{{ message }}
Repository navigation
Expand file tree
/
Copy pathh1.c
More file actions
1430 lines (1248 loc) · 44.7 KB
/
Copy pathh1.c
File metadata and controls
1430 lines (1248 loc) · 44.7 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
/*
* HTTP/1 protocol analyzer
*
* Copyright 2000-2017 Willy Tarreau <w@1wt.eu>
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
* as published by the Free Software Foundation; either version
* 2 of the License, or (at your option) any later version.
*
*/
#include <ctype.h>
#include <import/sha1.h>
#include <haproxy/api.h>
#include <haproxy/base64.h>
#include <haproxy/cfgparse.h>
#include <haproxy/h1.h>
#include <haproxy/http-hdr.h>
#include <haproxy/tools.h>
/* by default, RFC9112#6.1 applies, t-e combined with c-l represents a risk of
* smuggling if it crosses another 1.0 agent so we must close at the end of the
* transaction. But it may cause difficulties to some very old broken devices.
*/
int h1_do_not_close_on_insecure_t_e = 0;
/* Parse the Transfer-Encoding: header field of an HTTP/1 request, looking for
* "chunked" encoding to perform some checks (it must be the last encoding for
* the request and must not be performed twice for any message). The
* H1_MF_TE_CHUNKED is set if a valid "chunked" encoding is found. The
* H1_MF_TE_OTHER flag is set if any other encoding is found. The H1_MF_XFER_ENC
* flag is always set. The H1_MF_CHNK is set when "chunked" encoding is the last
* one. Note that transfer codings are case-insensitive (cf RFC7230#4). This
* function returns -2 for a fatal error, -1 for an error that may be hiidden by
* config, 0 if the whole header can be dropped (not used yet), or >0 if the
* value can be indexed.
*/
int h1_parse_xfer_enc_header(struct h1m *h1m, struct ist value)
{
char *e, *n;
struct ist word;
int ret = 1;
/* Reject empty header */
if (istptr(value) == istend(value)) {
ret = -1;
goto end;
}
h1m->flags |= H1_MF_XFER_ENC;
word.ptr = value.ptr - 1; // -1 for next loop's pre-increment
e = istend(value);
while (++word.ptr < e) {
/* skip leading delimiter and blanks */
if (HTTP_IS_LWS(*word.ptr))
continue;
n = http_find_hdr_value_end(word.ptr, e); // next comma or end of line
/* a comma at the end means the last value is empty */
if (n+1 == e)
ret = -1;
word.len = n - word.ptr;
/* trim trailing blanks */
while (word.len && HTTP_IS_LWS(word.ptr[word.len-1]))
word.len--;
h1m->flags &= ~H1_MF_CHNK;
/* empty values are forbidden */
if (!word.len)
ret = -1;
else if (isteqi(word, ist("chunked"))) {
if (h1m->flags & H1_MF_TE_CHUNKED) {
/* cf RFC7230#3.3.1 : A sender MUST NOT apply
* chunked more than once to a message body
* (i.e., chunking an already chunked message is
* not allowed)
*/
ret = -1;
}
h1m->flags |= (H1_MF_TE_CHUNKED|H1_MF_CHNK);
}
else {
if ((h1m->flags & (H1_MF_RESP|H1_MF_TE_CHUNKED)) == H1_MF_TE_CHUNKED) {
/* cf RFC7230#3.3.1 : If any transfer coding
* other than chunked is applied to a request
* payload body, the sender MUST apply chunked
* as the final transfer coding to ensure that
* the message is properly framed.
*/
ret = -2;
goto end;
}
h1m->flags |= H1_MF_TE_OTHER;
}
word.ptr = n;
}
end:
return ret;
}
/* Validate the authority and the host header value for CONNECT method. If there
* is hast header, its value is normalized. 0 is returned on success, -1 if the
* authority is invalid and -2 if the host is invalid.
*/
static int h1_validate_connect_authority(struct ist scheme, struct ist authority, struct ist *host_hdr)
{
struct ist uri_host, uri_port, host, host_port;
if (isttest(scheme) || !isttest(authority))
goto invalid_authority;
uri_host = authority;
uri_port = http_get_host_port(authority);
if (!istlen(uri_port))
goto invalid_authority;
uri_host.len -= (istlen(uri_port) + 1);
if (!istlen(uri_host))
goto invalid_authority;
if (!host_hdr || !isttest(*host_hdr))
goto end;
/* Get the port of the host header value, if any */
host = *host_hdr;
host_port = http_get_host_port(*host_hdr);
if (isttest(host_port))
host.len -= (istlen(host_port) + 1);
if (istlen(host_port)) {
if (!isteqi(host, uri_host) || !isteq(host_port, uri_port))
goto invalid_host;
if (http_is_default_port(IST_NULL, uri_port))
*host_hdr = host; /* normalize */
}
else {
if (!http_is_default_port(IST_NULL, uri_port) || !isteqi(host, uri_host))
goto invalid_host;
}
end:
return 0;
invalid_authority:
return -1;
invalid_host:
return -2;
}
/* Validate the authority and the host header value for non-CONNECT method, when
* an absolute-URI is detected but when it does not exactly match the host
* value. The idea is to detect default port (http or https). authority and host
* are defined here. 0 is returned on success, -1 if the host is does not match
* the authority.
*/
static int h1_validate_mismatch_authority(struct ist scheme, struct ist authority, struct ist host_hdr)
{
struct ist uri_host, uri_port, host, host_port;
if (!isttest(scheme))
goto mismatch;
uri_host = authority;
uri_port = http_get_host_port(authority);
if (isttest(uri_port))
uri_host.len -= (istlen(uri_port) + 1);
host = host_hdr;
host_port = http_get_host_port(host_hdr);
if (isttest(host_port))
host.len -= (istlen(host_port) + 1);
if (!isttest(uri_port) && !isttest(host_port)) {
/* No port on both: we already know the authority does not match
* the host value
*/
goto mismatch;
}
else if (isttest(uri_port) && !http_is_default_port(scheme, uri_port)) {
/* here there is no port for the host value and the port for the
* authority is not the default one
*/
goto mismatch;
}
else if (isttest(host_port) && !http_is_default_port(scheme, host_port)) {
/* here there is no port for the authority and the port for the
* host value is not the default one
*/
goto mismatch;
}
else {
/* the authority or the host value contain a default port and
* there is no port on the other value
*/
if (!isteqi(uri_host, host))
goto mismatch;
}
return 0;
mismatch:
return -1;
}
/* Parse the Connection: header of an HTTP/1 request, looking for "close",
* "keep-alive", and "upgrade" values, and updating h1m->flags according to
* what was found there. Note that flags are only added, not removed, so the
* function is safe for being called multiple times if multiple occurrences
* are found. If the flag H1_MF_CLEAN_CONN_HDR, the header value is cleaned
* up from "keep-alive" and "close" values. To do so, the header value is
* rewritten in place and its length is updated. The bytes freed at the end of
* the original value are replaced with spaces so that parsing the same area
* again (e.g. when the parser restarts on an incomplete message) gives the
* same value. However the removed values are not there anymore, so the caller
* must preserve the H1_MF_CONN_CLO and H1_MF_CONN_KAL flags across such
* restarts.
*/
void h1_parse_connection_header(struct h1m *h1m, struct ist *value)
{
char *e, *n, *p;
struct ist word;
word.ptr = value->ptr - 1; // -1 for next loop's pre-increment
p = value->ptr;
e = value->ptr + value->len;
if (h1m->flags & H1_MF_CLEAN_CONN_HDR)
value->len = 0;
while (++word.ptr < e) {
/* skip leading delimiter and blanks */
if (HTTP_IS_LWS(*word.ptr))
continue;
n = http_find_hdr_value_end(word.ptr, e); // next comma or end of line
word.len = n - word.ptr;
/* trim trailing blanks */
while (word.len && HTTP_IS_LWS(word.ptr[word.len-1]))
word.len--;
if (isteqi(word, ist("keep-alive"))) {
h1m->flags |= H1_MF_CONN_KAL;
if (h1m->flags & H1_MF_CLEAN_CONN_HDR)
goto skip_val;
}
else if (isteqi(word, ist("close"))) {
h1m->flags |= H1_MF_CONN_CLO;
if (h1m->flags & H1_MF_CLEAN_CONN_HDR)
goto skip_val;
}
else if (isteqi(word, ist("upgrade")))
h1m->flags |= H1_MF_CONN_UPG;
if (h1m->flags & H1_MF_CLEAN_CONN_HDR) {
if (value->ptr + value->len == p) {
/* no rewrite done till now */
value->len = n - value->ptr;
}
else {
if (value->len)
value->ptr[value->len++] = ',';
istcat(value, word, e - value->ptr);
}
}
skip_val:
word.ptr = p = n;
}
/* blank the freed area to make the operation idempotent */
if ((h1m->flags & H1_MF_CLEAN_CONN_HDR) && value->ptr + value->len < e)
memset(value->ptr + value->len, ' ', e - (value->ptr + value->len));
}
/* Parse the Upgrade: header of an HTTP/1 request.
* If "websocket" is found, set H1_MF_UPG_WEBSOCKET flag
* If "h2c" or "h2" found and the flag H1_MF_CLEAN_CONN_HDR is set, the value is
* skipped. The header value is rewritten in place and the bytes freed at the
* end of the original value are replaced with spaces so that parsing the same
* area again gives the same value. Without H1_MF_CLEAN_CONN_HDR, the value is
* never modified.
*/
void h1_parse_upgrade_header(struct h1m *h1m, struct ist *value)
{
char *e, *n, *p;
struct ist word;
word.ptr = value->ptr - 1; // -1 for next loop's pre-increment
p = value->ptr;
e = value->ptr + value->len;
value->len = 0;
while (++word.ptr < e) {
/* skip leading delimiter and blanks */
if (HTTP_IS_LWS(*word.ptr))
continue;
n = http_find_hdr_value_end(word.ptr, e); // next comma or end of line
word.len = n - word.ptr;
/* trim trailing blanks */
while (word.len && HTTP_IS_LWS(word.ptr[word.len-1]))
word.len--;
if (isteqi(word, ist("websocket")))
h1m->flags |= H1_MF_UPG_WEBSOCKET;
else if ((h1m->flags & H1_MF_CLEAN_CONN_HDR) &&
(isteqi(word, ist("h2c")) || isteqi(word, ist("h2"))))
goto skip_val;
if (value->ptr + value->len == p) {
/* no rewrite done till now */
value->len = n - value->ptr;
}
else {
if (value->len)
value->ptr[value->len++] = ',';
istcat(value, word, e - value->ptr);
}
skip_val:
word.ptr = p = n;
}
/* blank the freed area to make the operation idempotent */
if ((h1m->flags & H1_MF_CLEAN_CONN_HDR) && value->ptr + value->len < e)
memset(value->ptr + value->len, ' ', e - (value->ptr + value->len));
if (istlen(*value))
h1m->flags |= H1_MF_UPG_HDR;
}
/* Macros used in the HTTP/1 parser, to check for the expected presence of
* certain bytes (ef: LF) or to skip to next byte and yield in case of failure.
*/
/* Expects to find an LF at <ptr>. If not, set <state> to <where> and jump to
* <bad>.
*/
#define EXPECT_LF_HERE(ptr, bad, state, where) \
do { \
if (unlikely(*(ptr) != '\n')) { \
state = (where); \
goto bad; \
} \
} while (0)
/* Increments pointer <ptr>, continues to label <more> if it's still below
* pointer <end>, or goes to <stop> and sets <state> to <where> if the end
* of buffer was reached.
*/
#define EAT_AND_JUMP_OR_RETURN(ptr, end, more, stop, state, where) \
do { \
if (likely(++(ptr) < (end))) \
goto more; \
else { \
state = (where); \
goto stop; \
} \
} while (0)
/* This function parses a contiguous HTTP/1 headers block starting at <start>
* and ending before <stop>, at once, and converts it a list of (name,value)
* pairs representing header fields into the array <hdr> of size <hdr_num>,
* whose last entry will have an empty name and an empty value. If <hdr_num> is
* too small to represent the whole message, an error is returned. Some
* protocol elements such as content-length and transfer-encoding will be
* parsed and stored into h1m as well. <hdr> may be null, in which case only
* the parsing state will be updated. This may be used to restart the parsing
* where it stopped for example.
*
* For now it's limited to the response. If the header block is incomplete,
* 0 is returned, waiting to be called again with more data to try it again.
* The caller is responsible for initializing h1m->state to H1_MSG_RPBEFORE,
* and h1m->next to zero on the first call, the parser will do the rest. If
* an incomplete message is seen, the caller only needs to present h1m->state
* and h1m->next again, with an empty header list so that the parser can start
* again. In this case, it will detect that it interrupted a previous session
* and will first look for the end of the message before reparsing it again and
* indexing it at the same time. This ensures that incomplete messages fed 1
* character at a time are never processed entirely more than exactly twice,
* and that there is no need to store all the internal state and pre-parsed
* headers or start line between calls.
*
* A pointer to a start line descriptor may be passed in <slp>, in which case
* the parser will fill it with whatever it found.
*
* The code derived from the main HTTP/1 parser above but was simplified and
* optimized to process responses produced or forwarded by haproxy. The caller
* is responsible for ensuring that the message doesn't wrap, and should ensure
* it is complete to avoid having to retry the operation after a failed
* attempt. The message is not supposed to be invalid, which is why a few
* properties such as the character set used in the header field names are not
* checked. In case of an unparsable response message, a negative value will be
* returned with h1m->err_pos and h1m->err_state matching the location and
* state where the error was met. Leading blank likes are tolerated but not
* recommended. If flag H1_MF_HDRS_ONLY is set in h1m->flags, only headers are
* parsed and the start line is skipped. It is not required to set h1m->state
* nor h1m->next in this case.
*
* This function returns :
* -1 in case of error. In this case, h1m->err_state is filled (if h1m is
* set) with the state the error occurred in and h1m->err_pos with the
* the position relative to <start>
* -2 if the output is full (hdr_num reached). err_state and err_pos also
* indicate where it failed.
* 0 in case of missing data.
* > 0 on success, it then corresponds to the number of bytes read since
* <start> so that the caller can go on with the payload.
*/
int h1_headers_to_hdr_list(char *start, const char *stop,
struct http_hdr *hdr, unsigned int hdr_num,
struct h1m *h1m, union h1_sl *slp)
{
enum h1m_state state;
register char *ptr;
register const char *end;
unsigned int hdr_count;
unsigned int skip; /* number of bytes skipped at the beginning */
unsigned int sol; /* start of line */
unsigned int col; /* position of the colon */
unsigned int eol; /* end of line */
unsigned int sov; /* start of value */
union h1_sl sl;
int skip_update;
int restarting;
int host_idx;
struct ist n, v; /* header name and value during parsing */
skip = 0; // do it only once to keep track of the leading CRLF.
try_again:
hdr_count = sol = col = eol = sov = 0;
sl.st.status = 0;
skip_update = restarting = 0;
host_idx = -1;
if (h1m->flags & H1_MF_HDRS_ONLY) {
state = H1_MSG_HDR_FIRST;
h1m->flags &= (H1_MF_RESTART_MASK|H1_MF_VER_11);
h1m->curr_len = h1m->body_len = h1m->next = 0;
}
else {
state = h1m->state;
if (h1m->state != H1_MSG_RQBEFORE && h1m->state != H1_MSG_RPBEFORE)
restarting = 1;
}
/* When restarting from an interrupted state, the start line elements
* were not set by this call. They are not used in this case but let's
* make sure they never point to random locations (rq and st members
* are at the same places).
*/
sl.rq.m = sl.rq.u = sl.rq.v = ist2(start, 0);
ptr = start + h1m->next;
end = stop;
if (unlikely(ptr >= end))
goto http_msg_ood;
/* don't update output if hdr is NULL or if we're restarting */
if (!hdr || restarting)
skip_update = 1;
switch (state) {
case H1_MSG_RQBEFORE:
http_msg_rqbefore:
if (likely(HTTP_IS_TOKEN(*ptr))) {
/* we have a start of message, we may have skipped some
* heading CRLF. Skip them now.
*/
skip += ptr - start;
start = ptr;
sol = 0;
sl.rq.m.ptr = ptr;
hdr_count = 0;
state = H1_MSG_RQMETH;
goto http_msg_rqmeth;
}
if (unlikely(!HTTP_IS_CRLF(*ptr))) {
state = H1_MSG_RQBEFORE;
goto http_msg_invalid;
}
if (unlikely(*ptr == '\n'))
EAT_AND_JUMP_OR_RETURN(ptr, end, http_msg_rqbefore, http_msg_ood, state, H1_MSG_RQBEFORE);
EAT_AND_JUMP_OR_RETURN(ptr, end, http_msg_rqbefore_cr, http_msg_ood, state, H1_MSG_RQBEFORE_CR);
/* stop here */
case H1_MSG_RQBEFORE_CR:
http_msg_rqbefore_cr:
EXPECT_LF_HERE(ptr, http_msg_invalid, state, H1_MSG_RQBEFORE_CR);
EAT_AND_JUMP_OR_RETURN(ptr, end, http_msg_rqbefore, http_msg_ood, state, H1_MSG_RQBEFORE);
/* stop here */
case H1_MSG_RQMETH:
http_msg_rqmeth:
if (likely(HTTP_IS_TOKEN(*ptr)))
EAT_AND_JUMP_OR_RETURN(ptr, end, http_msg_rqmeth, http_msg_ood, state, H1_MSG_RQMETH);
if (likely(HTTP_IS_SPHT(*ptr))) {
sl.rq.m.len = ptr - sl.rq.m.ptr;
sl.rq.meth = find_http_meth(start, sl.rq.m.len);
EAT_AND_JUMP_OR_RETURN(ptr, end, http_msg_rqmeth_sp, http_msg_ood, state, H1_MSG_RQMETH_SP);
}
if (likely(HTTP_IS_CRLF(*ptr))) {
/* HTTP 0.9 request */
sl.rq.m.len = ptr - sl.rq.m.ptr;
sl.rq.meth = find_http_meth(sl.rq.m.ptr, sl.rq.m.len);
http_msg_req09_uri:
sl.rq.u.ptr = ptr;
http_msg_req09_uri_e:
sl.rq.u.len = ptr - sl.rq.u.ptr;
http_msg_req09_ver:
sl.rq.v = ist2(ptr, 0);
goto http_msg_rqline_eol;
}
state = H1_MSG_RQMETH;
goto http_msg_invalid;
case H1_MSG_RQMETH_SP:
http_msg_rqmeth_sp:
if (likely(!HTTP_IS_LWS(*ptr))) {
sl.rq.u.ptr = ptr;
goto http_msg_rquri;
}
if (likely(HTTP_IS_SPHT(*ptr)))
EAT_AND_JUMP_OR_RETURN(ptr, end, http_msg_rqmeth_sp, http_msg_ood, state, H1_MSG_RQMETH_SP);
/* so it's a CR/LF, meaning an HTTP 0.9 request */
goto http_msg_req09_uri;
case H1_MSG_RQURI:
http_msg_rquri:
#ifdef HA_UNALIGNED_LE
/* speedup: skip bytes not between 0x24 and 0x7e inclusive */
while (ptr <= end - sizeof(int)) {
if (is_char4_outside(*(uint *)ptr, 0x24, 0x7e))
break;
ptr += sizeof(int);
}
#endif
if (ptr >= end) {
state = H1_MSG_RQURI;
goto http_msg_ood;
}
http_msg_rquri2:
if (likely((unsigned char)(*ptr - 33) <= 93)) { /* 33 to 126 included */
if (*ptr == '#') {
if (h1m->err_pos < -1 || /* PR_O2_REQBUG_OK not set */
!(global.acc_hreq_vio & (1U << HTTP_VIO_URL_FRAG))) /* !fragment-in-url */
goto invalid_char;
if (h1m->err_pos == -1) /* PR_O2_REQBUG_OK set: just log */
h1m->err_pos = ptr - start + skip;
}
EAT_AND_JUMP_OR_RETURN(ptr, end, http_msg_rquri2, http_msg_ood, state, H1_MSG_RQURI);
}
if (likely(HTTP_IS_SPHT(*ptr))) {
sl.rq.u.len = ptr - sl.rq.u.ptr;
EAT_AND_JUMP_OR_RETURN(ptr, end, http_msg_rquri_sp, http_msg_ood, state, H1_MSG_RQURI_SP);
}
if (likely((unsigned char)*ptr >= 128)) {
/* non-ASCII chars are forbidden unless option
* accept-unsafe-violations-in-http-request is enabled in the frontend.
* In any case, we capture the faulty char.
*/
if (h1m->err_pos < -1 || !(global.acc_hreq_vio & (1U << HTTP_VIO_URL_NON_ASCII)))
goto invalid_char;
if (h1m->err_pos == -1)
h1m->err_pos = ptr - start + skip;
EAT_AND_JUMP_OR_RETURN(ptr, end, http_msg_rquri, http_msg_ood, state, H1_MSG_RQURI);
}
if (likely(HTTP_IS_CRLF(*ptr))) {
/* so it's a CR/LF, meaning an HTTP 0.9 request */
goto http_msg_req09_uri_e;
}
/* OK forbidden chars, 0..31 or 127 */
invalid_char:
state = H1_MSG_RQURI;
goto http_msg_invalid;
case H1_MSG_RQURI_SP:
http_msg_rquri_sp:
if (likely(!HTTP_IS_LWS(*ptr))) {
sl.rq.v.ptr = ptr;
goto http_msg_rqver;
}
if (likely(HTTP_IS_SPHT(*ptr)))
EAT_AND_JUMP_OR_RETURN(ptr, end, http_msg_rquri_sp, http_msg_ood, state, H1_MSG_RQURI_SP);
/* so it's a CR/LF, meaning an HTTP 0.9 request */
goto http_msg_req09_ver;
case H1_MSG_RQVER:
http_msg_rqver:
if (likely(HTTP_IS_VER_TOKEN(*ptr)))
EAT_AND_JUMP_OR_RETURN(ptr, end, http_msg_rqver, http_msg_ood, state, H1_MSG_RQVER);
if (likely(HTTP_IS_CRLF(*ptr))) {
sl.rq.v.len = ptr - sl.rq.v.ptr;
http_msg_rqline_eol:
/* We have seen the end of line. Note that we do not
* necessarily have the \n yet, but at least we know that we
* have EITHER \r OR \n, otherwise the request would not be
* complete. We can then record the request length and return
* to the caller which will be able to register it.
*/
if (likely(!skip_update)) {
if ((sl.rq.v.len == 8) &&
(*(sl.rq.v.ptr + 5) > '1' ||
(*(sl.rq.v.ptr + 5) == '1' && *(sl.rq.v.ptr + 7) >= '1')))
h1m->flags |= H1_MF_VER_11;
if (unlikely(hdr_count >= hdr_num)) {
state = H1_MSG_RQVER;
goto http_output_full;
}
if (!(h1m->flags & H1_MF_NO_PHDR))
http_set_hdr(&hdr[hdr_count++], ist(":method"), sl.rq.m);
if (unlikely(hdr_count >= hdr_num)) {
state = H1_MSG_RQVER;
goto http_output_full;
}
if (!(h1m->flags & H1_MF_NO_PHDR))
http_set_hdr(&hdr[hdr_count++], ist(":path"), sl.rq.u);
}
sol = ptr - start;
if (likely(*ptr == '\r'))
EAT_AND_JUMP_OR_RETURN(ptr, end, http_msg_rqline_end, http_msg_ood, state, H1_MSG_RQLINE_END);
goto http_msg_rqline_end;
}
/* neither an HTTP_VER token nor a CRLF */
state = H1_MSG_RQVER;
goto http_msg_invalid;
case H1_MSG_RQLINE_END:
http_msg_rqline_end:
/* check for HTTP/0.9 request : no version information
* available. sol must point to the first of CR or LF. However
* since we don't save these elements between calls, if we come
* here from a restart, we don't necessarily know. Thus in this
* case we simply start over.
*/
if (restarting)
goto restart;
if (unlikely(sl.rq.v.len == 0))
goto http_msg_last_lf;
EXPECT_LF_HERE(ptr, http_msg_invalid, state, H1_MSG_RQLINE_END);
EAT_AND_JUMP_OR_RETURN(ptr, end, http_msg_hdr_first, http_msg_ood, state, H1_MSG_HDR_FIRST);
/* stop here */
/*
* Common states below
*/
case H1_MSG_RPBEFORE:
http_msg_rpbefore:
if (likely(HTTP_IS_TOKEN(*ptr))) {
/* we have a start of message, we may have skipped some
* heading CRLF. Skip them now.
*/
skip += ptr - start;
start = ptr;
sol = 0;
sl.st.v.ptr = ptr;
hdr_count = 0;
state = H1_MSG_RPVER;
goto http_msg_rpver;
}
if (unlikely(!HTTP_IS_CRLF(*ptr))) {
state = H1_MSG_RPBEFORE;
goto http_msg_invalid;
}
if (unlikely(*ptr == '\n'))
EAT_AND_JUMP_OR_RETURN(ptr, end, http_msg_rpbefore, http_msg_ood, state, H1_MSG_RPBEFORE);
EAT_AND_JUMP_OR_RETURN(ptr, end, http_msg_rpbefore_cr, http_msg_ood, state, H1_MSG_RPBEFORE_CR);
/* stop here */
case H1_MSG_RPBEFORE_CR:
http_msg_rpbefore_cr:
EXPECT_LF_HERE(ptr, http_msg_invalid, state, H1_MSG_RPBEFORE_CR);
EAT_AND_JUMP_OR_RETURN(ptr, end, http_msg_rpbefore, http_msg_ood, state, H1_MSG_RPBEFORE);
/* stop here */
case H1_MSG_RPVER:
http_msg_rpver:
if (likely(HTTP_IS_VER_TOKEN(*ptr)))
EAT_AND_JUMP_OR_RETURN(ptr, end, http_msg_rpver, http_msg_ood, state, H1_MSG_RPVER);
if (likely(HTTP_IS_SPHT(*ptr))) {
sl.st.v.len = ptr - sl.st.v.ptr;
if (!restarting && (sl.st.v.len == 8) &&
(*(sl.st.v.ptr + 5) > '1' ||
(*(sl.st.v.ptr + 5) == '1' && *(sl.st.v.ptr + 7) >= '1')))
h1m->flags |= H1_MF_VER_11;
EAT_AND_JUMP_OR_RETURN(ptr, end, http_msg_rpver_sp, http_msg_ood, state, H1_MSG_RPVER_SP);
}
state = H1_MSG_RPVER;
goto http_msg_invalid;
case H1_MSG_RPVER_SP:
http_msg_rpver_sp:
if (likely(!HTTP_IS_LWS(*ptr))) {
sl.st.status = 0;
sl.st.c.ptr = ptr;
goto http_msg_rpcode;
}
if (likely(HTTP_IS_SPHT(*ptr)))
EAT_AND_JUMP_OR_RETURN(ptr, end, http_msg_rpver_sp, http_msg_ood, state, H1_MSG_RPVER_SP);
/* so it's a CR/LF, this is invalid */
state = H1_MSG_RPVER_SP;
goto http_msg_invalid;
case H1_MSG_RPCODE:
http_msg_rpcode:
if (likely(HTTP_IS_DIGIT(*ptr))) {
if (!restarting && ptr - sl.st.c.ptr >= 3) {
/* more than 3 digits (checked again after a restart) */
if (sl.st.status >= ((uint16_t)~0 - 9) / 10 || h1m->err_pos < -1 ||
!(global.acc_hres_vio & (1U << HTTP_VIO_STATUS_LONG))) {
/* strict checks or risk of overflow */
state = H1_MSG_RPCODE;
goto http_msg_invalid;
} else if (h1m->err_pos == -1) {
/* only capture the error pointer */
h1m->err_pos = ptr - start + skip;
}
}
sl.st.status = sl.st.status * 10 + *ptr - '0';
EAT_AND_JUMP_OR_RETURN(ptr, end, http_msg_rpcode, http_msg_ood, state, H1_MSG_RPCODE);
}
if (unlikely(!HTTP_IS_LWS(*ptr))) {
state = H1_MSG_RPCODE;
goto http_msg_invalid;
}
if (likely(HTTP_IS_SPHT(*ptr))) {
sl.st.c.len = ptr - sl.st.c.ptr;
if (sl.st.c.len < 3) {
/* less than 3 digits */
if (h1m->err_pos < -1 || !(global.acc_hres_vio & (1U << HTTP_VIO_STATUS_SHORT))) {
state = H1_MSG_RPCODE;
goto http_msg_invalid;
} else if (h1m->err_pos == -1) {
/* only capture the error pointer */
h1m->err_pos = ptr - start + skip;
}
}
EAT_AND_JUMP_OR_RETURN(ptr, end, http_msg_rpcode_sp, http_msg_ood, state, H1_MSG_RPCODE_SP);
}
/* so it's a CR/LF, so there is no reason phrase */
sl.st.c.len = ptr - sl.st.c.ptr;
http_msg_rsp_reason:
sl.st.r = ist2(ptr, 0);
goto http_msg_rpline_eol;
case H1_MSG_RPCODE_SP:
http_msg_rpcode_sp:
if (likely(!HTTP_IS_LWS(*ptr))) {
sl.st.r.ptr = ptr;
goto http_msg_rpreason;
}
if (likely(HTTP_IS_SPHT(*ptr)))
EAT_AND_JUMP_OR_RETURN(ptr, end, http_msg_rpcode_sp, http_msg_ood, state, H1_MSG_RPCODE_SP);
/* so it's a CR/LF, so there is no reason phrase */
goto http_msg_rsp_reason;
case H1_MSG_RPREASON:
http_msg_rpreason:
if (likely(!HTTP_IS_CRLF(*ptr)))
EAT_AND_JUMP_OR_RETURN(ptr, end, http_msg_rpreason, http_msg_ood, state, H1_MSG_RPREASON);
sl.st.r.len = ptr - sl.st.r.ptr;
http_msg_rpline_eol:
/* We have seen the end of line. Note that we do not
* necessarily have the \n yet, but at least we know that we
* have EITHER \r OR \n, otherwise the response would not be
* complete. We can then record the response length and return
* to the caller which will be able to register it.
*/
if (likely(!skip_update)) {
if (unlikely(hdr_count >= hdr_num)) {
state = H1_MSG_RPREASON;
goto http_output_full;
}
if (!(h1m->flags & H1_MF_NO_PHDR))
http_set_hdr(&hdr[hdr_count++], ist(":status"), sl.st.c);
}
sol = ptr - start;
if (likely(*ptr == '\r'))
EAT_AND_JUMP_OR_RETURN(ptr, end, http_msg_rpline_end, http_msg_ood, state, H1_MSG_RPLINE_END);
goto http_msg_rpline_end;
case H1_MSG_RPLINE_END:
http_msg_rpline_end:
/* sol must point to the first of CR or LF. */
EXPECT_LF_HERE(ptr, http_msg_invalid, state, H1_MSG_RPLINE_END);
EAT_AND_JUMP_OR_RETURN(ptr, end, http_msg_hdr_first, http_msg_ood, state, H1_MSG_HDR_FIRST);
/* stop here */
case H1_MSG_HDR_FIRST:
http_msg_hdr_first:
sol = ptr - start;
if (likely(!HTTP_IS_CRLF(*ptr))) {
goto http_msg_hdr_name;
}
if (likely(*ptr == '\r'))
EAT_AND_JUMP_OR_RETURN(ptr, end, http_msg_last_lf, http_msg_ood, state, H1_MSG_LAST_LF);
goto http_msg_last_lf;
case H1_MSG_HDR_NAME:
http_msg_hdr_name:
/* assumes sol points to the first char */
if (likely(HTTP_IS_TOKEN(*ptr))) {
if (!skip_update) {
/* turn it to lower case if needed */
if (isupper((unsigned char)*ptr) && h1m->flags & H1_MF_TOLOWER)
*ptr = tolower((unsigned char)*ptr);
}
EAT_AND_JUMP_OR_RETURN(ptr, end, http_msg_hdr_name, http_msg_ood, state, H1_MSG_HDR_NAME);
}
if (likely(*ptr == ':')) {
col = ptr - start;
if (col <= sol) {
state = H1_MSG_HDR_NAME;
goto http_msg_invalid;
}
EAT_AND_JUMP_OR_RETURN(ptr, end, http_msg_hdr_l1_sp, http_msg_ood, state, H1_MSG_HDR_L1_SP);
}
if (likely(h1m->err_pos < -1) || *ptr == '\n' ||
(!(h1m->flags & H1_MF_RESP) && !(global.acc_hreq_vio & (1U << HTTP_VIO_HDR_NAME_NON_TOK))) ||
((h1m->flags & H1_MF_RESP) && !(global.acc_hres_vio & (1U << HTTP_VIO_HDR_NAME_NON_TOK)))) {
state = H1_MSG_HDR_NAME;
goto http_msg_invalid;
}
if (h1m->err_pos == -1) /* capture the error pointer */
h1m->err_pos = ptr - start + skip; /* >= 0 now */
/* and we still accept this non-token character */
EAT_AND_JUMP_OR_RETURN(ptr, end, http_msg_hdr_name, http_msg_ood, state, H1_MSG_HDR_NAME);
case H1_MSG_HDR_L1_SP:
http_msg_hdr_l1_sp:
/* assumes sol points to the first char */
if (likely(HTTP_IS_SPHT(*ptr)))
EAT_AND_JUMP_OR_RETURN(ptr, end, http_msg_hdr_l1_sp, http_msg_ood, state, H1_MSG_HDR_L1_SP);
/* header value can be basically anything except CR/LF */
sov = ptr - start;
if (likely(!HTTP_IS_CRLF(*ptr))) {
goto http_msg_hdr_val;
}
if (likely(*ptr == '\r'))
EAT_AND_JUMP_OR_RETURN(ptr, end, http_msg_hdr_l1_lf, http_msg_ood, state, H1_MSG_HDR_L1_LF);
goto http_msg_hdr_l1_lf;
case H1_MSG_HDR_L1_LF:
http_msg_hdr_l1_lf:
EXPECT_LF_HERE(ptr, http_msg_invalid, state, H1_MSG_HDR_L1_LF);
EAT_AND_JUMP_OR_RETURN(ptr, end, http_msg_hdr_l1_lws, http_msg_ood, state, H1_MSG_HDR_L1_LWS);
case H1_MSG_HDR_L1_LWS:
http_msg_hdr_l1_lws:
if (likely(HTTP_IS_SPHT(*ptr))) {
if (!skip_update) {
/* replace HT,CR,LF with spaces */
for (; start + sov < ptr; sov++)
start[sov] = ' ';
}
goto http_msg_hdr_l1_sp;
}
/* we had a header consisting only in spaces ! */
eol = sov;
goto http_msg_complete_header;
case H1_MSG_HDR_VAL:
http_msg_hdr_val:
/* assumes sol points to the first char, and sov
* points to the first character of the value.
*/
/* speedup: we'll skip packs of 4 or 8 bytes not containing bytes 0x0D
* and lower. In fact since most of the time is spent in the loop, we
* also remove the sign bit test so that bytes 0x8e..0x0d break the
* loop, but we don't care since they're very rare in header values.
*/
#ifdef HA_UNALIGNED_LE64
while (ptr <= end - sizeof(long)) {
if (is_char8_below_opt(*(ulong *)ptr, 0x0e))
goto http_msg_hdr_val2;
ptr += sizeof(long);
}
#endif
#ifdef HA_UNALIGNED_LE
while (ptr <= end - sizeof(int)) {
if (is_char4_below_opt(*(uint *)ptr, 0x0e))
goto http_msg_hdr_val2;
ptr += sizeof(int);
}
#endif
if (ptr >= end) {
state = H1_MSG_HDR_VAL;
goto http_msg_ood;
}
http_msg_hdr_val2:
if (likely(!*ptr)) {
/* RFC9110 clarified that NUL is explicitly forbidden in header values
* (like CR and LF).
*/
if (h1m->err_pos < -1 || /* PR_O2_R*BUG_OK not set */
(!(h1m->flags & H1_MF_RESP) && !(global.acc_hreq_vio & HTTP_VIO_HDR_VALUE_NUL)) ||
((h1m->flags & H1_MF_RESP) && !(global.acc_hres_vio & HTTP_VIO_HDR_VALUE_NUL))) {
state = H1_MSG_HDR_VAL;
goto http_msg_invalid;
}
if (h1m->err_pos == -1) /* PR_O2_REQBUG_OK set: just log */
h1m->err_pos = ptr - start + skip;
}
if (likely(!HTTP_IS_CRLF(*ptr)))
EAT_AND_JUMP_OR_RETURN(ptr, end, http_msg_hdr_val2, http_msg_ood, state, H1_MSG_HDR_VAL);
eol = ptr - start;
/* Note: we could also copy eol into ->eoh so that we have the
* real header end in case it ends with lots of LWS, but is this
* really needed ?
*/
if (likely(*ptr == '\r'))
EAT_AND_JUMP_OR_RETURN(ptr, end, http_msg_hdr_l2_lf, http_msg_ood, state, H1_MSG_HDR_L2_LF);
goto http_msg_hdr_l2_lf;
case H1_MSG_HDR_L2_LF:
http_msg_hdr_l2_lf:
EXPECT_LF_HERE(ptr, http_msg_invalid, state, H1_MSG_HDR_L2_LF);
EAT_AND_JUMP_OR_RETURN(ptr, end, http_msg_hdr_l2_lws, http_msg_ood, state, H1_MSG_HDR_L2_LWS);
case H1_MSG_HDR_L2_LWS:
http_msg_hdr_l2_lws:
if (unlikely(HTTP_IS_SPHT(*ptr))) {
if (!skip_update) {
/* LWS: replace HT,CR,LF with spaces */
for (; start + eol < ptr; eol++)
start[eol] = ' ';
}
goto http_msg_hdr_val;
}
http_msg_complete_header:
/*
* It was a new header, so the last one is finished. Assumes
* <sol> points to the first char of the name, <col> to the
* colon, <sov> points to the first character of the value and
* <eol> to the first CR or LF so we know how the line ends. We
* will trim spaces around the value. It's possible to do it by
* adjusting <eol> and <sov> which are no more used after this.
* We can add the header field to the list.
*/
if (likely(!skip_update)) {
while (sov < eol && HTTP_IS_LWS(start[sov]))
sov++;
while (eol - 1 > sov && HTTP_IS_LWS(start[eol - 1]))
eol--;
You can’t perform that action at this time.