                } else {
201 0
                        VSLb(hp->vsl, SLT_BogoHeader, "Too many headers: %.*s",
202 0
                            (int)(q - p > 20 ? 20 : q - p), p);
203 0
                        return (400);
204
                }
205 562552
        }
206 205207
        i = vct_iscrlf(p, htc->rxbuf_e);
207 205207
        assert(i > 0);          /* HTTP1_Complete guarantees this */
208 205205
        p += i;
209 205205
        HTC_RxPipeline(htc, p);
210 205205
        htc->rxbuf_e = p;
211 205205
        return (0);
212 205885
}
213
214
/*--------------------------------------------------------------------
215
 * Deal with first line of HTTP protocol message.
216
 */
217
218
static uint16_t
219 206143
http1_splitline(struct http *hp, struct http_conn *htc, const int *hf,
220
    unsigned maxhdr)
221
{
222
        char *p, *q;
223
        int i;
224
225 206143
        assert(hf == HTTP1_Req || hf == HTTP1_Resp);
226 206143
        CHECK_OBJ_NOTNULL(htc, HTTP_CONN_MAGIC);
227 206143
        CHECK_OBJ_NOTNULL(hp, HTTP_MAGIC);
228 206143
        assert(htc->rxbuf_e >= htc->rxbuf_b);
229
230 206143
        AZ(hp->hd[hf[0]].b);
231 206143
        AZ(hp->hd[hf[1]].b);
232 206143
        AZ(hp->hd[hf[2]].b);
233
234
        /* Skip leading LWS */
235 206343
        for (p = htc->rxbuf_b ; vct_islws(*p); p++)
236 200
                continue;
237 206143
        hp->hd[hf[0]].b = p;
238
239
        /* First field cannot contain SP or CTL */
240 1233979
        for (; !vct_issp(*p); p++) {
241 1027996
                if (vct_isctl(*p))
242 160
                        return (400);
243 1027836
        }
244 205983
        hp->hd[hf[0]].e = p;
245 205983
        assert(Tlen(hp->hd[hf[0]]));
246 205983
        *p++ = '\0';
247
248
        /* Skip SP */
249 206223
        for (; vct_issp(*p); p++) {
250 240
                if (vct_isctl(*p))
251 0
                        return (400);
252 240
        }
253 205983
        hp->hd[hf[1]].b = p;
254
255
        /* Second field cannot contain LWS or CTL */
256 1489724
        for (; !vct_islws(*p); p++) {
257 1283741
                if (vct_isctl(*p))
258 0
                        return (400);
259 1283741
        }
260 205983
        hp->hd[hf[1]].e = p;
261 205983
        if (!Tlen(hp->hd[hf[1]]))
262 40
                return (400);
263
264
        /* Skip SP */
265 205943
        q = p;
266 411595
        for (; vct_issp(*p); p++) {
267 205652
                if (vct_isctl(*p))
268 0
                        return (400);
269 205652
        }
270 205943
        if (q < p)
271 205613
                *q = '\0';      /* Nul guard for the 2nd field. If q == p
272
                                 * (the third optional field is not
273
                                 * present), the last nul guard will
274
                                 * cover this field. */
275
276
        /* Third field is optional and cannot contain CTL except TAB */
277 205943
        q = p;
278 1374003
        for (; p < htc->rxbuf_e && !vct_iscrlf(p, htc->rxbuf_e); p++) {
279 1168100
                if (vct_isctl(*p) && !vct_issp(*p))
280 40
                        return (400);
281 1168060
        }
282 205883
        if (p > q) {
283 205441
                hp->hd[hf[2]].b = q;
284 205441
                hp->hd[hf[2]].e = p;
285 205441
        }
286
287
        /* Skip CRLF */
288 205883
        i = vct_iscrlf(p, htc->rxbuf_e);
289 205883
        if (!i)
290 0
                return (400);
291 205883
        *p = '\0';
292 205883
        p += i;
293
294 205883
        http_Proto(hp);
295
296 205883
        return (http1_dissect_hdrs(hp, p, htc, maxhdr));
297 206123
}
298
299
/*--------------------------------------------------------------------*/
300
301
static body_status_t
302 205041
http1_body_status(const struct http *hp, struct http_conn *htc, int request)
303
{
304
        ssize_t cl;
305
        const char *b;
306
307 205041
        CHECK_OBJ_NOTNULL(htc, HTTP_CONN_MAGIC);
308 205041
        CHECK_OBJ_NOTNULL(hp, HTTP_MAGIC);
309
310 205041
        htc->content_length = -1;
311
312 205041
        cl = http_GetContentLength(hp);
313 205041
        if (cl == -2)
314 160
                return (BS_ERROR);
315 204881
        if (http_GetHdr(hp, H_Transfer_Encoding, &b)) {
316 6240
                if (!http_coding_eq(b, chunked))
317 80
                        return (BS_ERROR);
318 6160
                if (cl != -1) {
319
                        /*
320
                         * RFC7230 3.3.3 allows more lenient handling
321
                         * but we're going to be strict.
322
                         */
323 80
                        return (BS_ERROR);
324
                }
325 6080
                return (BS_CHUNKED);
326
        }
327 198641
        if (cl >= 0) {
328 75478
                htc->content_length = cl;
329 75478
                return (cl == 0 ? BS_NONE : BS_LENGTH);
330
        }
331
332 123163
        if (hp->protover == 11 && request)
333 120883
                return (BS_NONE);
334
335 2280
        if (http_HdrIs(hp, H_Connection, "keep-alive")) {
336
                /*
337
                 * Keep alive with neither TE=Chunked or C-Len is impossible.
338
                 * We assume a zero length body.
339
                 */
340 80
                return (BS_NONE);
341
        }
342
343
        /*
344
         * Fall back to EOF transfer.
345
         */
346 2200
        return (BS_EOF);
347 205041
}
348
349
/*--------------------------------------------------------------------*/
350
351
uint16_t
352 126294
HTTP1_DissectRequest(struct http_conn *htc, struct http *hp)
353
{
354
        uint16_t retval;
355
        const char *p;
356 126294
        const char *b = NULL, *e;
357
358 126294
        CHECK_OBJ_NOTNULL(htc, HTTP_CONN_MAGIC);
359 126294
        CHECK_OBJ_NOTNULL(hp, HTTP_MAGIC);
360
361 252588
        retval = http1_splitline(hp, htc,
362 126294
            HTTP1_Req, cache_param->http_req_hdr_len);
363 126294
        if (retval != 0)
364 600
                return (retval);
365
366 125694
        if (hp->protover < 10 || hp->protover > 11)
367 480
                return (400);
368
369
        /* RFC2616, section 5.2, point 1 */
370 125214
        if (http_scheme_at(hp->hd[HTTP_HDR_URL].b, http))
371 120
                b = hp->hd[HTTP_HDR_URL].b + 7;
372 125094
        else if (FEATURE(FEATURE_HTTPS_SCHEME) &&
373 40
            http_scheme_at(hp->hd[HTTP_HDR_URL].b, https))
374 40
                b = hp->hd[HTTP_HDR_URL].b + 8;
375 125214
        if (b) {
376 160
                e = strchr(b, '/');
377 160
                if (e) {
378 160
                        http_Unset(hp, H_Host);
379 160
                        http_PrintfHeader(hp, "Host: %.*s", (int)(e - b), b);
380 160
                        hp->hd[HTTP_HDR_URL].b = e;
381 160
                }
382 160
        }
383
384 125214
        htc->body_status = http1_body_status(hp, htc, 1);
385 125214
        if (htc->body_status == BS_ERROR)
386 160
                return (400);
387
388 125054
        p = http_GetMethod(hp);
389 125054
        AN(p);
390
391 125054
        if (htc->body_status == BS_EOF) {
392 560
                assert(hp->protover == 10);
393
                /* RFC1945 8.3 p32 and D.1.1 p58 */
394 560
                if (http_method_eq(p, POST) || http_method_eq(p, PUT))
395 80
                        return (400);
396 480
                htc->body_status = BS_NONE;
397 480
        }
398
399
        /* HEAD with a body is a hard error */
400 124974
        if (htc->body_status != BS_NONE && http_method_eq(p, HEAD))
401 0
                return (400);
402
403 124974
        return (retval);
404 126294
}
405
406
/*--------------------------------------------------------------------*/
407
408
uint16_t
409 79837
HTTP1_DissectResponse(struct http_conn *htc, struct http *hp,
410
    const struct http *rhttp)
411
{
412 79837
        uint16_t retval = 0;
413
        const char *p;
414
415 79837
        CHECK_OBJ_NOTNULL(htc, HTTP_CONN_MAGIC);
416 79837
        CHECK_OBJ_NOTNULL(hp, HTTP_MAGIC);
417 79837
        CHECK_OBJ_NOTNULL(rhttp, HTTP_MAGIC);
418
419 159674
        if (http1_splitline(hp, htc,
420 79837
            HTTP1_Resp, cache_param->http_resp_hdr_len))
421 320
                retval = 503;
422
423 79837
        if (retval == 0 && hp->protover < 10)
424 0
                retval = 503;
425
426 79837
        if (retval == 0 && hp->protover > rhttp->protover)
427 40
                http_SetH(hp, HTTP_HDR_PROTO, rhttp->hd[HTTP_HDR_PROTO].b);
428
429 79837
        if (retval == 0 && Tlen(hp->hd[HTTP_HDR_STATUS]) != 3)
430 120
                retval = 503;
431
432 79837
        if (retval == 0) {
433 79395
                p = hp->hd[HTTP_HDR_STATUS].b;
434
435 158550
                if (p[0] >= '1' && p[0] <= '9' &&
436 79275
                    p[1] >= '0' && p[1] <= '9' &&
437 79195
                    p[2] >= '0' && p[2] <= '9')
438 79115
                        hp->status =
439 79115
                            100 * (p[0] - '0') + 10 * (p[1] - '0') + p[2] - '0';
440
                else
441 280
                        retval = 503;
442 79395
        }
443
444 79837
        if (retval != 0) {
445 1440
                VSLb(hp->vsl, SLT_HttpGarbage, "%.*s",
446 720
                    (int)(htc->rxbuf_e - htc->rxbuf_b), htc->rxbuf_b);
447 720
                assert(retval >= 100 && retval <= 999);
448 720
                assert(retval == 503);
449 720
                http_SetStatus(hp, 503, NULL);
450 720
        }
451
452 79837
        if (hp->hd[HTTP_HDR_REASON].b == NULL ||
453 79756
            !Tlen(hp->hd[HTTP_HDR_REASON])) {
454 176
                http_SetH(hp, HTTP_HDR_REASON,
455 88
                    http_Status2Reason(hp->status, NULL));
456 88
        }
457
458 79829
        htc->body_status = http1_body_status(hp, htc, 0);
459
460 79829
        return (retval);
461
}
462
463
/*--------------------------------------------------------------------*/
464
465
static unsigned
466 2104567
http1_WrTxt(struct v1l *v1l, const txt *hh, const char *suf)
467
{
468
        unsigned u;
469
470 2104567
        AN(hh);
471 2104567
        AN(hh->b);
472 2104567
        AN(hh->e);
473 2104567
        u = V1L_Write(v1l, hh->b, hh->e - hh->b);
474 2104567
        if (suf != NULL)
475 2104325
                u += V1L_Write(v1l, suf, -1);
476 2104573
        return (u);
477
}
478
479
unsigned
480 199129
HTTP1_Write(struct v1l *v1l, const struct http *hp, const int *hf)
481
{
482
        unsigned u, l;
483
484 199129
        assert(hf == HTTP1_Req || hf == HTTP1_Resp);
485 199129
        AN(hp->hd[hf[0]].b);
486 199129
        AN(hp->hd[hf[1]].b);
487 199129
        AN(hp->hd[hf[2]].b);
488 199129
        l = http1_WrTxt(v1l, &hp->hd[hf[0]], " ");
489 199129
        l += http1_WrTxt(v1l, &hp->hd[hf[1]], " ");
490 199129
        l += http1_WrTxt(v1l, &hp->hd[hf[2]], "\r\n");
491
492 1706678
        for (u = HTTP_HDR_FIRST; u < hp->nhd; u++)
493 1507549
                l += http1_WrTxt(v1l, &hp->hd[u], "\r\n");
494 199129
        l += V1L_Write(v1l, "\r\n", -1);
495 199129
        return (l);
496
}