1/* Licensed to the Apache Software Foundation (ASF) under one or more 2 * contributor license agreements. See the NOTICE file distributed with 3 * this work for additional information regarding copyright ownership. 4 * The ASF licenses this file to You under the Apache License, Version 2.0 5 * (the "License"); you may not use this file except in compliance with 6 * the License. You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17/* 18 * protocol.c --- routines which directly communicate with the client. 19 * 20 * Code originally by Rob McCool; much redone by Robert S. Thau 21 * and the Apache Software Foundation. 22 */ 23 24#include "apr.h" 25#include "apr_strings.h" 26#include "apr_buckets.h" 27#include "apr_lib.h" 28#include "apr_signal.h" 29#include "apr_strmatch.h" 30 31#define APR_WANT_STDIO /* for sscanf */ 32#define APR_WANT_STRFUNC 33#define APR_WANT_MEMFUNC 34#include "apr_want.h" 35 36#include "util_filter.h" 37#include "ap_config.h" 38#include "httpd.h" 39#include "http_config.h" 40#include "http_core.h" 41#include "http_protocol.h" 42#include "http_main.h" 43#include "http_request.h" 44#include "http_vhost.h" 45#include "http_log.h" /* For errors detected in basic auth common 46 * support code... */ 47#include "mod_core.h" 48#include "util_charset.h" 49#include "util_ebcdic.h" 50#include "scoreboard.h" 51 52#if APR_HAVE_STDARG_H 53#include <stdarg.h> 54#endif 55#if APR_HAVE_UNISTD_H 56#include <unistd.h> 57#endif 58 59/* we know core's module_index is 0 */ 60#undef APLOG_MODULE_INDEX 61#define APLOG_MODULE_INDEX AP_CORE_MODULE_INDEX 62 63APR_HOOK_STRUCT( 64 APR_HOOK_LINK(pre_read_request) 65 APR_HOOK_LINK(post_read_request) 66 APR_HOOK_LINK(log_transaction) 67 APR_HOOK_LINK(http_scheme) 68 APR_HOOK_LINK(default_port) 69 APR_HOOK_LINK(note_auth_failure) 70) 71 72AP_DECLARE_DATA ap_filter_rec_t *ap_old_write_func = NULL; 73 74 75/* Patterns to match in ap_make_content_type() */ 76static const char *needcset[] = { 77 "text/plain", 78 "text/html", 79 NULL 80}; 81static const apr_strmatch_pattern **needcset_patterns; 82static const apr_strmatch_pattern *charset_pattern; 83 84AP_DECLARE(void) ap_setup_make_content_type(apr_pool_t *pool) 85{ 86 int i; 87 for (i = 0; needcset[i]; i++) { 88 continue; 89 } 90 needcset_patterns = (const apr_strmatch_pattern **) 91 apr_palloc(pool, (i + 1) * sizeof(apr_strmatch_pattern *)); 92 for (i = 0; needcset[i]; i++) { 93 needcset_patterns[i] = apr_strmatch_precompile(pool, needcset[i], 0); 94 } 95 needcset_patterns[i] = NULL; 96 charset_pattern = apr_strmatch_precompile(pool, "charset=", 0); 97} 98 99/* 100 * Builds the content-type that should be sent to the client from the 101 * content-type specified. The following rules are followed: 102 * - if type is NULL or "", return NULL (do not set content-type). 103 * - if charset adding is disabled, stop processing and return type. 104 * - then, if there are no parameters on type, add the default charset 105 * - return type 106 */ 107AP_DECLARE(const char *)ap_make_content_type(request_rec *r, const char *type) 108{ 109 const apr_strmatch_pattern **pcset; 110 core_dir_config *conf = 111 (core_dir_config *)ap_get_core_module_config(r->per_dir_config); 112 core_request_config *request_conf; 113 apr_size_t type_len; 114 115 if (!type || *type == '\0') { 116 return NULL; 117 } 118 119 if (conf->add_default_charset != ADD_DEFAULT_CHARSET_ON) { 120 return type; 121 } 122 123 request_conf = ap_get_core_module_config(r->request_config); 124 if (request_conf->suppress_charset) { 125 return type; 126 } 127 128 type_len = strlen(type); 129 130 if (apr_strmatch(charset_pattern, type, type_len) != NULL) { 131 /* already has parameter, do nothing */ 132 /* XXX we don't check the validity */ 133 ; 134 } 135 else { 136 /* see if it makes sense to add the charset. At present, 137 * we only add it if the Content-type is one of needcset[] 138 */ 139 for (pcset = needcset_patterns; *pcset ; pcset++) { 140 if (apr_strmatch(*pcset, type, type_len) != NULL) { 141 struct iovec concat[3]; 142 concat[0].iov_base = (void *)type; 143 concat[0].iov_len = type_len; 144 concat[1].iov_base = (void *)"; charset="; 145 concat[1].iov_len = sizeof("; charset=") - 1; 146 concat[2].iov_base = (void *)(conf->add_default_charset_name); 147 concat[2].iov_len = strlen(conf->add_default_charset_name); 148 type = apr_pstrcatv(r->pool, concat, 3, NULL); 149 break; 150 } 151 } 152 } 153 154 return type; 155} 156 157AP_DECLARE(void) ap_set_content_length(request_rec *r, apr_off_t clength) 158{ 159 r->clength = clength; 160 apr_table_setn(r->headers_out, "Content-Length", 161 apr_off_t_toa(r->pool, clength)); 162} 163 164/* 165 * Return the latest rational time from a request/mtime (modification time) 166 * pair. We return the mtime unless it's in the future, in which case we 167 * return the current time. We use the request time as a reference in order 168 * to limit the number of calls to time(). We don't check for futurosity 169 * unless the mtime is at least as new as the reference. 170 */ 171AP_DECLARE(apr_time_t) ap_rationalize_mtime(request_rec *r, apr_time_t mtime) 172{ 173 apr_time_t now; 174 175 /* For all static responses, it's almost certain that the file was 176 * last modified before the beginning of the request. So there's 177 * no reason to call time(NULL) again. But if the response has been 178 * created on demand, then it might be newer than the time the request 179 * started. In this event we really have to call time(NULL) again 180 * so that we can give the clients the most accurate Last-Modified. If we 181 * were given a time in the future, we return the current time - the 182 * Last-Modified can't be in the future. 183 */ 184 now = (mtime < r->request_time) ? r->request_time : apr_time_now(); 185 return (mtime > now) ? now : mtime; 186} 187 188/* Get a line of protocol input, including any continuation lines 189 * caused by MIME folding (or broken clients) if fold != 0, and place it 190 * in the buffer s, of size n bytes, without the ending newline. 191 * 192 * If s is NULL, ap_rgetline_core will allocate necessary memory from r->pool. 193 * 194 * Returns APR_SUCCESS if there are no problems and sets *read to be 195 * the full length of s. 196 * 197 * APR_ENOSPC is returned if there is not enough buffer space. 198 * Other errors may be returned on other errors. 199 * 200 * The LF is *not* returned in the buffer. Therefore, a *read of 0 201 * indicates that an empty line was read. 202 * 203 * Notes: Because the buffer uses 1 char for NUL, the most we can return is 204 * (n - 1) actual characters. 205 * 206 * If no LF is detected on the last line due to a dropped connection 207 * or a full buffer, that's considered an error. 208 */ 209AP_DECLARE(apr_status_t) ap_rgetline_core(char **s, apr_size_t n, 210 apr_size_t *read, request_rec *r, 211 int fold, apr_bucket_brigade *bb) 212{ 213 apr_status_t rv; 214 apr_bucket *e; 215 apr_size_t bytes_handled = 0, current_alloc = 0; 216 char *pos, *last_char = *s; 217 int do_alloc = (*s == NULL), saw_eos = 0; 218 219 /* 220 * Initialize last_char as otherwise a random value will be compared 221 * against APR_ASCII_LF at the end of the loop if bb only contains 222 * zero-length buckets. 223 */ 224 if (last_char) 225 *last_char = '\0'; 226 227 for (;;) { 228 apr_brigade_cleanup(bb); 229 rv = ap_get_brigade(r->input_filters, bb, AP_MODE_GETLINE, 230 APR_BLOCK_READ, 0); 231 if (rv != APR_SUCCESS) { 232 return rv; 233 } 234 235 /* Something horribly wrong happened. Someone didn't block! */ 236 if (APR_BRIGADE_EMPTY(bb)) { 237 return APR_EGENERAL; 238 } 239 240 for (e = APR_BRIGADE_FIRST(bb); 241 e != APR_BRIGADE_SENTINEL(bb); 242 e = APR_BUCKET_NEXT(e)) 243 { 244 const char *str; 245 apr_size_t len; 246 247 /* If we see an EOS, don't bother doing anything more. */ 248 if (APR_BUCKET_IS_EOS(e)) { 249 saw_eos = 1; 250 break; 251 } 252 253 rv = apr_bucket_read(e, &str, &len, APR_BLOCK_READ); 254 if (rv != APR_SUCCESS) { 255 return rv; 256 } 257 258 if (len == 0) { 259 /* no use attempting a zero-byte alloc (hurts when 260 * using --with-efence --enable-pool-debug) or 261 * doing any of the other logic either 262 */ 263 continue; 264 } 265 266 /* Would this overrun our buffer? If so, we'll die. */ 267 if (n < bytes_handled + len) { 268 *read = bytes_handled; 269 if (*s) { 270 /* ensure this string is NUL terminated */ 271 if (bytes_handled > 0) { 272 (*s)[bytes_handled-1] = '\0'; 273 } 274 else { 275 (*s)[0] = '\0'; 276 } 277 } 278 return APR_ENOSPC; 279 } 280 281 /* Do we have to handle the allocation ourselves? */ 282 if (do_alloc) { 283 /* We'll assume the common case where one bucket is enough. */ 284 if (!*s) { 285 current_alloc = len; 286 *s = apr_palloc(r->pool, current_alloc); 287 } 288 else if (bytes_handled + len > current_alloc) { 289 /* Increase the buffer size */ 290 apr_size_t new_size = current_alloc * 2; 291 char *new_buffer; 292 293 if (bytes_handled + len > new_size) { 294 new_size = (bytes_handled + len) * 2; 295 } 296 297 new_buffer = apr_palloc(r->pool, new_size); 298 299 /* Copy what we already had. */ 300 memcpy(new_buffer, *s, bytes_handled); 301 current_alloc = new_size; 302 *s = new_buffer; 303 } 304 } 305 306 /* Just copy the rest of the data to the end of the old buffer. */ 307 pos = *s + bytes_handled; 308 memcpy(pos, str, len); 309 last_char = pos + len - 1; 310 311 /* We've now processed that new data - update accordingly. */ 312 bytes_handled += len; 313 } 314 315 /* If we got a full line of input, stop reading */ 316 if (last_char && (*last_char == APR_ASCII_LF)) { 317 break; 318 } 319 } 320 321 /* Now NUL-terminate the string at the end of the line; 322 * if the last-but-one character is a CR, terminate there */ 323 if (last_char > *s && last_char[-1] == APR_ASCII_CR) { 324 last_char--; 325 } 326 *last_char = '\0'; 327 bytes_handled = last_char - *s; 328 329 /* If we're folding, we have more work to do. 330 * 331 * Note that if an EOS was seen, we know we can't have another line. 332 */ 333 if (fold && bytes_handled && !saw_eos) { 334 for (;;) { 335 const char *str; 336 apr_size_t len; 337 char c; 338 339 /* Clear the temp brigade for this filter read. */ 340 apr_brigade_cleanup(bb); 341 342 /* We only care about the first byte. */ 343 rv = ap_get_brigade(r->input_filters, bb, AP_MODE_SPECULATIVE, 344 APR_BLOCK_READ, 1); 345 if (rv != APR_SUCCESS) { 346 return rv; 347 } 348 349 if (APR_BRIGADE_EMPTY(bb)) { 350 break; 351 } 352 353 e = APR_BRIGADE_FIRST(bb); 354 355 /* If we see an EOS, don't bother doing anything more. */ 356 if (APR_BUCKET_IS_EOS(e)) { 357 break; 358 } 359 360 rv = apr_bucket_read(e, &str, &len, APR_BLOCK_READ); 361 if (rv != APR_SUCCESS) { 362 apr_brigade_cleanup(bb); 363 return rv; 364 } 365 366 /* Found one, so call ourselves again to get the next line. 367 * 368 * FIXME: If the folding line is completely blank, should we 369 * stop folding? Does that require also looking at the next 370 * char? 371 */ 372 /* When we call destroy, the buckets are deleted, so save that 373 * one character we need. This simplifies our execution paths 374 * at the cost of one character read. 375 */ 376 c = *str; 377 if (c == APR_ASCII_BLANK || c == APR_ASCII_TAB) { 378 /* Do we have enough space? We may be full now. */ 379 if (bytes_handled >= n) { 380 *read = n; 381 /* ensure this string is terminated */ 382 (*s)[n-1] = '\0'; 383 return APR_ENOSPC; 384 } 385 else { 386 apr_size_t next_size, next_len; 387 char *tmp; 388 389 /* If we're doing the allocations for them, we have to 390 * give ourselves a NULL and copy it on return. 391 */ 392 if (do_alloc) { 393 tmp = NULL; 394 } else { 395 /* We're null terminated. */ 396 tmp = last_char; 397 } 398 399 next_size = n - bytes_handled; 400 401 rv = ap_rgetline_core(&tmp, next_size, 402 &next_len, r, 0, bb); 403 if (rv != APR_SUCCESS) { 404 return rv; 405 } 406 407 if (do_alloc && next_len > 0) { 408 char *new_buffer; 409 apr_size_t new_size = bytes_handled + next_len + 1; 410 411 /* we need to alloc an extra byte for a null */ 412 new_buffer = apr_palloc(r->pool, new_size); 413 414 /* Copy what we already had. */ 415 memcpy(new_buffer, *s, bytes_handled); 416 417 /* copy the new line, including the trailing null */ 418 memcpy(new_buffer + bytes_handled, tmp, next_len + 1); 419 *s = new_buffer; 420 } 421 422 last_char += next_len; 423 bytes_handled += next_len; 424 } 425 } 426 else { /* next character is not tab or space */ 427 break; 428 } 429 } 430 } 431 *read = bytes_handled; 432 433 /* PR#43039: We shouldn't accept NULL bytes within the line */ 434 if (strlen(*s) < bytes_handled) { 435 return APR_EINVAL; 436 } 437 438 return APR_SUCCESS; 439} 440 441#if APR_CHARSET_EBCDIC 442AP_DECLARE(apr_status_t) ap_rgetline(char **s, apr_size_t n, 443 apr_size_t *read, request_rec *r, 444 int fold, apr_bucket_brigade *bb) 445{ 446 /* on ASCII boxes, ap_rgetline is a macro which simply invokes 447 * ap_rgetline_core with the same parms 448 * 449 * on EBCDIC boxes, each complete http protocol input line needs to be 450 * translated into the code page used by the compiler. Since 451 * ap_rgetline_core uses recursion, we do the translation in a wrapper 452 * function to ensure that each input character gets translated only once. 453 */ 454 apr_status_t rv; 455 456 rv = ap_rgetline_core(s, n, read, r, fold, bb); 457 if (rv == APR_SUCCESS) { 458 ap_xlate_proto_from_ascii(*s, *read); 459 } 460 return rv; 461} 462#endif 463 464AP_DECLARE(int) ap_getline(char *s, int n, request_rec *r, int fold) 465{ 466 char *tmp_s = s; 467 apr_status_t rv; 468 apr_size_t len; 469 apr_bucket_brigade *tmp_bb; 470 471 tmp_bb = apr_brigade_create(r->pool, r->connection->bucket_alloc); 472 rv = ap_rgetline(&tmp_s, n, &len, r, fold, tmp_bb); 473 apr_brigade_destroy(tmp_bb); 474 475 /* Map the out-of-space condition to the old API. */ 476 if (rv == APR_ENOSPC) { 477 return n; 478 } 479 480 /* Anything else is just bad. */ 481 if (rv != APR_SUCCESS) { 482 return -1; 483 } 484 485 return (int)len; 486} 487 488/* parse_uri: break apart the uri 489 * Side Effects: 490 * - sets r->args to rest after '?' (or NULL if no '?') 491 * - sets r->uri to request uri (without r->args part) 492 * - sets r->hostname (if not set already) from request (scheme://host:port) 493 */ 494AP_CORE_DECLARE(void) ap_parse_uri(request_rec *r, const char *uri) 495{ 496 int status = HTTP_OK; 497 498 r->unparsed_uri = apr_pstrdup(r->pool, uri); 499 500 /* http://issues.apache.org/bugzilla/show_bug.cgi?id=31875 501 * http://issues.apache.org/bugzilla/show_bug.cgi?id=28450 502 * 503 * This is not in fact a URI, it's a path. That matters in the 504 * case of a leading double-slash. We need to resolve the issue 505 * by normalising that out before treating it as a URI. 506 */ 507 while ((uri[0] == '/') && (uri[1] == '/')) { 508 ++uri ; 509 } 510 if (r->method_number == M_CONNECT) { 511 status = apr_uri_parse_hostinfo(r->pool, uri, &r->parsed_uri); 512 } 513 else { 514 status = apr_uri_parse(r->pool, uri, &r->parsed_uri); 515 } 516 517 if (status == APR_SUCCESS) { 518 /* if it has a scheme we may need to do absoluteURI vhost stuff */ 519 if (r->parsed_uri.scheme 520 && !strcasecmp(r->parsed_uri.scheme, ap_http_scheme(r))) { 521 r->hostname = r->parsed_uri.hostname; 522 } 523 else if (r->method_number == M_CONNECT) { 524 r->hostname = r->parsed_uri.hostname; 525 } 526 527 r->args = r->parsed_uri.query; 528 r->uri = r->parsed_uri.path ? r->parsed_uri.path 529 : apr_pstrdup(r->pool, "/"); 530 531#if defined(OS2) || defined(WIN32) 532 /* Handle path translations for OS/2 and plug security hole. 533 * This will prevent "http://www.wherever.com/..\..\/" from 534 * returning a directory for the root drive. 535 */ 536 { 537 char *x; 538 539 for (x = r->uri; (x = strchr(x, '\\')) != NULL; ) 540 *x = '/'; 541 } 542#endif /* OS2 || WIN32 */ 543 } 544 else { 545 r->args = NULL; 546 r->hostname = NULL; 547 r->status = HTTP_BAD_REQUEST; /* set error status */ 548 r->uri = apr_pstrdup(r->pool, uri); 549 } 550} 551 552static int read_request_line(request_rec *r, apr_bucket_brigade *bb) 553{ 554 const char *ll; 555 const char *uri; 556 const char *pro; 557 558 int major = 1, minor = 0; /* Assume HTTP/1.0 if non-"HTTP" protocol */ 559 char http[5]; 560 apr_size_t len; 561 int num_blank_lines = 0; 562 int max_blank_lines = r->server->limit_req_fields; 563 564 if (max_blank_lines <= 0) { 565 max_blank_lines = DEFAULT_LIMIT_REQUEST_FIELDS; 566 } 567 568 /* Read past empty lines until we get a real request line, 569 * a read error, the connection closes (EOF), or we timeout. 570 * 571 * We skip empty lines because browsers have to tack a CRLF on to the end 572 * of POSTs to support old CERN webservers. But note that we may not 573 * have flushed any previous response completely to the client yet. 574 * We delay the flush as long as possible so that we can improve 575 * performance for clients that are pipelining requests. If a request 576 * is pipelined then we won't block during the (implicit) read() below. 577 * If the requests aren't pipelined, then the client is still waiting 578 * for the final buffer flush from us, and we will block in the implicit 579 * read(). B_SAFEREAD ensures that the BUFF layer flushes if it will 580 * have to block during a read. 581 */ 582 583 do { 584 apr_status_t rv; 585 586 /* ensure ap_rgetline allocates memory each time thru the loop 587 * if there are empty lines 588 */ 589 r->the_request = NULL; 590 rv = ap_rgetline(&(r->the_request), (apr_size_t)(r->server->limit_req_line + 2), 591 &len, r, 0, bb); 592 593 if (rv != APR_SUCCESS) { 594 r->request_time = apr_time_now(); 595 596 /* ap_rgetline returns APR_ENOSPC if it fills up the 597 * buffer before finding the end-of-line. This is only going to 598 * happen if it exceeds the configured limit for a request-line. 599 */ 600 if (APR_STATUS_IS_ENOSPC(rv)) { 601 r->status = HTTP_REQUEST_URI_TOO_LARGE; 602 r->proto_num = HTTP_VERSION(1,0); 603 r->protocol = apr_pstrdup(r->pool, "HTTP/1.0"); 604 } 605 else if (APR_STATUS_IS_TIMEUP(rv)) { 606 r->status = HTTP_REQUEST_TIME_OUT; 607 } 608 else if (APR_STATUS_IS_EINVAL(rv)) { 609 r->status = HTTP_BAD_REQUEST; 610 } 611 return 0; 612 } 613 } while ((len <= 0) && (++num_blank_lines < max_blank_lines)); 614 615 if (APLOGrtrace5(r)) { 616 ap_log_rerror(APLOG_MARK, APLOG_TRACE5, 0, r, 617 "Request received from client: %s", 618 ap_escape_logitem(r->pool, r->the_request)); 619 } 620 621 r->request_time = apr_time_now(); 622 ll = r->the_request; 623 r->method = ap_getword_white(r->pool, &ll); 624 625 uri = ap_getword_white(r->pool, &ll); 626 627 /* Provide quick information about the request method as soon as known */ 628 629 r->method_number = ap_method_number_of(r->method); 630 if (r->method_number == M_GET && r->method[0] == 'H') { 631 r->header_only = 1; 632 } 633 634 ap_parse_uri(r, uri); 635 636 if (ll[0]) { 637 r->assbackwards = 0; 638 pro = ll; 639 len = strlen(ll); 640 } else { 641 r->assbackwards = 1; 642 pro = "HTTP/0.9"; 643 len = 8; 644 } 645 r->protocol = apr_pstrmemdup(r->pool, pro, len); 646 647 /* Avoid sscanf in the common case */ 648 if (len == 8 649 && pro[0] == 'H' && pro[1] == 'T' && pro[2] == 'T' && pro[3] == 'P' 650 && pro[4] == '/' && apr_isdigit(pro[5]) && pro[6] == '.' 651 && apr_isdigit(pro[7])) { 652 r->proto_num = HTTP_VERSION(pro[5] - '0', pro[7] - '0'); 653 } 654 else if (3 == sscanf(r->protocol, "%4s/%u.%u", http, &major, &minor) 655 && (strcasecmp("http", http) == 0) 656 && (minor < HTTP_VERSION(1, 0)) ) /* don't allow HTTP/0.1000 */ 657 r->proto_num = HTTP_VERSION(major, minor); 658 else 659 r->proto_num = HTTP_VERSION(1, 0); 660 661 return 1; 662} 663 664static int table_do_fn_check_lengths(void *r_, const char *key, 665 const char *value) 666{ 667 request_rec *r = r_; 668 if (value == NULL || r->server->limit_req_fieldsize >= strlen(value) ) 669 return 1; 670 671 r->status = HTTP_BAD_REQUEST; 672 apr_table_setn(r->notes, "error-notes", 673 apr_pstrcat(r->pool, "Size of a request header field " 674 "after merging exceeds server limit.<br />" 675 "\n<pre>\n", 676 ap_escape_html(r->pool, key), 677 "</pre>\n", NULL)); 678 ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r, APLOGNO(00560) "Request header " 679 "exceeds LimitRequestFieldSize after merging: %s", key); 680 return 0; 681} 682 683/* get the length of the field name for logging, but no more than 80 bytes */ 684#define LOG_NAME_MAX_LEN 80 685static int field_name_len(const char *field) 686{ 687 const char *end = ap_strchr_c(field, ':'); 688 if (end == NULL || end - field > LOG_NAME_MAX_LEN) 689 return LOG_NAME_MAX_LEN; 690 return end - field; 691} 692 693AP_DECLARE(void) ap_get_mime_headers_core(request_rec *r, apr_bucket_brigade *bb) 694{ 695 char *last_field = NULL; 696 apr_size_t last_len = 0; 697 apr_size_t alloc_len = 0; 698 char *field; 699 char *value; 700 apr_size_t len; 701 int fields_read = 0; 702 char *tmp_field; 703 704 /* 705 * Read header lines until we get the empty separator line, a read error, 706 * the connection closes (EOF), reach the server limit, or we timeout. 707 */ 708 while(1) { 709 apr_status_t rv; 710 int folded = 0; 711 712 field = NULL; 713 rv = ap_rgetline(&field, r->server->limit_req_fieldsize + 2, 714 &len, r, 0, bb); 715 716 if (rv != APR_SUCCESS) { 717 if (APR_STATUS_IS_TIMEUP(rv)) { 718 r->status = HTTP_REQUEST_TIME_OUT; 719 } 720 else { 721 r->status = HTTP_BAD_REQUEST; 722 } 723 724 /* ap_rgetline returns APR_ENOSPC if it fills up the buffer before 725 * finding the end-of-line. This is only going to happen if it 726 * exceeds the configured limit for a field size. 727 */ 728 if (rv == APR_ENOSPC) { 729 const char *field_escaped; 730 if (field) { 731 /* ensure ap_escape_html will terminate correctly */ 732 field[len - 1] = '\0'; 733 field_escaped = ap_escape_html(r->pool, field); 734 } 735 else { 736 field_escaped = field = ""; 737 } 738 739 apr_table_setn(r->notes, "error-notes", 740 apr_psprintf(r->pool, 741 "Size of a request header field " 742 "exceeds server limit.<br />\n" 743 "<pre>\n%.*s\n</pre>\n", 744 field_name_len(field_escaped), 745 field_escaped)); 746 ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r, APLOGNO(00561) 747 "Request header exceeds LimitRequestFieldSize%s" 748 "%.*s", 749 *field ? ": " : "", 750 field_name_len(field), field); 751 } 752 return; 753 } 754 755 if (last_field != NULL) { 756 if ((len > 0) && ((*field == '\t') || *field == ' ')) { 757 /* This line is a continuation of the preceding line(s), 758 * so append it to the line that we've set aside. 759 * Note: this uses a power-of-two allocator to avoid 760 * doing O(n) allocs and using O(n^2) space for 761 * continuations that span many many lines. 762 */ 763 apr_size_t fold_len = last_len + len + 1; /* trailing null */ 764 765 if (fold_len >= (apr_size_t)(r->server->limit_req_fieldsize)) { 766 r->status = HTTP_BAD_REQUEST; 767 /* report what we have accumulated so far before the 768 * overflow (last_field) as the field with the problem 769 */ 770 apr_table_setn(r->notes, "error-notes", 771 apr_psprintf(r->pool, 772 "Size of a request header field " 773 "after folding " 774 "exceeds server limit.<br />\n" 775 "<pre>\n%.*s\n</pre>\n", 776 field_name_len(last_field), 777 ap_escape_html(r->pool, last_field))); 778 ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r, APLOGNO(00562) 779 "Request header exceeds LimitRequestFieldSize " 780 "after folding: %.*s", 781 field_name_len(last_field), last_field); 782 return; 783 } 784 785 if (fold_len > alloc_len) { 786 char *fold_buf; 787 alloc_len += alloc_len; 788 if (fold_len > alloc_len) { 789 alloc_len = fold_len; 790 } 791 fold_buf = (char *)apr_palloc(r->pool, alloc_len); 792 memcpy(fold_buf, last_field, last_len); 793 last_field = fold_buf; 794 } 795 memcpy(last_field + last_len, field, len +1); /* +1 for nul */ 796 last_len += len; 797 folded = 1; 798 } 799 else /* not a continuation line */ { 800 801 if (r->server->limit_req_fields 802 && (++fields_read > r->server->limit_req_fields)) { 803 r->status = HTTP_BAD_REQUEST; 804 apr_table_setn(r->notes, "error-notes", 805 "The number of request header fields " 806 "exceeds this server's limit."); 807 ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r, APLOGNO(00563) 808 "Number of request headers exceeds " 809 "LimitRequestFields"); 810 return; 811 } 812 813 if (!(value = strchr(last_field, ':'))) { /* Find ':' or */ 814 r->status = HTTP_BAD_REQUEST; /* abort bad request */ 815 apr_table_setn(r->notes, "error-notes", 816 apr_psprintf(r->pool, 817 "Request header field is " 818 "missing ':' separator.<br />\n" 819 "<pre>\n%.*s</pre>\n", 820 (int)LOG_NAME_MAX_LEN, 821 ap_escape_html(r->pool, 822 last_field))); 823 ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r, APLOGNO(00564) 824 "Request header field is missing ':' " 825 "separator: %.*s", (int)LOG_NAME_MAX_LEN, 826 last_field); 827 return; 828 } 829 830 tmp_field = value - 1; /* last character of field-name */ 831 832 *value++ = '\0'; /* NUL-terminate at colon */ 833 834 while (*value == ' ' || *value == '\t') { 835 ++value; /* Skip to start of value */ 836 } 837 838 /* Strip LWS after field-name: */ 839 while (tmp_field > last_field 840 && (*tmp_field == ' ' || *tmp_field == '\t')) { 841 *tmp_field-- = '\0'; 842 } 843 844 /* Strip LWS after field-value: */ 845 tmp_field = last_field + last_len - 1; 846 while (tmp_field > value 847 && (*tmp_field == ' ' || *tmp_field == '\t')) { 848 *tmp_field-- = '\0'; 849 } 850 851 apr_table_addn(r->headers_in, last_field, value); 852 853 /* reset the alloc_len so that we'll allocate a new 854 * buffer if we have to do any more folding: we can't 855 * use the previous buffer because its contents are 856 * now part of r->headers_in 857 */ 858 alloc_len = 0; 859 860 } /* end if current line is not a continuation starting with tab */ 861 } 862 863 /* Found a blank line, stop. */ 864 if (len == 0) { 865 break; 866 } 867 868 /* Keep track of this line so that we can parse it on 869 * the next loop iteration. (In the folded case, last_field 870 * has been updated already.) 871 */ 872 if (!folded) { 873 last_field = field; 874 last_len = len; 875 } 876 } 877 878 /* Combine multiple message-header fields with the same 879 * field-name, following RFC 2616, 4.2. 880 */ 881 apr_table_compress(r->headers_in, APR_OVERLAP_TABLES_MERGE); 882 883 /* enforce LimitRequestFieldSize for merged headers */ 884 apr_table_do(table_do_fn_check_lengths, r, r->headers_in, NULL); 885} 886 887AP_DECLARE(void) ap_get_mime_headers(request_rec *r) 888{ 889 apr_bucket_brigade *tmp_bb; 890 tmp_bb = apr_brigade_create(r->pool, r->connection->bucket_alloc); 891 ap_get_mime_headers_core(r, tmp_bb); 892 apr_brigade_destroy(tmp_bb); 893} 894 895request_rec *ap_read_request(conn_rec *conn) 896{ 897 request_rec *r; 898 apr_pool_t *p; 899 const char *expect; 900 int access_status = HTTP_OK; 901 apr_bucket_brigade *tmp_bb; 902 apr_socket_t *csd; 903 apr_interval_time_t cur_timeout; 904 905 906 apr_pool_create(&p, conn->pool); 907 apr_pool_tag(p, "request"); 908 r = apr_pcalloc(p, sizeof(request_rec)); 909 AP_READ_REQUEST_ENTRY((intptr_t)r, (uintptr_t)conn); 910 r->pool = p; 911 r->connection = conn; 912 r->server = conn->base_server; 913 914 r->user = NULL; 915 r->ap_auth_type = NULL; 916 917 r->allowed_methods = ap_make_method_list(p, 2); 918 919 r->headers_in = apr_table_make(r->pool, 25); 920 r->subprocess_env = apr_table_make(r->pool, 25); 921 r->headers_out = apr_table_make(r->pool, 12); 922 r->err_headers_out = apr_table_make(r->pool, 5); 923 r->notes = apr_table_make(r->pool, 5); 924 925 r->request_config = ap_create_request_config(r->pool); 926 /* Must be set before we run create request hook */ 927 928 r->proto_output_filters = conn->output_filters; 929 r->output_filters = r->proto_output_filters; 930 r->proto_input_filters = conn->input_filters; 931 r->input_filters = r->proto_input_filters; 932 ap_run_create_request(r); 933 r->per_dir_config = r->server->lookup_defaults; 934 935 r->sent_bodyct = 0; /* bytect isn't for body */ 936 937 r->read_length = 0; 938 r->read_body = REQUEST_NO_BODY; 939 940 r->status = HTTP_OK; /* Until further notice */ 941 r->the_request = NULL; 942 943 /* Begin by presuming any module can make its own path_info assumptions, 944 * until some module interjects and changes the value. 945 */ 946 r->used_path_info = AP_REQ_DEFAULT_PATH_INFO; 947 948 r->useragent_addr = conn->client_addr; 949 r->useragent_ip = conn->client_ip; 950 951 tmp_bb = apr_brigade_create(r->pool, r->connection->bucket_alloc); 952 953 ap_run_pre_read_request(r, conn); 954 955 /* Get the request... */ 956 if (!read_request_line(r, tmp_bb)) { 957 if (r->status == HTTP_REQUEST_URI_TOO_LARGE 958 || r->status == HTTP_BAD_REQUEST) { 959 if (r->status == HTTP_REQUEST_URI_TOO_LARGE) { 960 ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r, APLOGNO(00565) 961 "request failed: client's request-line exceeds LimitRequestLine (longer than %d)", 962 r->server->limit_req_line); 963 } 964 else if (r->method == NULL) { 965 ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r, APLOGNO(00566) 966 "request failed: invalid characters in URI"); 967 } 968 ap_send_error_response(r, 0); 969 ap_update_child_status(conn->sbh, SERVER_BUSY_LOG, r); 970 ap_run_log_transaction(r); 971 apr_brigade_destroy(tmp_bb); 972 goto traceout; 973 } 974 else if (r->status == HTTP_REQUEST_TIME_OUT) { 975 ap_update_child_status(conn->sbh, SERVER_BUSY_LOG, r); 976 if (!r->connection->keepalives) { 977 ap_run_log_transaction(r); 978 } 979 apr_brigade_destroy(tmp_bb); 980 goto traceout; 981 } 982 983 apr_brigade_destroy(tmp_bb); 984 r = NULL; 985 goto traceout; 986 } 987 988 /* We may have been in keep_alive_timeout mode, so toggle back 989 * to the normal timeout mode as we fetch the header lines, 990 * as necessary. 991 */ 992 csd = ap_get_conn_socket(conn); 993 apr_socket_timeout_get(csd, &cur_timeout); 994 if (cur_timeout != conn->base_server->timeout) { 995 apr_socket_timeout_set(csd, conn->base_server->timeout); 996 cur_timeout = conn->base_server->timeout; 997 } 998 999 if (!r->assbackwards) { 1000 const char *tenc; 1001 1002 ap_get_mime_headers_core(r, tmp_bb); 1003 if (r->status != HTTP_OK) { 1004 ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r, APLOGNO(00567) 1005 "request failed: error reading the headers"); 1006 ap_send_error_response(r, 0); 1007 ap_update_child_status(conn->sbh, SERVER_BUSY_LOG, r); 1008 ap_run_log_transaction(r); 1009 apr_brigade_destroy(tmp_bb); 1010 goto traceout; 1011 } 1012 1013 tenc = apr_table_get(r->headers_in, "Transfer-Encoding"); 1014 if (tenc) { 1015 /* http://tools.ietf.org/html/draft-ietf-httpbis-p1-messaging-23 1016 * Section 3.3.3.3: "If a Transfer-Encoding header field is 1017 * present in a request and the chunked transfer coding is not 1018 * the final encoding ...; the server MUST respond with the 400 1019 * (Bad Request) status code and then close the connection". 1020 */ 1021 if (!(strcasecmp(tenc, "chunked") == 0 /* fast path */ 1022 || ap_find_last_token(r->pool, tenc, "chunked"))) { 1023 ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r, APLOGNO(02539) 1024 "client sent unknown Transfer-Encoding " 1025 "(%s): %s", tenc, r->uri); 1026 r->status = HTTP_BAD_REQUEST; 1027 conn->keepalive = AP_CONN_CLOSE; 1028 ap_send_error_response(r, 0); 1029 ap_update_child_status(conn->sbh, SERVER_BUSY_LOG, r); 1030 ap_run_log_transaction(r); 1031 apr_brigade_destroy(tmp_bb); 1032 goto traceout; 1033 } 1034 1035 /* http://tools.ietf.org/html/draft-ietf-httpbis-p1-messaging-23 1036 * Section 3.3.3.3: "If a message is received with both a 1037 * Transfer-Encoding and a Content-Length header field, the 1038 * Transfer-Encoding overrides the Content-Length. ... A sender 1039 * MUST remove the received Content-Length field". 1040 */ 1041 apr_table_unset(r->headers_in, "Content-Length"); 1042 } 1043 } 1044 else { 1045 if (r->header_only) { 1046 /* 1047 * Client asked for headers only with HTTP/0.9, which doesn't send 1048 * headers! Have to dink things just to make sure the error message 1049 * comes through... 1050 */ 1051 ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r, APLOGNO(00568) 1052 "client sent invalid HTTP/0.9 request: HEAD %s", 1053 r->uri); 1054 r->header_only = 0; 1055 r->status = HTTP_BAD_REQUEST; 1056 ap_send_error_response(r, 0); 1057 ap_update_child_status(conn->sbh, SERVER_BUSY_LOG, r); 1058 ap_run_log_transaction(r); 1059 apr_brigade_destroy(tmp_bb); 1060 goto traceout; 1061 } 1062 } 1063 1064 apr_brigade_destroy(tmp_bb); 1065 1066 /* update what we think the virtual host is based on the headers we've 1067 * now read. may update status. 1068 */ 1069 ap_update_vhost_from_headers(r); 1070 1071 /* Toggle to the Host:-based vhost's timeout mode to fetch the 1072 * request body and send the response body, if needed. 1073 */ 1074 if (cur_timeout != r->server->timeout) { 1075 apr_socket_timeout_set(csd, r->server->timeout); 1076 cur_timeout = r->server->timeout; 1077 } 1078 1079 /* we may have switched to another server */ 1080 r->per_dir_config = r->server->lookup_defaults; 1081 1082 if ((!r->hostname && (r->proto_num >= HTTP_VERSION(1, 1))) 1083 || ((r->proto_num == HTTP_VERSION(1, 1)) 1084 && !apr_table_get(r->headers_in, "Host"))) { 1085 /* 1086 * Client sent us an HTTP/1.1 or later request without telling us the 1087 * hostname, either with a full URL or a Host: header. We therefore 1088 * need to (as per the 1.1 spec) send an error. As a special case, 1089 * HTTP/1.1 mentions twice (S9, S14.23) that a request MUST contain 1090 * a Host: header, and the server MUST respond with 400 if it doesn't. 1091 */ 1092 access_status = HTTP_BAD_REQUEST; 1093 ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r, APLOGNO(00569) 1094 "client sent HTTP/1.1 request without hostname " 1095 "(see RFC2616 section 14.23): %s", r->uri); 1096 } 1097 1098 /* 1099 * Add the HTTP_IN filter here to ensure that ap_discard_request_body 1100 * called by ap_die and by ap_send_error_response works correctly on 1101 * status codes that do not cause the connection to be dropped and 1102 * in situations where the connection should be kept alive. 1103 */ 1104 1105 ap_add_input_filter_handle(ap_http_input_filter_handle, 1106 NULL, r, r->connection); 1107 1108 if (access_status != HTTP_OK 1109 || (access_status = ap_run_post_read_request(r))) { 1110 ap_die(access_status, r); 1111 ap_update_child_status(conn->sbh, SERVER_BUSY_LOG, r); 1112 ap_run_log_transaction(r); 1113 r = NULL; 1114 goto traceout; 1115 } 1116 1117 if (((expect = apr_table_get(r->headers_in, "Expect")) != NULL) 1118 && (expect[0] != '\0')) { 1119 /* 1120 * The Expect header field was added to HTTP/1.1 after RFC 2068 1121 * as a means to signal when a 100 response is desired and, 1122 * unfortunately, to signal a poor man's mandatory extension that 1123 * the server must understand or return 417 Expectation Failed. 1124 */ 1125 if (strcasecmp(expect, "100-continue") == 0) { 1126 r->expecting_100 = 1; 1127 } 1128 else { 1129 r->status = HTTP_EXPECTATION_FAILED; 1130 ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r, APLOGNO(00570) 1131 "client sent an unrecognized expectation value of " 1132 "Expect: %s", expect); 1133 ap_send_error_response(r, 0); 1134 ap_update_child_status(conn->sbh, SERVER_BUSY_LOG, r); 1135 ap_run_log_transaction(r); 1136 goto traceout; 1137 } 1138 } 1139 1140 AP_READ_REQUEST_SUCCESS((uintptr_t)r, (char *)r->method, (char *)r->uri, (char *)r->server->defn_name, r->status); 1141 return r; 1142 traceout: 1143 AP_READ_REQUEST_FAILURE((uintptr_t)r); 1144 return r; 1145} 1146 1147/* if a request with a body creates a subrequest, remove original request's 1148 * input headers which pertain to the body which has already been read. 1149 * out-of-line helper function for ap_set_sub_req_protocol. 1150 */ 1151 1152static void strip_headers_request_body(request_rec *rnew) 1153{ 1154 apr_table_unset(rnew->headers_in, "Content-Encoding"); 1155 apr_table_unset(rnew->headers_in, "Content-Language"); 1156 apr_table_unset(rnew->headers_in, "Content-Length"); 1157 apr_table_unset(rnew->headers_in, "Content-Location"); 1158 apr_table_unset(rnew->headers_in, "Content-MD5"); 1159 apr_table_unset(rnew->headers_in, "Content-Range"); 1160 apr_table_unset(rnew->headers_in, "Content-Type"); 1161 apr_table_unset(rnew->headers_in, "Expires"); 1162 apr_table_unset(rnew->headers_in, "Last-Modified"); 1163 apr_table_unset(rnew->headers_in, "Transfer-Encoding"); 1164} 1165 1166/* 1167 * A couple of other functions which initialize some of the fields of 1168 * a request structure, as appropriate for adjuncts of one kind or another 1169 * to a request in progress. Best here, rather than elsewhere, since 1170 * *someone* has to set the protocol-specific fields... 1171 */ 1172 1173AP_DECLARE(void) ap_set_sub_req_protocol(request_rec *rnew, 1174 const request_rec *r) 1175{ 1176 rnew->the_request = r->the_request; /* Keep original request-line */ 1177 1178 rnew->assbackwards = 1; /* Don't send headers from this. */ 1179 rnew->no_local_copy = 1; /* Don't try to send HTTP_NOT_MODIFIED for a 1180 * fragment. */ 1181 rnew->method = "GET"; 1182 rnew->method_number = M_GET; 1183 rnew->protocol = "INCLUDED"; 1184 1185 rnew->status = HTTP_OK; 1186 1187 rnew->headers_in = apr_table_copy(rnew->pool, r->headers_in); 1188 1189 /* did the original request have a body? (e.g. POST w/SSI tags) 1190 * if so, make sure the subrequest doesn't inherit body headers 1191 */ 1192 if (!r->kept_body && (apr_table_get(r->headers_in, "Content-Length") 1193 || apr_table_get(r->headers_in, "Transfer-Encoding"))) { 1194 strip_headers_request_body(rnew); 1195 } 1196 rnew->subprocess_env = apr_table_copy(rnew->pool, r->subprocess_env); 1197 rnew->headers_out = apr_table_make(rnew->pool, 5); 1198 rnew->err_headers_out = apr_table_make(rnew->pool, 5); 1199 rnew->notes = apr_table_make(rnew->pool, 5); 1200 1201 rnew->expecting_100 = r->expecting_100; 1202 rnew->read_length = r->read_length; 1203 rnew->read_body = REQUEST_NO_BODY; 1204 1205 rnew->main = (request_rec *) r; 1206} 1207 1208static void end_output_stream(request_rec *r) 1209{ 1210 conn_rec *c = r->connection; 1211 apr_bucket_brigade *bb; 1212 apr_bucket *b; 1213 1214 bb = apr_brigade_create(r->pool, c->bucket_alloc); 1215 b = apr_bucket_eos_create(c->bucket_alloc); 1216 APR_BRIGADE_INSERT_TAIL(bb, b); 1217 ap_pass_brigade(r->output_filters, bb); 1218} 1219 1220AP_DECLARE(void) ap_finalize_sub_req_protocol(request_rec *sub) 1221{ 1222 /* tell the filter chain there is no more content coming */ 1223 if (!sub->eos_sent) { 1224 end_output_stream(sub); 1225 } 1226} 1227 1228/* finalize_request_protocol is called at completion of sending the 1229 * response. Its sole purpose is to send the terminating protocol 1230 * information for any wrappers around the response message body 1231 * (i.e., transfer encodings). It should have been named finalize_response. 1232 */ 1233AP_DECLARE(void) ap_finalize_request_protocol(request_rec *r) 1234{ 1235 (void) ap_discard_request_body(r); 1236 1237 /* tell the filter chain there is no more content coming */ 1238 if (!r->eos_sent) { 1239 end_output_stream(r); 1240 } 1241} 1242 1243/* 1244 * Support for the Basic authentication protocol, and a bit for Digest. 1245 */ 1246AP_DECLARE(void) ap_note_auth_failure(request_rec *r) 1247{ 1248 const char *type = ap_auth_type(r); 1249 if (type) { 1250 ap_run_note_auth_failure(r, type); 1251 } 1252 else { 1253 ap_log_rerror(APLOG_MARK, APLOG_ERR, 1254 0, r, APLOGNO(00571) "need AuthType to note auth failure: %s", r->uri); 1255 } 1256} 1257 1258AP_DECLARE(void) ap_note_basic_auth_failure(request_rec *r) 1259{ 1260 ap_note_auth_failure(r); 1261} 1262 1263AP_DECLARE(void) ap_note_digest_auth_failure(request_rec *r) 1264{ 1265 ap_note_auth_failure(r); 1266} 1267 1268AP_DECLARE(int) ap_get_basic_auth_pw(request_rec *r, const char **pw) 1269{ 1270 const char *auth_line = apr_table_get(r->headers_in, 1271 (PROXYREQ_PROXY == r->proxyreq) 1272 ? "Proxy-Authorization" 1273 : "Authorization"); 1274 const char *t; 1275 1276 if (!(t = ap_auth_type(r)) || strcasecmp(t, "Basic")) 1277 return DECLINED; 1278 1279 if (!ap_auth_name(r)) { 1280 ap_log_rerror(APLOG_MARK, APLOG_ERR, 1281 0, r, APLOGNO(00572) "need AuthName: %s", r->uri); 1282 return HTTP_INTERNAL_SERVER_ERROR; 1283 } 1284 1285 if (!auth_line) { 1286 ap_note_auth_failure(r); 1287 return HTTP_UNAUTHORIZED; 1288 } 1289 1290 if (strcasecmp(ap_getword(r->pool, &auth_line, ' '), "Basic")) { 1291 /* Client tried to authenticate using wrong auth scheme */ 1292 ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r, APLOGNO(00573) 1293 "client used wrong authentication scheme: %s", r->uri); 1294 ap_note_auth_failure(r); 1295 return HTTP_UNAUTHORIZED; 1296 } 1297 1298 while (*auth_line == ' ' || *auth_line == '\t') { 1299 auth_line++; 1300 } 1301 1302 t = ap_pbase64decode(r->pool, auth_line); 1303 r->user = ap_getword_nulls (r->pool, &t, ':'); 1304 r->ap_auth_type = "Basic"; 1305 1306 *pw = t; 1307 1308 return OK; 1309} 1310 1311struct content_length_ctx { 1312 int data_sent; /* true if the C-L filter has already sent at 1313 * least one bucket on to the next output filter 1314 * for this request 1315 */ 1316 apr_bucket_brigade *tmpbb; 1317}; 1318 1319/* This filter computes the content length, but it also computes the number 1320 * of bytes sent to the client. This means that this filter will always run 1321 * through all of the buckets in all brigades 1322 */ 1323AP_CORE_DECLARE_NONSTD(apr_status_t) ap_content_length_filter( 1324 ap_filter_t *f, 1325 apr_bucket_brigade *b) 1326{ 1327 request_rec *r = f->r; 1328 struct content_length_ctx *ctx; 1329 apr_bucket *e; 1330 int eos = 0; 1331 apr_read_type_e eblock = APR_NONBLOCK_READ; 1332 1333 ctx = f->ctx; 1334 if (!ctx) { 1335 f->ctx = ctx = apr_palloc(r->pool, sizeof(*ctx)); 1336 ctx->data_sent = 0; 1337 ctx->tmpbb = apr_brigade_create(r->pool, r->connection->bucket_alloc); 1338 } 1339 1340 /* Loop through this set of buckets to compute their length 1341 */ 1342 e = APR_BRIGADE_FIRST(b); 1343 while (e != APR_BRIGADE_SENTINEL(b)) { 1344 if (APR_BUCKET_IS_EOS(e)) { 1345 eos = 1; 1346 break; 1347 } 1348 if (e->length == (apr_size_t)-1) { 1349 apr_size_t len; 1350 const char *ignored; 1351 apr_status_t rv; 1352 1353 /* This is probably a pipe bucket. Send everything 1354 * prior to this, and then read the data for this bucket. 1355 */ 1356 rv = apr_bucket_read(e, &ignored, &len, eblock); 1357 if (rv == APR_SUCCESS) { 1358 /* Attempt a nonblocking read next time through */ 1359 eblock = APR_NONBLOCK_READ; 1360 r->bytes_sent += len; 1361 } 1362 else if (APR_STATUS_IS_EAGAIN(rv)) { 1363 /* Output everything prior to this bucket, and then 1364 * do a blocking read on the next batch. 1365 */ 1366 if (e != APR_BRIGADE_FIRST(b)) { 1367 apr_bucket *flush; 1368 apr_brigade_split_ex(b, e, ctx->tmpbb); 1369 flush = apr_bucket_flush_create(r->connection->bucket_alloc); 1370 1371 APR_BRIGADE_INSERT_TAIL(b, flush); 1372 rv = ap_pass_brigade(f->next, b); 1373 if (rv != APR_SUCCESS || f->c->aborted) { 1374 return rv; 1375 } 1376 apr_brigade_cleanup(b); 1377 APR_BRIGADE_CONCAT(b, ctx->tmpbb); 1378 e = APR_BRIGADE_FIRST(b); 1379 1380 ctx->data_sent = 1; 1381 } 1382 eblock = APR_BLOCK_READ; 1383 continue; 1384 } 1385 else { 1386 ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(00574) 1387 "ap_content_length_filter: " 1388 "apr_bucket_read() failed"); 1389 return rv; 1390 } 1391 } 1392 else { 1393 r->bytes_sent += e->length; 1394 } 1395 e = APR_BUCKET_NEXT(e); 1396 } 1397 1398 /* If we've now seen the entire response and it's otherwise 1399 * okay to set the C-L in the response header, then do so now. 1400 * 1401 * We can only set a C-L in the response header if we haven't already 1402 * sent any buckets on to the next output filter for this request. 1403 */ 1404 if (ctx->data_sent == 0 && eos && 1405 /* don't whack the C-L if it has already been set for a HEAD 1406 * by something like proxy. the brigade only has an EOS bucket 1407 * in this case, making r->bytes_sent zero. 1408 * 1409 * if r->bytes_sent > 0 we have a (temporary) body whose length may 1410 * have been changed by a filter. the C-L header might not have been 1411 * updated so we do it here. long term it would be cleaner to have 1412 * such filters update or remove the C-L header, and just use it 1413 * if present. 1414 */ 1415 !(r->header_only && r->bytes_sent == 0 && 1416 apr_table_get(r->headers_out, "Content-Length"))) { 1417 ap_set_content_length(r, r->bytes_sent); 1418 } 1419 1420 ctx->data_sent = 1; 1421 return ap_pass_brigade(f->next, b); 1422} 1423 1424/* 1425 * Send the body of a response to the client. 1426 */ 1427AP_DECLARE(apr_status_t) ap_send_fd(apr_file_t *fd, request_rec *r, 1428 apr_off_t offset, apr_size_t len, 1429 apr_size_t *nbytes) 1430{ 1431 conn_rec *c = r->connection; 1432 apr_bucket_brigade *bb = NULL; 1433 apr_status_t rv; 1434 1435 bb = apr_brigade_create(r->pool, c->bucket_alloc); 1436 1437 apr_brigade_insert_file(bb, fd, offset, len, r->pool); 1438 1439 rv = ap_pass_brigade(r->output_filters, bb); 1440 if (rv != APR_SUCCESS) { 1441 *nbytes = 0; /* no way to tell how many were actually sent */ 1442 } 1443 else { 1444 *nbytes = len; 1445 } 1446 1447 return rv; 1448} 1449 1450#if APR_HAS_MMAP 1451/* send data from an in-memory buffer */ 1452AP_DECLARE(apr_size_t) ap_send_mmap(apr_mmap_t *mm, 1453 request_rec *r, 1454 apr_size_t offset, 1455 apr_size_t length) 1456{ 1457 conn_rec *c = r->connection; 1458 apr_bucket_brigade *bb = NULL; 1459 apr_bucket *b; 1460 1461 bb = apr_brigade_create(r->pool, c->bucket_alloc); 1462 b = apr_bucket_mmap_create(mm, offset, length, c->bucket_alloc); 1463 APR_BRIGADE_INSERT_TAIL(bb, b); 1464 ap_pass_brigade(r->output_filters, bb); 1465 1466 return mm->size; /* XXX - change API to report apr_status_t? */ 1467} 1468#endif /* APR_HAS_MMAP */ 1469 1470typedef struct { 1471 apr_bucket_brigade *bb; 1472 apr_bucket_brigade *tmpbb; 1473} old_write_filter_ctx; 1474 1475AP_CORE_DECLARE_NONSTD(apr_status_t) ap_old_write_filter( 1476 ap_filter_t *f, apr_bucket_brigade *bb) 1477{ 1478 old_write_filter_ctx *ctx = f->ctx; 1479 1480 AP_DEBUG_ASSERT(ctx); 1481 1482 if (ctx->bb != NULL) { 1483 /* whatever is coming down the pipe (we don't care), we 1484 * can simply insert our buffered data at the front and 1485 * pass the whole bundle down the chain. 1486 */ 1487 APR_BRIGADE_PREPEND(bb, ctx->bb); 1488 } 1489 1490 return ap_pass_brigade(f->next, bb); 1491} 1492 1493static ap_filter_t *insert_old_write_filter(request_rec *r) 1494{ 1495 ap_filter_t *f; 1496 old_write_filter_ctx *ctx; 1497 1498 /* future optimization: record some flags in the request_rec to 1499 * say whether we've added our filter, and whether it is first. 1500 */ 1501 1502 /* this will typically exit on the first test */ 1503 for (f = r->output_filters; f != NULL; f = f->next) { 1504 if (ap_old_write_func == f->frec) 1505 break; 1506 } 1507 1508 if (f == NULL) { 1509 /* our filter hasn't been added yet */ 1510 ctx = apr_pcalloc(r->pool, sizeof(*ctx)); 1511 ctx->tmpbb = apr_brigade_create(r->pool, r->connection->bucket_alloc); 1512 1513 ap_add_output_filter("OLD_WRITE", ctx, r, r->connection); 1514 f = r->output_filters; 1515 } 1516 1517 return f; 1518} 1519 1520static apr_status_t buffer_output(request_rec *r, 1521 const char *str, apr_size_t len) 1522{ 1523 conn_rec *c = r->connection; 1524 ap_filter_t *f; 1525 old_write_filter_ctx *ctx; 1526 1527 if (len == 0) 1528 return APR_SUCCESS; 1529 1530 f = insert_old_write_filter(r); 1531 ctx = f->ctx; 1532 1533 /* if the first filter is not our buffering filter, then we have to 1534 * deliver the content through the normal filter chain 1535 */ 1536 if (f != r->output_filters) { 1537 apr_status_t rv; 1538 apr_bucket *b = apr_bucket_transient_create(str, len, c->bucket_alloc); 1539 APR_BRIGADE_INSERT_TAIL(ctx->tmpbb, b); 1540 1541 rv = ap_pass_brigade(r->output_filters, ctx->tmpbb); 1542 apr_brigade_cleanup(ctx->tmpbb); 1543 return rv; 1544 } 1545 1546 if (ctx->bb == NULL) { 1547 ctx->bb = apr_brigade_create(r->pool, c->bucket_alloc); 1548 } 1549 1550 return ap_fwrite(f->next, ctx->bb, str, len); 1551} 1552 1553AP_DECLARE(int) ap_rputc(int c, request_rec *r) 1554{ 1555 char c2 = (char)c; 1556 1557 if (r->connection->aborted) { 1558 return -1; 1559 } 1560 1561 if (buffer_output(r, &c2, 1) != APR_SUCCESS) 1562 return -1; 1563 1564 return c; 1565} 1566 1567AP_DECLARE(int) ap_rwrite(const void *buf, int nbyte, request_rec *r) 1568{ 1569 if (r->connection->aborted) 1570 return -1; 1571 1572 if (buffer_output(r, buf, nbyte) != APR_SUCCESS) 1573 return -1; 1574 1575 return nbyte; 1576} 1577 1578struct ap_vrprintf_data { 1579 apr_vformatter_buff_t vbuff; 1580 request_rec *r; 1581 char *buff; 1582}; 1583 1584/* Flush callback for apr_vformatter; returns -1 on error. */ 1585static int r_flush(apr_vformatter_buff_t *buff) 1586{ 1587 /* callback function passed to ap_vformatter to be called when 1588 * vformatter needs to write into buff and buff.curpos > buff.endpos */ 1589 1590 /* ap_vrprintf_data passed as a apr_vformatter_buff_t, which is then 1591 * "downcast" to an ap_vrprintf_data */ 1592 struct ap_vrprintf_data *vd = (struct ap_vrprintf_data*)buff; 1593 1594 if (vd->r->connection->aborted) 1595 return -1; 1596 1597 /* r_flush is called when vbuff is completely full */ 1598 if (buffer_output(vd->r, vd->buff, AP_IOBUFSIZE)) { 1599 return -1; 1600 } 1601 1602 /* reset the buffer position */ 1603 vd->vbuff.curpos = vd->buff; 1604 vd->vbuff.endpos = vd->buff + AP_IOBUFSIZE; 1605 1606 return 0; 1607} 1608 1609AP_DECLARE(int) ap_vrprintf(request_rec *r, const char *fmt, va_list va) 1610{ 1611 apr_size_t written; 1612 struct ap_vrprintf_data vd; 1613 char vrprintf_buf[AP_IOBUFSIZE]; 1614 1615 vd.vbuff.curpos = vrprintf_buf; 1616 vd.vbuff.endpos = vrprintf_buf + AP_IOBUFSIZE; 1617 vd.r = r; 1618 vd.buff = vrprintf_buf; 1619 1620 if (r->connection->aborted) 1621 return -1; 1622 1623 written = apr_vformatter(r_flush, &vd.vbuff, fmt, va); 1624 1625 if (written != -1) { 1626 int n = vd.vbuff.curpos - vrprintf_buf; 1627 1628 /* last call to buffer_output, to finish clearing the buffer */ 1629 if (buffer_output(r, vrprintf_buf,n) != APR_SUCCESS) 1630 return -1; 1631 1632 written += n; 1633 } 1634 1635 return written; 1636} 1637 1638AP_DECLARE_NONSTD(int) ap_rprintf(request_rec *r, const char *fmt, ...) 1639{ 1640 va_list va; 1641 int n; 1642 1643 if (r->connection->aborted) 1644 return -1; 1645 1646 va_start(va, fmt); 1647 n = ap_vrprintf(r, fmt, va); 1648 va_end(va); 1649 1650 return n; 1651} 1652 1653AP_DECLARE_NONSTD(int) ap_rvputs(request_rec *r, ...) 1654{ 1655 va_list va; 1656 const char *s; 1657 apr_size_t len; 1658 apr_size_t written = 0; 1659 1660 if (r->connection->aborted) 1661 return -1; 1662 1663 /* ### TODO: if the total output is large, put all the strings 1664 * ### into a single brigade, rather than flushing each time we 1665 * ### fill the buffer 1666 */ 1667 va_start(va, r); 1668 while (1) { 1669 s = va_arg(va, const char *); 1670 if (s == NULL) 1671 break; 1672 1673 len = strlen(s); 1674 if (buffer_output(r, s, len) != APR_SUCCESS) { 1675 return -1; 1676 } 1677 1678 written += len; 1679 } 1680 va_end(va); 1681 1682 return written; 1683} 1684 1685AP_DECLARE(int) ap_rflush(request_rec *r) 1686{ 1687 conn_rec *c = r->connection; 1688 apr_bucket *b; 1689 ap_filter_t *f; 1690 old_write_filter_ctx *ctx; 1691 apr_status_t rv; 1692 1693 f = insert_old_write_filter(r); 1694 ctx = f->ctx; 1695 1696 b = apr_bucket_flush_create(c->bucket_alloc); 1697 APR_BRIGADE_INSERT_TAIL(ctx->tmpbb, b); 1698 1699 rv = ap_pass_brigade(r->output_filters, ctx->tmpbb); 1700 apr_brigade_cleanup(ctx->tmpbb); 1701 if (rv != APR_SUCCESS) 1702 return -1; 1703 1704 return 0; 1705} 1706 1707/* 1708 * This function sets the Last-Modified output header field to the value 1709 * of the mtime field in the request structure - rationalized to keep it from 1710 * being in the future. 1711 */ 1712AP_DECLARE(void) ap_set_last_modified(request_rec *r) 1713{ 1714 if (!r->assbackwards) { 1715 apr_time_t mod_time = ap_rationalize_mtime(r, r->mtime); 1716 char *datestr = apr_palloc(r->pool, APR_RFC822_DATE_LEN); 1717 1718 apr_rfc822_date(datestr, mod_time); 1719 apr_table_setn(r->headers_out, "Last-Modified", datestr); 1720 } 1721} 1722 1723typedef struct hdr_ptr { 1724 ap_filter_t *f; 1725 apr_bucket_brigade *bb; 1726} hdr_ptr; 1727static int send_header(void *data, const char *key, const char *val) 1728{ 1729 ap_fputstrs(((hdr_ptr*)data)->f, ((hdr_ptr*)data)->bb, 1730 key, ": ", val, CRLF, NULL); 1731 return 1; 1732} 1733AP_DECLARE(void) ap_send_interim_response(request_rec *r, int send_headers) 1734{ 1735 hdr_ptr x; 1736 char *status_line = NULL; 1737 request_rec *rr; 1738 1739 if (r->proto_num < HTTP_VERSION(1,1)) { 1740 /* don't send interim response to HTTP/1.0 Client */ 1741 return; 1742 } 1743 if (!ap_is_HTTP_INFO(r->status)) { 1744 ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(00575) 1745 "Status is %d - not sending interim response", r->status); 1746 return; 1747 } 1748 if ((r->status == HTTP_CONTINUE) && !r->expecting_100) { 1749 /* 1750 * Don't send 100-Continue when there was no Expect: 100-continue 1751 * in the request headers. For origin servers this is a SHOULD NOT 1752 * for proxies it is a MUST NOT according to RFC 2616 8.2.3 1753 */ 1754 return; 1755 } 1756 1757 /* if we send an interim response, we're no longer in a state of 1758 * expecting one. Also, this could feasibly be in a subrequest, 1759 * so we need to propagate the fact that we responded. 1760 */ 1761 for (rr = r; rr != NULL; rr = rr->main) { 1762 rr->expecting_100 = 0; 1763 } 1764 1765 status_line = apr_pstrcat(r->pool, AP_SERVER_PROTOCOL, " ", r->status_line, CRLF, NULL); 1766 ap_xlate_proto_to_ascii(status_line, strlen(status_line)); 1767 1768 x.f = r->connection->output_filters; 1769 x.bb = apr_brigade_create(r->pool, r->connection->bucket_alloc); 1770 1771 ap_fputs(x.f, x.bb, status_line); 1772 if (send_headers) { 1773 apr_table_do(send_header, &x, r->headers_out, NULL); 1774 apr_table_clear(r->headers_out); 1775 } 1776 ap_fputs(x.f, x.bb, CRLF_ASCII); 1777 ap_fflush(x.f, x.bb); 1778 apr_brigade_destroy(x.bb); 1779} 1780 1781 1782AP_IMPLEMENT_HOOK_VOID(pre_read_request, 1783 (request_rec *r, conn_rec *c), 1784 (r, c)) 1785AP_IMPLEMENT_HOOK_RUN_ALL(int,post_read_request, 1786 (request_rec *r), (r), OK, DECLINED) 1787AP_IMPLEMENT_HOOK_RUN_ALL(int,log_transaction, 1788 (request_rec *r), (r), OK, DECLINED) 1789AP_IMPLEMENT_HOOK_RUN_FIRST(const char *,http_scheme, 1790 (const request_rec *r), (r), NULL) 1791AP_IMPLEMENT_HOOK_RUN_FIRST(unsigned short,default_port, 1792 (const request_rec *r), (r), 0) 1793AP_IMPLEMENT_HOOK_RUN_FIRST(int, note_auth_failure, 1794 (request_rec *r, const char *auth_type), 1795 (r, auth_type), DECLINED) 1796