| /* |
| * nghttp2 - HTTP/2 C Library |
| * |
| * Copyright (c) 2015 Tatsuhiro Tsujikawa |
| * |
| * Permission is hereby granted, free of charge, to any person obtaining |
| * a copy of this software and associated documentation files (the |
| * "Software"), to deal in the Software without restriction, including |
| * without limitation the rights to use, copy, modify, merge, publish, |
| * distribute, sublicense, and/or sell copies of the Software, and to |
| * permit persons to whom the Software is furnished to do so, subject to |
| * the following conditions: |
| * |
| * The above copyright notice and this permission notice shall be |
| * included in all copies or substantial portions of the Software. |
| * |
| * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, |
| * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF |
| * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND |
| * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE |
| * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION |
| * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION |
| * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. |
| */ |
| #include "nghttp2_http.h" |
| |
| #include <string.h> |
| #include <assert.h> |
| #include <stdio.h> |
| |
| #include "nghttp2_hd.h" |
| #include "nghttp2_helper.h" |
| |
| static uint8_t downcase(uint8_t c) { |
| return 'A' <= c && c <= 'Z' ? (uint8_t)(c - 'A' + 'a') : c; |
| } |
| |
| static int memieq(const void *a, const void *b, size_t n) { |
| size_t i; |
| const uint8_t *aa = a, *bb = b; |
| |
| for (i = 0; i < n; ++i) { |
| if (downcase(aa[i]) != downcase(bb[i])) { |
| return 0; |
| } |
| } |
| return 1; |
| } |
| |
| #define lstrieq(A, B, N) ((sizeof((A)) - 1) == (N) && memieq((A), (B), (N))) |
| |
| static int64_t parse_uint(const uint8_t *s, size_t len) { |
| int64_t n = 0; |
| size_t i; |
| if (len == 0) { |
| return -1; |
| } |
| for (i = 0; i < len; ++i) { |
| if ('0' <= s[i] && s[i] <= '9') { |
| if (n > INT64_MAX / 10) { |
| return -1; |
| } |
| n *= 10; |
| if (n > INT64_MAX - (s[i] - '0')) { |
| return -1; |
| } |
| n += s[i] - '0'; |
| continue; |
| } |
| return -1; |
| } |
| return n; |
| } |
| |
| static int lws(const uint8_t *s, size_t n) { |
| size_t i; |
| for (i = 0; i < n; ++i) { |
| if (s[i] != ' ' && s[i] != '\t') { |
| return 0; |
| } |
| } |
| return 1; |
| } |
| |
| static int check_pseudo_header(nghttp2_stream *stream, const nghttp2_hd_nv *nv, |
| int flag) { |
| if (stream->http_flags & flag) { |
| return 0; |
| } |
| if (lws(nv->value->base, nv->value->len)) { |
| return 0; |
| } |
| stream->http_flags = (uint16_t)(stream->http_flags | flag); |
| return 1; |
| } |
| |
| static int expect_response_body(nghttp2_stream *stream) { |
| return (stream->http_flags & NGHTTP2_HTTP_FLAG_METH_HEAD) == 0 && |
| stream->status_code / 100 != 1 && stream->status_code != 304 && |
| stream->status_code != 204; |
| } |
| |
| /* For "http" or "https" URIs, OPTIONS request may have "*" in :path |
| header field to represent system-wide OPTIONS request. Otherwise, |
| :path header field value must start with "/". This function must |
| be called after ":method" header field was received. This function |
| returns nonzero if path is valid.*/ |
| static int check_path(nghttp2_stream *stream) { |
| return (stream->http_flags & NGHTTP2_HTTP_FLAG_SCHEME_HTTP) == 0 || |
| ((stream->http_flags & NGHTTP2_HTTP_FLAG_PATH_REGULAR) || |
| ((stream->http_flags & NGHTTP2_HTTP_FLAG_METH_OPTIONS) && |
| (stream->http_flags & NGHTTP2_HTTP_FLAG_PATH_ASTERISK))); |
| } |
| |
| static int http_request_on_header(nghttp2_stream *stream, nghttp2_hd_nv *nv, |
| int trailer, int connect_protocol) { |
| if (nv->name->base[0] == ':') { |
| if (trailer || |
| (stream->http_flags & NGHTTP2_HTTP_FLAG_PSEUDO_HEADER_DISALLOWED)) { |
| return NGHTTP2_ERR_HTTP_HEADER; |
| } |
| } |
| |
| switch (nv->token) { |
| case NGHTTP2_TOKEN__AUTHORITY: |
| if (!check_pseudo_header(stream, nv, NGHTTP2_HTTP_FLAG__AUTHORITY)) { |
| return NGHTTP2_ERR_HTTP_HEADER; |
| } |
| break; |
| case NGHTTP2_TOKEN__METHOD: |
| if (!check_pseudo_header(stream, nv, NGHTTP2_HTTP_FLAG__METHOD)) { |
| return NGHTTP2_ERR_HTTP_HEADER; |
| } |
| switch (nv->value->len) { |
| case 4: |
| if (lstreq("HEAD", nv->value->base, nv->value->len)) { |
| stream->http_flags |= NGHTTP2_HTTP_FLAG_METH_HEAD; |
| } |
| break; |
| case 7: |
| switch (nv->value->base[6]) { |
| case 'T': |
| if (lstreq("CONNECT", nv->value->base, nv->value->len)) { |
| if (stream->stream_id % 2 == 0) { |
| /* we won't allow CONNECT for push */ |
| return NGHTTP2_ERR_HTTP_HEADER; |
| } |
| stream->http_flags |= NGHTTP2_HTTP_FLAG_METH_CONNECT; |
| } |
| break; |
| case 'S': |
| if (lstreq("OPTIONS", nv->value->base, nv->value->len)) { |
| stream->http_flags |= NGHTTP2_HTTP_FLAG_METH_OPTIONS; |
| } |
| break; |
| } |
| break; |
| } |
| break; |
| case NGHTTP2_TOKEN__PATH: |
| if (!check_pseudo_header(stream, nv, NGHTTP2_HTTP_FLAG__PATH)) { |
| return NGHTTP2_ERR_HTTP_HEADER; |
| } |
| if (nv->value->base[0] == '/') { |
| stream->http_flags |= NGHTTP2_HTTP_FLAG_PATH_REGULAR; |
| } else if (nv->value->len == 1 && nv->value->base[0] == '*') { |
| stream->http_flags |= NGHTTP2_HTTP_FLAG_PATH_ASTERISK; |
| } |
| break; |
| case NGHTTP2_TOKEN__SCHEME: |
| if (!check_pseudo_header(stream, nv, NGHTTP2_HTTP_FLAG__SCHEME)) { |
| return NGHTTP2_ERR_HTTP_HEADER; |
| } |
| if ((nv->value->len == 4 && memieq("http", nv->value->base, 4)) || |
| (nv->value->len == 5 && memieq("https", nv->value->base, 5))) { |
| stream->http_flags |= NGHTTP2_HTTP_FLAG_SCHEME_HTTP; |
| } |
| break; |
| case NGHTTP2_TOKEN__PROTOCOL: |
| if (!connect_protocol) { |
| return NGHTTP2_ERR_HTTP_HEADER; |
| } |
| |
| if (!check_pseudo_header(stream, nv, NGHTTP2_HTTP_FLAG__PROTOCOL)) { |
| return NGHTTP2_ERR_HTTP_HEADER; |
| } |
| break; |
| case NGHTTP2_TOKEN_HOST: |
| if (!check_pseudo_header(stream, nv, NGHTTP2_HTTP_FLAG_HOST)) { |
| return NGHTTP2_ERR_HTTP_HEADER; |
| } |
| break; |
| case NGHTTP2_TOKEN_CONTENT_LENGTH: { |
| if (stream->content_length != -1) { |
| return NGHTTP2_ERR_HTTP_HEADER; |
| } |
| stream->content_length = parse_uint(nv->value->base, nv->value->len); |
| if (stream->content_length == -1) { |
| return NGHTTP2_ERR_HTTP_HEADER; |
| } |
| break; |
| } |
| /* disallowed header fields */ |
| case NGHTTP2_TOKEN_CONNECTION: |
| case NGHTTP2_TOKEN_KEEP_ALIVE: |
| case NGHTTP2_TOKEN_PROXY_CONNECTION: |
| case NGHTTP2_TOKEN_TRANSFER_ENCODING: |
| case NGHTTP2_TOKEN_UPGRADE: |
| return NGHTTP2_ERR_HTTP_HEADER; |
| case NGHTTP2_TOKEN_TE: |
| if (!lstrieq("trailers", nv->value->base, nv->value->len)) { |
| return NGHTTP2_ERR_HTTP_HEADER; |
| } |
| break; |
| default: |
| if (nv->name->base[0] == ':') { |
| return NGHTTP2_ERR_HTTP_HEADER; |
| } |
| } |
| |
| if (nv->name->base[0] != ':') { |
| stream->http_flags |= NGHTTP2_HTTP_FLAG_PSEUDO_HEADER_DISALLOWED; |
| } |
| |
| return 0; |
| } |
| |
| static int http_response_on_header(nghttp2_stream *stream, nghttp2_hd_nv *nv, |
| int trailer) { |
| if (nv->name->base[0] == ':') { |
| if (trailer || |
| (stream->http_flags & NGHTTP2_HTTP_FLAG_PSEUDO_HEADER_DISALLOWED)) { |
| return NGHTTP2_ERR_HTTP_HEADER; |
| } |
| } |
| |
| switch (nv->token) { |
| case NGHTTP2_TOKEN__STATUS: { |
| if (!check_pseudo_header(stream, nv, NGHTTP2_HTTP_FLAG__STATUS)) { |
| return NGHTTP2_ERR_HTTP_HEADER; |
| } |
| if (nv->value->len != 3) { |
| return NGHTTP2_ERR_HTTP_HEADER; |
| } |
| stream->status_code = (int16_t)parse_uint(nv->value->base, nv->value->len); |
| if (stream->status_code == -1 || stream->status_code == 101) { |
| return NGHTTP2_ERR_HTTP_HEADER; |
| } |
| break; |
| } |
| case NGHTTP2_TOKEN_CONTENT_LENGTH: { |
| if (stream->status_code == 204) { |
| /* content-length header field in 204 response is prohibited by |
| RFC 7230. But some widely used servers send content-length: |
| 0. Until they get fixed, we ignore it. */ |
| if (stream->content_length != -1) { |
| /* Found multiple content-length field */ |
| return NGHTTP2_ERR_HTTP_HEADER; |
| } |
| if (!lstrieq("0", nv->value->base, nv->value->len)) { |
| return NGHTTP2_ERR_HTTP_HEADER; |
| } |
| stream->content_length = 0; |
| return NGHTTP2_ERR_REMOVE_HTTP_HEADER; |
| } |
| if (stream->status_code / 100 == 1) { |
| return NGHTTP2_ERR_HTTP_HEADER; |
| } |
| /* https://tools.ietf.org/html/rfc7230#section-3.3.3 */ |
| if (stream->status_code / 100 == 2 && |
| (stream->http_flags & NGHTTP2_HTTP_FLAG_METH_CONNECT)) { |
| return NGHTTP2_ERR_REMOVE_HTTP_HEADER; |
| } |
| if (stream->content_length != -1) { |
| return NGHTTP2_ERR_HTTP_HEADER; |
| } |
| stream->content_length = parse_uint(nv->value->base, nv->value->len); |
| if (stream->content_length == -1) { |
| return NGHTTP2_ERR_HTTP_HEADER; |
| } |
| break; |
| } |
| /* disallowed header fields */ |
| case NGHTTP2_TOKEN_CONNECTION: |
| case NGHTTP2_TOKEN_KEEP_ALIVE: |
| case NGHTTP2_TOKEN_PROXY_CONNECTION: |
| case NGHTTP2_TOKEN_TRANSFER_ENCODING: |
| case NGHTTP2_TOKEN_UPGRADE: |
| return NGHTTP2_ERR_HTTP_HEADER; |
| case NGHTTP2_TOKEN_TE: |
| if (!lstrieq("trailers", nv->value->base, nv->value->len)) { |
| return NGHTTP2_ERR_HTTP_HEADER; |
| } |
| break; |
| default: |
| if (nv->name->base[0] == ':') { |
| return NGHTTP2_ERR_HTTP_HEADER; |
| } |
| } |
| |
| if (nv->name->base[0] != ':') { |
| stream->http_flags |= NGHTTP2_HTTP_FLAG_PSEUDO_HEADER_DISALLOWED; |
| } |
| |
| return 0; |
| } |
| |
| static int check_scheme(const uint8_t *value, size_t len) { |
| const uint8_t *last; |
| if (len == 0) { |
| return 0; |
| } |
| |
| if (!(('A' <= *value && *value <= 'Z') || ('a' <= *value && *value <= 'z'))) { |
| return 0; |
| } |
| |
| last = value + len; |
| ++value; |
| |
| for (; value != last; ++value) { |
| if (!(('A' <= *value && *value <= 'Z') || |
| ('a' <= *value && *value <= 'z') || |
| ('0' <= *value && *value <= '9') || *value == '+' || *value == '-' || |
| *value == '.')) { |
| return 0; |
| } |
| } |
| return 1; |
| } |
| |
| int nghttp2_http_on_header(nghttp2_session *session, nghttp2_stream *stream, |
| nghttp2_frame *frame, nghttp2_hd_nv *nv, |
| int trailer) { |
| int rv; |
| |
| /* We are strict for pseudo header field. One bad character should |
| lead to fail. OTOH, we should be a bit forgiving for regular |
| headers, since existing public internet has so much illegal |
| headers floating around and if we kill the stream because of |
| this, we may disrupt many web sites and/or libraries. So we |
| become conservative here, and just ignore those illegal regular |
| headers. */ |
| if (!nghttp2_check_header_name(nv->name->base, nv->name->len)) { |
| size_t i; |
| if (nv->name->len > 0 && nv->name->base[0] == ':') { |
| return NGHTTP2_ERR_HTTP_HEADER; |
| } |
| /* header field name must be lower-cased without exception */ |
| for (i = 0; i < nv->name->len; ++i) { |
| uint8_t c = nv->name->base[i]; |
| if ('A' <= c && c <= 'Z') { |
| return NGHTTP2_ERR_HTTP_HEADER; |
| } |
| } |
| /* When ignoring regular headers, we set this flag so that we |
| still enforce header field ordering rule for pseudo header |
| fields. */ |
| stream->http_flags |= NGHTTP2_HTTP_FLAG_PSEUDO_HEADER_DISALLOWED; |
| return NGHTTP2_ERR_IGN_HTTP_HEADER; |
| } |
| |
| if (nv->token == NGHTTP2_TOKEN__AUTHORITY || |
| nv->token == NGHTTP2_TOKEN_HOST) { |
| rv = nghttp2_check_authority(nv->value->base, nv->value->len); |
| } else if (nv->token == NGHTTP2_TOKEN__SCHEME) { |
| rv = check_scheme(nv->value->base, nv->value->len); |
| } else { |
| rv = nghttp2_check_header_value(nv->value->base, nv->value->len); |
| } |
| |
| if (rv == 0) { |
| assert(nv->name->len > 0); |
| if (nv->name->base[0] == ':') { |
| return NGHTTP2_ERR_HTTP_HEADER; |
| } |
| /* When ignoring regular headers, we set this flag so that we |
| still enforce header field ordering rule for pseudo header |
| fields. */ |
| stream->http_flags |= NGHTTP2_HTTP_FLAG_PSEUDO_HEADER_DISALLOWED; |
| return NGHTTP2_ERR_IGN_HTTP_HEADER; |
| } |
| |
| if (session->server || frame->hd.type == NGHTTP2_PUSH_PROMISE) { |
| return http_request_on_header(stream, nv, trailer, |
| session->server && |
| session->pending_enable_connect_protocol); |
| } |
| |
| return http_response_on_header(stream, nv, trailer); |
| } |
| |
| int nghttp2_http_on_request_headers(nghttp2_stream *stream, |
| nghttp2_frame *frame) { |
| if (!(stream->http_flags & NGHTTP2_HTTP_FLAG__PROTOCOL) && |
| (stream->http_flags & NGHTTP2_HTTP_FLAG_METH_CONNECT)) { |
| if ((stream->http_flags & |
| (NGHTTP2_HTTP_FLAG__SCHEME | NGHTTP2_HTTP_FLAG__PATH)) || |
| (stream->http_flags & NGHTTP2_HTTP_FLAG__AUTHORITY) == 0) { |
| return -1; |
| } |
| stream->content_length = -1; |
| } else { |
| if ((stream->http_flags & NGHTTP2_HTTP_FLAG_REQ_HEADERS) != |
| NGHTTP2_HTTP_FLAG_REQ_HEADERS || |
| (stream->http_flags & |
| (NGHTTP2_HTTP_FLAG__AUTHORITY | NGHTTP2_HTTP_FLAG_HOST)) == 0) { |
| return -1; |
| } |
| if ((stream->http_flags & NGHTTP2_HTTP_FLAG__PROTOCOL) && |
| ((stream->http_flags & NGHTTP2_HTTP_FLAG_METH_CONNECT) == 0 || |
| (stream->http_flags & NGHTTP2_HTTP_FLAG__AUTHORITY) == 0)) { |
| return -1; |
| } |
| if (!check_path(stream)) { |
| return -1; |
| } |
| } |
| |
| if (frame->hd.type == NGHTTP2_PUSH_PROMISE) { |
| /* we are going to reuse data fields for upcoming response. Clear |
| them now, except for method flags. */ |
| stream->http_flags &= NGHTTP2_HTTP_FLAG_METH_ALL; |
| stream->content_length = -1; |
| } |
| |
| return 0; |
| } |
| |
| int nghttp2_http_on_response_headers(nghttp2_stream *stream) { |
| if ((stream->http_flags & NGHTTP2_HTTP_FLAG__STATUS) == 0) { |
| return -1; |
| } |
| |
| if (stream->status_code / 100 == 1) { |
| /* non-final response */ |
| stream->http_flags = |
| (uint16_t)((stream->http_flags & NGHTTP2_HTTP_FLAG_METH_ALL) | |
| NGHTTP2_HTTP_FLAG_EXPECT_FINAL_RESPONSE); |
| stream->content_length = -1; |
| stream->status_code = -1; |
| return 0; |
| } |
| |
| stream->http_flags = |
| (uint16_t)(stream->http_flags & ~NGHTTP2_HTTP_FLAG_EXPECT_FINAL_RESPONSE); |
| |
| if (!expect_response_body(stream)) { |
| stream->content_length = 0; |
| } else if (stream->http_flags & (NGHTTP2_HTTP_FLAG_METH_CONNECT | |
| NGHTTP2_HTTP_FLAG_METH_UPGRADE_WORKAROUND)) { |
| stream->content_length = -1; |
| } |
| |
| return 0; |
| } |
| |
| int nghttp2_http_on_trailer_headers(nghttp2_stream *stream, |
| nghttp2_frame *frame) { |
| (void)stream; |
| |
| if ((frame->hd.flags & NGHTTP2_FLAG_END_STREAM) == 0) { |
| return -1; |
| } |
| |
| return 0; |
| } |
| |
| int nghttp2_http_on_remote_end_stream(nghttp2_stream *stream) { |
| if (stream->http_flags & NGHTTP2_HTTP_FLAG_EXPECT_FINAL_RESPONSE) { |
| return -1; |
| } |
| |
| if (stream->content_length != -1 && |
| stream->content_length != stream->recv_content_length) { |
| return -1; |
| } |
| |
| return 0; |
| } |
| |
| int nghttp2_http_on_data_chunk(nghttp2_stream *stream, size_t n) { |
| stream->recv_content_length += (int64_t)n; |
| |
| if ((stream->http_flags & NGHTTP2_HTTP_FLAG_EXPECT_FINAL_RESPONSE) || |
| (stream->content_length != -1 && |
| stream->recv_content_length > stream->content_length)) { |
| return -1; |
| } |
| |
| return 0; |
| } |
| |
| void nghttp2_http_record_request_method(nghttp2_stream *stream, |
| nghttp2_frame *frame) { |
| const nghttp2_nv *nva; |
| size_t nvlen; |
| size_t i; |
| |
| switch (frame->hd.type) { |
| case NGHTTP2_HEADERS: |
| nva = frame->headers.nva; |
| nvlen = frame->headers.nvlen; |
| break; |
| case NGHTTP2_PUSH_PROMISE: |
| nva = frame->push_promise.nva; |
| nvlen = frame->push_promise.nvlen; |
| break; |
| default: |
| return; |
| } |
| |
| /* TODO we should do this strictly. */ |
| for (i = 0; i < nvlen; ++i) { |
| const nghttp2_nv *nv = &nva[i]; |
| if (!(nv->namelen == 7 && nv->name[6] == 'd' && |
| memcmp(":metho", nv->name, nv->namelen - 1) == 0)) { |
| continue; |
| } |
| if (lstreq("CONNECT", nv->value, nv->valuelen)) { |
| stream->http_flags |= NGHTTP2_HTTP_FLAG_METH_CONNECT; |
| return; |
| } |
| if (lstreq("HEAD", nv->value, nv->valuelen)) { |
| stream->http_flags |= NGHTTP2_HTTP_FLAG_METH_HEAD; |
| return; |
| } |
| return; |
| } |
| } |