HttpHeaderProcessor.cc 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484
  1. /* <!-- copyright */
  2. /*
  3. * aria2 - The high speed download utility
  4. *
  5. * Copyright (C) 2012 Tatsuhiro Tsujikawa
  6. *
  7. * This program is free software; you can redistribute it and/or modify
  8. * it under the terms of the GNU General Public License as published by
  9. * the Free Software Foundation; either version 2 of the License, or
  10. * (at your option) any later version.
  11. *
  12. * This program is distributed in the hope that it will be useful,
  13. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  15. * GNU General Public License for more details.
  16. *
  17. * You should have received a copy of the GNU General Public License
  18. * along with this program; if not, write to the Free Software
  19. * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  20. *
  21. * In addition, as a special exception, the copyright holders give
  22. * permission to link the code of portions of this program with the
  23. * OpenSSL library under certain conditions as described in each
  24. * individual source file, and distribute linked combinations
  25. * including the two.
  26. * You must obey the GNU General Public License in all respects
  27. * for all of the code used other than OpenSSL. If you modify
  28. * file(s) with this exception, you may extend this exception to your
  29. * version of the file(s), but you are not obligated to do so. If you
  30. * do not wish to do so, delete this exception statement from your
  31. * version. If you delete this exception statement from all source
  32. * files in the program, then also delete it here.
  33. */
  34. /* copyright --> */
  35. #include "HttpHeaderProcessor.h"
  36. #include <vector>
  37. #include "HttpHeader.h"
  38. #include "message.h"
  39. #include "util.h"
  40. #include "DlRetryEx.h"
  41. #include "DlAbortEx.h"
  42. #include "A2STR.h"
  43. #include "error_code.h"
  44. namespace aria2 {
  45. namespace {
  46. enum {
  47. // Server mode
  48. PREV_METHOD,
  49. METHOD,
  50. PREV_PATH,
  51. PATH,
  52. PREV_REQ_VERSION,
  53. REQ_VERSION,
  54. // Client mode,
  55. PREV_RES_VERSION,
  56. RES_VERSION,
  57. PREV_STATUS_CODE,
  58. STATUS_CODE,
  59. PREV_REASON_PHRASE,
  60. REASON_PHRASE,
  61. // name/value header fields
  62. PREV_EOL,
  63. PREV_FIELD_NAME,
  64. FIELD_NAME,
  65. PREV_FIELD_VALUE,
  66. FIELD_VALUE,
  67. // End of header
  68. PREV_EOH,
  69. HEADERS_COMPLETE
  70. };
  71. } // namespace
  72. HttpHeaderProcessor::HttpHeaderProcessor(ParserMode mode)
  73. : mode_(mode),
  74. state_(mode == CLIENT_PARSER ? PREV_RES_VERSION : PREV_METHOD),
  75. lastBytesProcessed_(0),
  76. lastFieldHdKey_(HttpHeader::MAX_INTERESTING_HEADER),
  77. result_(new HttpHeader())
  78. {}
  79. HttpHeaderProcessor::~HttpHeaderProcessor() {}
  80. namespace {
  81. size_t
  82. getToken(std::string& buf, const unsigned char* data, size_t length, size_t off)
  83. {
  84. size_t j = off;
  85. while (j < length && !util::isLws(data[j]) && !util::isCRLF(data[j])) {
  86. ++j;
  87. }
  88. buf.append(&data[off], &data[j]);
  89. return j - 1;
  90. }
  91. } // namespace
  92. namespace {
  93. size_t getFieldNameToken(std::string& buf,
  94. const unsigned char* data,
  95. size_t length,
  96. size_t off)
  97. {
  98. size_t j = off;
  99. while (j < length && data[j] != ':' && !util::isLws(data[j]) &&
  100. !util::isCRLF(data[j])) {
  101. ++j;
  102. }
  103. buf.append(&data[off], &data[j]);
  104. return j - 1;
  105. }
  106. } // namespace
  107. namespace {
  108. size_t
  109. getText(std::string& buf, const unsigned char* data, size_t length, size_t off)
  110. {
  111. size_t j = off;
  112. while (j < length && !util::isCRLF(data[j])) {
  113. ++j;
  114. }
  115. buf.append(&data[off], &data[j]);
  116. return j - 1;
  117. }
  118. } // namespace
  119. namespace {
  120. size_t ignoreText(std::string& buf,
  121. const unsigned char* data,
  122. size_t length,
  123. size_t off)
  124. {
  125. size_t j = off;
  126. while (j < length && !util::isCRLF(data[j])) {
  127. ++j;
  128. }
  129. return j - 1;
  130. }
  131. } // namespace
  132. bool HttpHeaderProcessor::parse(const unsigned char* data, size_t length)
  133. {
  134. size_t i;
  135. lastBytesProcessed_ = 0;
  136. for (i = 0; i < length; ++i) {
  137. unsigned char c = data[i];
  138. switch (state_) {
  139. case PREV_METHOD:
  140. if (util::isLws(c) || util::isCRLF(c)) {
  141. throw DL_ABORT_EX("Bad Request-Line: missing method");
  142. }
  143. i = getToken(buf_, data, length, i);
  144. state_ = METHOD;
  145. break;
  146. case METHOD:
  147. if (util::isLws(c)) {
  148. result_->setMethod(buf_);
  149. buf_.clear();
  150. state_ = PREV_PATH;
  151. break;
  152. }
  153. if (util::isCRLF(c)) {
  154. throw DL_ABORT_EX("Bad Request-Line: missing request-target");
  155. }
  156. i = getToken(buf_, data, length, i);
  157. break;
  158. case PREV_PATH:
  159. if (util::isCRLF(c)) {
  160. throw DL_ABORT_EX("Bad Request-Line: missing request-target");
  161. }
  162. if (util::isLws(c)) {
  163. break;
  164. }
  165. i = getToken(buf_, data, length, i);
  166. state_ = PATH;
  167. break;
  168. case PATH:
  169. if (util::isLws(c)) {
  170. result_->setRequestPath(buf_);
  171. buf_.clear();
  172. state_ = PREV_REQ_VERSION;
  173. break;
  174. }
  175. if (util::isCRLF(c)) {
  176. throw DL_ABORT_EX("Bad Request-Line: missing HTTP-version");
  177. }
  178. i = getToken(buf_, data, length, i);
  179. break;
  180. case PREV_REQ_VERSION:
  181. if (util::isCRLF(c)) {
  182. throw DL_ABORT_EX("Bad Request-Line: missing HTTP-version");
  183. }
  184. if (util::isLws(c)) {
  185. break;
  186. }
  187. i = getToken(buf_, data, length, i);
  188. state_ = REQ_VERSION;
  189. break;
  190. case REQ_VERSION:
  191. if (util::isCRLF(c)) {
  192. result_->setVersion(buf_);
  193. buf_.clear();
  194. state_ = c == '\n' ? PREV_FIELD_NAME : PREV_EOL;
  195. break;
  196. }
  197. if (util::isLws(c)) {
  198. throw DL_ABORT_EX("Bad Request-Line: LWS after HTTP-version");
  199. }
  200. i = getToken(buf_, data, length, i);
  201. break;
  202. case PREV_RES_VERSION:
  203. if (util::isLws(c) || util::isCRLF(c)) {
  204. throw DL_ABORT_EX("Bad Status-Line: missing HTTP-version");
  205. }
  206. i = getToken(buf_, data, length, i);
  207. state_ = RES_VERSION;
  208. break;
  209. case RES_VERSION:
  210. if (util::isLws(c)) {
  211. result_->setVersion(buf_);
  212. buf_.clear();
  213. state_ = PREV_STATUS_CODE;
  214. break;
  215. }
  216. if (util::isCRLF(c)) {
  217. throw DL_ABORT_EX("Bad Status-Line: missing status-code");
  218. }
  219. break;
  220. case PREV_STATUS_CODE:
  221. if (util::isCRLF(c)) {
  222. throw DL_ABORT_EX("Bad Status-Line: missing status-code");
  223. }
  224. if (!util::isLws(c)) {
  225. state_ = STATUS_CODE;
  226. i = getToken(buf_, data, length, i);
  227. }
  228. break;
  229. case STATUS_CODE:
  230. if (!util::isLws(c) && !util::isCRLF(c)) {
  231. i = getToken(buf_, data, length, i);
  232. break;
  233. }
  234. {
  235. int statusCode = -1;
  236. if (buf_.size() == 3 && util::isNumber(buf_.begin(), buf_.end())) {
  237. statusCode =
  238. (buf_[0] - '0') * 100 + (buf_[1] - '0') * 10 + (buf_[2] - '0');
  239. }
  240. if (statusCode < 100) {
  241. throw DL_ABORT_EX("Bad status code: bad status-code");
  242. }
  243. result_->setStatusCode(statusCode);
  244. buf_.clear();
  245. }
  246. if (c == '\r') {
  247. state_ = PREV_EOL;
  248. break;
  249. }
  250. if (c == '\n') {
  251. state_ = PREV_FIELD_NAME;
  252. break;
  253. }
  254. state_ = PREV_REASON_PHRASE;
  255. break;
  256. case PREV_REASON_PHRASE:
  257. if (util::isCRLF(c)) {
  258. // The reason-phrase is completely optional.
  259. state_ = c == '\n' ? PREV_FIELD_NAME : PREV_EOL;
  260. break;
  261. }
  262. if (util::isLws(c)) {
  263. break;
  264. }
  265. state_ = REASON_PHRASE;
  266. i = getText(buf_, data, length, i);
  267. break;
  268. case REASON_PHRASE:
  269. if (util::isCRLF(c)) {
  270. result_->setReasonPhrase(buf_);
  271. buf_.clear();
  272. state_ = c == '\n' ? PREV_FIELD_NAME : PREV_EOL;
  273. break;
  274. }
  275. i = getText(buf_, data, length, i);
  276. break;
  277. case PREV_EOL:
  278. if (c != '\n') {
  279. throw DL_ABORT_EX("Bad HTTP header: missing LF");
  280. }
  281. state_ = PREV_FIELD_NAME;
  282. break;
  283. case PREV_FIELD_NAME:
  284. if (util::isLws(c)) {
  285. if (lastFieldName_.empty()) {
  286. throw DL_ABORT_EX("Bad HTTP header: field name starts with LWS");
  287. }
  288. // Evil Multi-line header field
  289. state_ = FIELD_VALUE;
  290. break;
  291. }
  292. if (!lastFieldName_.empty()) {
  293. if (lastFieldHdKey_ != HttpHeader::MAX_INTERESTING_HEADER) {
  294. result_->put(lastFieldHdKey_, util::strip(buf_));
  295. }
  296. lastFieldName_.clear();
  297. lastFieldHdKey_ = HttpHeader::MAX_INTERESTING_HEADER;
  298. buf_.clear();
  299. }
  300. if (c == '\n') {
  301. state_ = HEADERS_COMPLETE;
  302. break;
  303. }
  304. if (c == '\r') {
  305. state_ = PREV_EOH;
  306. break;
  307. }
  308. if (c == ':') {
  309. throw DL_ABORT_EX("Bad HTTP header: field name starts with ':'");
  310. }
  311. state_ = FIELD_NAME;
  312. i = getFieldNameToken(lastFieldName_, data, length, i);
  313. break;
  314. case FIELD_NAME:
  315. if (util::isLws(c) || util::isCRLF(c)) {
  316. throw DL_ABORT_EX("Bad HTTP header: missing ':'");
  317. }
  318. if (c == ':') {
  319. util::lowercase(lastFieldName_);
  320. lastFieldHdKey_ = idInterestingHeader(lastFieldName_.c_str());
  321. state_ = PREV_FIELD_VALUE;
  322. break;
  323. }
  324. i = getFieldNameToken(lastFieldName_, data, length, i);
  325. break;
  326. case PREV_FIELD_VALUE:
  327. if (c == '\r') {
  328. state_ = PREV_EOL;
  329. break;
  330. }
  331. if (c == '\n') {
  332. state_ = PREV_FIELD_NAME;
  333. break;
  334. }
  335. if (util::isLws(c)) {
  336. break;
  337. }
  338. state_ = FIELD_VALUE;
  339. if (lastFieldHdKey_ == HttpHeader::MAX_INTERESTING_HEADER) {
  340. i = ignoreText(buf_, data, length, i);
  341. break;
  342. }
  343. i = getText(buf_, data, length, i);
  344. break;
  345. case FIELD_VALUE:
  346. if (c == '\r') {
  347. state_ = PREV_EOL;
  348. break;
  349. }
  350. if (c == '\n') {
  351. state_ = PREV_FIELD_NAME;
  352. break;
  353. }
  354. if (lastFieldHdKey_ == HttpHeader::MAX_INTERESTING_HEADER) {
  355. i = ignoreText(buf_, data, length, i);
  356. break;
  357. }
  358. i = getText(buf_, data, length, i);
  359. break;
  360. case PREV_EOH:
  361. if (c != '\n') {
  362. throw DL_ABORT_EX("Bad HTTP header: "
  363. "missing LF at the end of the header");
  364. }
  365. state_ = HEADERS_COMPLETE;
  366. break;
  367. case HEADERS_COMPLETE:
  368. goto fin;
  369. }
  370. }
  371. fin:
  372. // See Apache's documentation
  373. // http://httpd.apache.org/docs/2.2/en/mod/core.html about size
  374. // limit of HTTP headers. The page states that the number of request
  375. // fields rarely exceeds 20.
  376. if (lastFieldName_.size() > 1024 || buf_.size() > 8192) {
  377. throw DL_ABORT_EX("Too large HTTP header");
  378. }
  379. lastBytesProcessed_ = i;
  380. headers_.append(&data[0], &data[i]);
  381. return state_ == HEADERS_COMPLETE;
  382. }
  383. bool HttpHeaderProcessor::parse(const std::string& data)
  384. {
  385. return parse(reinterpret_cast<const unsigned char*>(data.c_str()),
  386. data.size());
  387. }
  388. size_t HttpHeaderProcessor::getLastBytesProcessed() const
  389. {
  390. return lastBytesProcessed_;
  391. }
  392. void HttpHeaderProcessor::clear()
  393. {
  394. state_ = (mode_ == CLIENT_PARSER ? PREV_RES_VERSION : PREV_METHOD);
  395. lastBytesProcessed_ = 0;
  396. buf_.clear();
  397. lastFieldName_.clear();
  398. lastFieldHdKey_ = HttpHeader::MAX_INTERESTING_HEADER;
  399. result_.reset(new HttpHeader());
  400. headers_.clear();
  401. }
  402. std::unique_ptr<HttpHeader> HttpHeaderProcessor::getResult()
  403. {
  404. return std::move(result_);
  405. }
  406. std::string HttpHeaderProcessor::getHeaderString() const
  407. {
  408. return headers_;
  409. }
  410. } // namespace aria2