fix use-after-realloc issue with the request url
[project/uhttpd.git] / client.c
1 /*
2 * uhttpd - Tiny single-threaded httpd
3 *
4 * Copyright (C) 2010-2012 Jo-Philipp Wich <xm@subsignal.org>
5 * Copyright (C) 2012 Felix Fietkau <nbd@openwrt.org>
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License");
8 * you may not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS,
15 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
18 */
19
20 #include <libubox/blobmsg.h>
21 #include <ctype.h>
22
23 #include "uhttpd.h"
24
25 static LIST_HEAD(clients);
26
27 int n_clients = 0;
28 struct config conf = {};
29
30 const char * const http_versions[] = {
31 [UH_HTTP_VER_0_9] = "HTTP/0.9",
32 [UH_HTTP_VER_1_0] = "HTTP/1.0",
33 [UH_HTTP_VER_1_1] = "HTTP/1.1",
34 };
35
36 const char * const http_methods[] = {
37 [UH_HTTP_MSG_GET] = "GET",
38 [UH_HTTP_MSG_POST] = "POST",
39 [UH_HTTP_MSG_HEAD] = "HEAD",
40 };
41
42 void uh_http_header(struct client *cl, int code, const char *summary)
43 {
44 const char *enc = "Transfer-Encoding: chunked\r\n";
45 const char *conn;
46
47 if (!uh_use_chunked(cl))
48 enc = "";
49
50 if (cl->request.version != UH_HTTP_VER_1_1)
51 conn = "Connection: close";
52 else
53 conn = "Connection: keep-alive";
54
55 ustream_printf(cl->us, "%s %03i %s\r\n%s\r\n%s",
56 http_versions[cl->request.version],
57 code, summary, conn, enc);
58 }
59
60 static void uh_connection_close(struct client *cl)
61 {
62 cl->state = CLIENT_STATE_CLOSE;
63 cl->us->eof = true;
64 ustream_state_change(cl->us);
65 }
66
67 static void uh_dispatch_done(struct client *cl)
68 {
69 if (cl->dispatch.free)
70 cl->dispatch.free(cl);
71 }
72
73 void uh_request_done(struct client *cl)
74 {
75 uh_chunk_eof(cl);
76 uh_dispatch_done(cl);
77 cl->us->notify_write = NULL;
78 memset(&cl->dispatch, 0, sizeof(cl->dispatch));
79
80 if (cl->request.version != UH_HTTP_VER_1_1 || !conf.http_keepalive) {
81 uh_connection_close(cl);
82 return;
83 }
84
85 cl->state = CLIENT_STATE_INIT;
86 uloop_timeout_set(&cl->timeout, conf.http_keepalive * 1000);
87 }
88
89 void __printf(4, 5)
90 uh_client_error(struct client *cl, int code, const char *summary, const char *fmt, ...)
91 {
92 va_list arg;
93
94 uh_http_header(cl, code, summary);
95 ustream_printf(cl->us, "Content-Type: text/html\r\n\r\n");
96
97 uh_chunk_printf(cl, "<h1>%s</h1>", summary);
98
99 if (fmt) {
100 va_start(arg, fmt);
101 uh_chunk_vprintf(cl, fmt, arg);
102 va_end(arg);
103 }
104
105 uh_request_done(cl);
106 }
107
108 static void uh_header_error(struct client *cl, int code, const char *summary)
109 {
110 uh_client_error(cl, code, summary, NULL);
111 uh_connection_close(cl);
112 }
113
114 static void client_timeout(struct uloop_timeout *timeout)
115 {
116 struct client *cl = container_of(timeout, struct client, timeout);
117
118 cl->state = CLIENT_STATE_CLOSE;
119 uh_connection_close(cl);
120 }
121
122 static int find_idx(const char * const *list, int max, const char *str)
123 {
124 int i;
125
126 for (i = 0; i < max; i++)
127 if (!strcmp(list[i], str))
128 return i;
129
130 return -1;
131 }
132
133 static int client_parse_request(struct client *cl, char *data)
134 {
135 struct http_request *req = &cl->request;
136 char *type, *path, *version;
137 int h_method, h_version;
138
139 type = strtok(data, " ");
140 path = strtok(NULL, " ");
141 version = strtok(NULL, " ");
142 if (!type || !path || !version)
143 return CLIENT_STATE_DONE;
144
145 blobmsg_add_string(&cl->hdr, "URL", path);
146
147 memset(&cl->request, 0, sizeof(cl->request));
148 h_method = find_idx(http_methods, ARRAY_SIZE(http_methods), type);
149 h_version = find_idx(http_versions, ARRAY_SIZE(http_versions), version);
150 if (h_method < 0 || h_version < 0) {
151 req->version = UH_HTTP_VER_1_0;
152 return CLIENT_STATE_DONE;
153 }
154
155 req->method = h_method;
156 req->version = h_version;
157
158 return CLIENT_STATE_HEADER;
159 }
160
161 static bool client_init_cb(struct client *cl, char *buf, int len)
162 {
163 char *newline;
164
165 newline = strstr(buf, "\r\n");
166 if (!newline)
167 return false;
168
169 *newline = 0;
170 blob_buf_init(&cl->hdr, 0);
171 cl->state = client_parse_request(cl, buf);
172 ustream_consume(cl->us, newline + 2 - buf);
173 if (cl->state == CLIENT_STATE_DONE)
174 uh_header_error(cl, 400, "Bad Request");
175
176 return true;
177 }
178
179 static bool rfc1918_filter_check(struct client *cl)
180 {
181 if (!conf.rfc1918_filter)
182 return true;
183
184 if (!uh_addr_rfc1918(&cl->peer_addr) || uh_addr_rfc1918(&cl->srv_addr))
185 return true;
186
187 uh_client_error(cl, 403, "Forbidden",
188 "Rejected request from RFC1918 IP "
189 "to public server address");
190 return false;
191 }
192
193 static void client_header_complete(struct client *cl)
194 {
195 if (!rfc1918_filter_check(cl))
196 return;
197
198 if (cl->request.expect_cont)
199 ustream_printf(cl->us, "HTTP/1.1 100 Continue\r\n\r\n");
200
201 uh_handle_request(cl);
202 }
203
204 static void client_parse_header(struct client *cl, char *data)
205 {
206 struct http_request *r = &cl->request;
207 char *err;
208 char *name;
209 char *val;
210
211 if (!*data) {
212 uloop_timeout_cancel(&cl->timeout);
213 cl->state = CLIENT_STATE_DATA;
214 client_header_complete(cl);
215 return;
216 }
217
218 val = uh_split_header(data);
219 if (!val) {
220 cl->state = CLIENT_STATE_DONE;
221 return;
222 }
223
224 for (name = data; *name; name++)
225 if (isupper(*name))
226 *name = tolower(*name);
227
228 if (!strcmp(data, "expect")) {
229 if (!strcasecmp(val, "100-continue"))
230 r->expect_cont = true;
231 else {
232 uh_header_error(cl, 412, "Precondition Failed");
233 return;
234 }
235 } else if (!strcmp(data, "content-length")) {
236 r->content_length = strtoul(val, &err, 0);
237 if (err && *err) {
238 uh_header_error(cl, 400, "Bad Request");
239 return;
240 }
241 } else if (!strcmp(data, "transfer-encoding")) {
242 if (!strcmp(val, "chunked"))
243 r->transfer_chunked = true;
244 }
245
246
247 blobmsg_add_string(&cl->hdr, data, val);
248
249 cl->state = CLIENT_STATE_HEADER;
250 }
251
252 static bool client_data_cb(struct client *cl, char *buf, int len)
253 {
254 struct dispatch *d = &cl->dispatch;
255 struct http_request *r = &cl->request;
256 int consumed = 0;
257 int cur_len = 0;
258
259 if (!d->data_send)
260 return false;
261
262 while (len) {
263 int offset = 0;
264 char *sep;
265
266 consumed += cur_len;
267 buf += cur_len;
268 len -= cur_len;
269 cur_len = min(r->content_length, len);
270
271 if (cur_len) {
272 r->content_length -= cur_len;
273 if (d->data_send)
274 d->data_send(cl, buf, cur_len);
275 continue;
276 }
277
278 if (!r->transfer_chunked)
279 break;
280
281 if (r->transfer_chunked > 1)
282 offset = 2;
283
284 sep = strstr(buf + offset, "\r\n");
285 if (!sep)
286 break;
287
288 *sep = 0;
289 cur_len = sep + 2 - buf;
290
291 r->content_length = strtoul(buf + offset, &sep, 16);
292 r->transfer_chunked++;
293
294 /* invalid chunk length */
295 if (sep && *sep)
296 goto abort;
297
298 /* empty chunk == eof */
299 if (!r->content_length)
300 r->transfer_chunked = false;
301
302 continue;
303
304 abort:
305 consumed = len;
306 r->content_length = 0;
307 r->transfer_chunked = 0;
308 break;
309 }
310
311 ustream_consume(cl->us, consumed);
312 if (!r->content_length && !r->transfer_chunked) {
313 if (cl->dispatch.data_done)
314 cl->dispatch.data_done(cl);
315
316 cl->state = CLIENT_STATE_DONE;
317 }
318 return false;
319 }
320
321 static bool client_header_cb(struct client *cl, char *buf, int len)
322 {
323 char *newline;
324 int line_len;
325
326 newline = strstr(buf, "\r\n");
327 if (!newline)
328 return false;
329
330 *newline = 0;
331 client_parse_header(cl, buf);
332 line_len = newline + 2 - buf;
333 ustream_consume(cl->us, line_len);
334 if (cl->state == CLIENT_STATE_DATA)
335 return client_data_cb(cl, newline + 2, len - line_len);
336
337 return true;
338 }
339
340 typedef bool (*read_cb_t)(struct client *cl, char *buf, int len);
341 static read_cb_t read_cbs[] = {
342 [CLIENT_STATE_INIT] = client_init_cb,
343 [CLIENT_STATE_HEADER] = client_header_cb,
344 [CLIENT_STATE_DATA] = client_data_cb,
345 };
346
347 static void client_read_cb(struct client *cl)
348 {
349 struct ustream *us = cl->us;
350 char *str;
351 int len;
352
353 do {
354 str = ustream_get_read_buf(us, &len);
355 if (!str || !len)
356 break;
357
358 if (cl->state >= array_size(read_cbs) || !read_cbs[cl->state])
359 break;
360
361 if (!read_cbs[cl->state](cl, str, len)) {
362 if (len == us->r.buffer_len &&
363 cl->state != CLIENT_STATE_DATA)
364 uh_header_error(cl, 413, "Request Entity Too Large");
365 break;
366 }
367 } while(1);
368 }
369
370 static void client_close(struct client *cl)
371 {
372 n_clients--;
373 uh_dispatch_done(cl);
374 uloop_timeout_cancel(&cl->timeout);
375 ustream_free(&cl->sfd.stream);
376 close(cl->sfd.fd.fd);
377 list_del(&cl->list);
378 blob_buf_free(&cl->hdr);
379 free(cl);
380
381 uh_unblock_listeners();
382 }
383
384 static void client_ustream_read_cb(struct ustream *s, int bytes)
385 {
386 struct client *cl = container_of(s, struct client, sfd);
387
388 client_read_cb(cl);
389 }
390
391 static void client_ustream_write_cb(struct ustream *s, int bytes)
392 {
393 struct client *cl = container_of(s, struct client, sfd);
394
395 if (cl->dispatch.write_cb)
396 cl->dispatch.write_cb(cl);
397 }
398
399 static void client_notify_state(struct ustream *s)
400 {
401 struct client *cl = container_of(s, struct client, sfd);
402
403 if (!s->write_error) {
404 if (cl->state == CLIENT_STATE_DATA)
405 return;
406
407 if (!s->eof || s->w.data_bytes)
408 return;
409 }
410
411 return client_close(cl);
412 }
413
414 static void set_addr(struct uh_addr *addr, void *src)
415 {
416 struct sockaddr_in *sin = src;
417 struct sockaddr_in6 *sin6 = src;
418
419 addr->family = sin->sin_family;
420 if (addr->family == AF_INET) {
421 addr->port = ntohs(sin->sin_port);
422 memcpy(&addr->in, &sin->sin_addr, sizeof(addr->in));
423 } else {
424 addr->port = ntohs(sin6->sin6_port);
425 memcpy(&addr->in6, &sin6->sin6_addr, sizeof(addr->in6));
426 }
427 }
428
429 void uh_accept_client(int fd)
430 {
431 static struct client *next_client;
432 struct client *cl;
433 unsigned int sl;
434 int sfd;
435 static int client_id = 0;
436 struct sockaddr_in6 addr;
437
438 if (!next_client)
439 next_client = calloc(1, sizeof(*next_client));
440
441 cl = next_client;
442
443 sl = sizeof(addr);
444 sfd = accept(fd, (struct sockaddr *) &addr, &sl);
445 if (sfd < 0)
446 return;
447
448 set_addr(&cl->peer_addr, &addr);
449 sl = sizeof(addr);
450 getsockname(fd, (struct sockaddr *) &addr, &sl);
451 set_addr(&cl->srv_addr, &addr);
452 cl->us = &cl->sfd.stream;
453 cl->us->string_data = true;
454 cl->us->notify_read = client_ustream_read_cb;
455 cl->us->notify_write = client_ustream_write_cb;
456 cl->us->notify_state = client_notify_state;
457 ustream_fd_init(&cl->sfd, sfd);
458
459 cl->timeout.cb = client_timeout;
460 uloop_timeout_set(&cl->timeout, conf.network_timeout * 1000);
461
462 list_add_tail(&cl->list, &clients);
463
464 next_client = NULL;
465 n_clients++;
466 cl->id = client_id++;
467 }
468
469 void uh_close_fds(void)
470 {
471 struct client *cl;
472
473 uloop_done();
474 uh_close_listen_fds();
475 list_for_each_entry(cl, &clients, list) {
476 close(cl->sfd.fd.fd);
477 if (cl->dispatch.close_fds)
478 cl->dispatch.close_fds(cl);
479 }
480 }