src/lib-http/http-message-parser.c

/* Copyright (c) 2013-2018 Dovecot authors, see the included COPYING file */

#include "lib.h"
#include "array.h"
#include "istream.h"
#include "iostream.h"
#include "istream-sized.h"
#include "http-parser.h"
#include "http-header.h"
#include "http-header-parser.h"
#include "http-date.h"
#include "http-transfer.h"
#include "http-message-parser.h"

#include <ctype.h>

void http_message_parser_init(struct http_message_parser *parser,
    struct istream *input, const struct http_header_limits *hdr_limits,
    uoff_t max_payload_size, enum http_message_parse_flags flags)
{
    i_zero(parser);
    parser->input = input;
    i_stream_ref(parser->input);
    if (hdr_limits != NULL)
        parser->header_limits = *hdr_limits;
    parser->max_payload_size = max_payload_size;
    parser->flags = flags;
}

void http_message_parser_deinit(struct http_message_parser *parser)
{
    if (parser->header_parser != NULL)
        http_header_parser_deinit(&parser->header_parser);
    pool_unref(&parser->msg.pool);
    i_stream_unref(&parser->payload);
    i_stream_unref(&parser->input);
}

void http_message_parser_restart(struct http_message_parser *parser,
    pool_t pool)
{
    i_assert(parser->payload == NULL);

    if (parser->header_parser == NULL) {
        enum http_header_parse_flags hdr_flags = 0;

        if ((parser->flags & HTTP_MESSAGE_PARSE_FLAG_STRICT) != 0)
            hdr_flags |= HTTP_HEADER_PARSE_FLAG_STRICT;
        parser->header_parser = http_header_parser_init
            (parser->input, &parser->header_limits, hdr_flags);
    } else {
        http_header_parser_reset(parser->header_parser);
    }

    pool_unref(&parser->msg.pool);
    i_zero(&parser->msg);
    if (pool != NULL) {
        parser->msg.pool = pool;
        pool_ref(pool);
    }
    parser->msg.date = (time_t)-1;
}

pool_t http_message_parser_get_pool(struct http_message_parser *parser)
{
    if (parser->msg.pool == NULL)
        parser->msg.pool = pool_alloconly_create("http_message", 4096);
    return parser->msg.pool;
}

int http_message_parse_version(struct http_message_parser *parser)
{
    const unsigned char *p = parser->cur;
    const size_t size = parser->end - parser->cur;

    parser->error_code = HTTP_MESSAGE_PARSE_ERROR_NONE;
    parser->error = NULL;

    /* RFC 7230, Section 2.6: Protocol Versioning

       HTTP-version  = HTTP-name "/" DIGIT "." DIGIT
       HTTP-name     = %x48.54.54.50 ; "HTTP", case-sensitive
     */
    if (size < 8)
        return 0;
    if (memcmp(p, "HTTP/", 5) != 0 ||
        !i_isdigit(p[5]) || p[6] != '.' || !i_isdigit(p[7])) {
        parser->error = "Bad HTTP version";
        parser->error_code = HTTP_MESSAGE_PARSE_ERROR_BROKEN_MESSAGE;
        return -1;
    }
    parser->msg.version_major = p[5] - '0';
    parser->msg.version_minor = p[7] - '0';
    parser->cur += 8;
    return 1;
}

int http_message_parse_finish_payload(struct http_message_parser *parser)
{
    const unsigned char *data;
    size_t size;
    int ret;

    parser->error_code = HTTP_MESSAGE_PARSE_ERROR_NONE;
    parser->error = NULL;

    if (parser->payload == NULL)
        return 1;

    while ((ret = i_stream_read_more(parser->payload, &data, &size)) > 0)
        i_stream_skip(parser->payload, size);
    if (ret == 0 || parser->payload->stream_errno != 0) {
        if (ret < 0) {
            if (parser->payload->stream_errno == EMSGSIZE) {
                parser->error_code = HTTP_MESSAGE_PARSE_ERROR_PAYLOAD_TOO_LARGE;
                parser->error = "Payload is too large";
            } else if (parser->payload->stream_errno == EIO) {
                parser->error_code = HTTP_MESSAGE_PARSE_ERROR_BROKEN_MESSAGE;
                parser->error = "Invalid payload";
            } else {
                parser->error_code = HTTP_MESSAGE_PARSE_ERROR_BROKEN_STREAM;
                parser->error = t_strdup_printf("Stream error while skipping payload: %s",
                                i_stream_get_error(parser->payload));
            }
        }
        return ret;
    }

    i_stream_destroy(&parser->payload);
    return 1;
}

static int
http_message_parse_header(struct http_message_parser *parser,
              const char *name, const unsigned char *data, size_t size)
{
    const struct http_header_field *hdr;
    struct http_parser hparser;
    pool_t pool;

    pool = http_message_parser_get_pool(parser);
    if (parser->msg.header == NULL)
        parser->msg.header = http_header_create(pool, 32);
    hdr = http_header_field_add(parser->msg.header, name, data, size);

    /* RFC 7230, Section 3.2.2: Field Order

       A sender MUST NOT generate multiple header fields with the same field
       name in a message unless either the entire field value for that
       header field is defined as a comma-separated list [i.e., #(values)]
       or the header field is a well-known exception.
     */

    switch (name[0]) {
    case 'C': case 'c':
        /* Connection: */
        if (strcasecmp(name, "Connection") == 0) {
            const char **opt_idx;
            const char *option;
            unsigned int num_tokens = 0;

            /* RFC 7230, Section 6.1: Connection

               Connection        = 1#connection-option
               connection-option = token
            */

            /* Multiple Connection headers are allowed and combined into one */
            http_parser_init(&hparser, data, size);
            for (;;) {
                if (http_parse_token_list_next(&hparser, &option) <= 0)
                    break;
                num_tokens++;
                if (strcasecmp(option, "close") == 0)
                    parser->msg.connection_close = TRUE;
                if (!array_is_created(&parser->msg.connection_options))
                    p_array_init(&parser->msg.connection_options, pool, 4);
                opt_idx = array_append_space(&parser->msg.connection_options);
                *opt_idx = p_strdup(pool, option);
            }

            if (hparser.cur < hparser.end || num_tokens == 0) {
                parser->error = "Invalid Connection header";
                parser->error_code = HTTP_MESSAGE_PARSE_ERROR_BROKEN_MESSAGE;
                return -1;
            }

            return 0;
        }
        /* Content-Length: */
        if (strcasecmp(name, "Content-Length") == 0) {
            if (parser->msg.have_content_length) {
                /* There is no acceptable way to allow duplicates for this
                   header. */
                parser->error = "Duplicate Content-Length header";
                parser->error_code = HTTP_MESSAGE_PARSE_ERROR_BROKEN_MESSAGE;
                return -1;
            }

            /* RFC 7230, Section 3.3.2: Content-Length

               Content-Length = 1*DIGIT
             */
            if (str_to_uoff(hdr->value, &parser->msg.content_length) < 0) {
                parser->error= "Invalid Content-Length header";
                parser->error_code = HTTP_MESSAGE_PARSE_ERROR_BROKEN_MESSAGE;
                return -1;
            }
            parser->msg.have_content_length = TRUE;
            return 0;
        }
        break;
    case 'D': case 'd':
        /* Date: */
        if (strcasecmp(name, "Date") == 0) {
            if (parser->msg.date != (time_t)-1) {
                if ((parser->flags & HTTP_MESSAGE_PARSE_FLAG_STRICT) != 0) {
                    parser->error = "Duplicate Date header";
                    parser->error_code = HTTP_MESSAGE_PARSE_ERROR_BROKEN_MESSAGE;
                    return -1;
                }
                /* Allow the duplicate; last instance is used */
            }

            /* RFC 7231, Section 7.1.1.2: Date

               Date = HTTP-date
             */
            if (!http_date_parse(data, size, &parser->msg.date) &&
                (parser->flags & HTTP_MESSAGE_PARSE_FLAG_STRICT) != 0) {
                parser->error = "Invalid Date header";
                parser->error_code = HTTP_MESSAGE_PARSE_ERROR_BROKEN_MESSAGE;
                return -1;
            }
            return 0;
        }
        break;
    case 'L': case 'l':
        /* Location: */
        if (strcasecmp(name, "Location") == 0) {
            /* RFC 7231, Section 7.1.2: Location

               Location = URI-reference

               -> not parsed here
             */
            /* FIXME: move this to response parser */
            parser->msg.location = hdr->value;
            return 0;
        }
        break;
    case 'T': case 't':
        /* Transfer-Encoding: */
        if (strcasecmp(name, "Transfer-Encoding") == 0) {
            const char *trenc = NULL;

            /* Multiple Transfer-Encoding headers are allowed and combined into one */
            if (!array_is_created(&parser->msg.transfer_encoding))
                p_array_init(&parser->msg.transfer_encoding, pool, 4);

            /* RFC 7230, Section 3.3.1: Transfer-Encoding

               Transfer-Encoding  = 1#transfer-coding

               RFC 7230, Section 4: Transfer Codings

               transfer-coding    = "chunked"  ; RFC 7230, Section 4.1
                                  / "compress" ; RFC 7230, Section 4.2.1
                                  / "deflate"  ; RFC 7230, Section 4.2.2
                                  / "gzip"     ; RFC 7230, Section 4.2.3
                                  / transfer-extension
               transfer-extension = token *( OWS ";" OWS transfer-parameter )
               transfer-parameter = token BWS "=" BWS ( token / quoted-string )
             */
            http_parser_init(&hparser, data, size);
            for (;;) {
                /* transfer-coding */
                if (http_parse_token(&hparser, &trenc) > 0) {
                    struct http_transfer_coding *coding;
                    bool parse_error;

                    coding = array_append_space(&parser->msg.transfer_encoding);
                    coding->name = p_strdup(pool, trenc);

                    /* *( OWS ";" OWS transfer-parameter ) */
                    parse_error = FALSE;
                    for (;;) {
                        struct http_transfer_param *param;
                        const char *attribute, *value;

                        /* OWS ";" OWS */
                        http_parse_ows(&hparser);
                        if (hparser.cur >= hparser.end || *hparser.cur != ';')
                            break;
                        hparser.cur++;
                        http_parse_ows(&hparser);

                        /* attribute */
                        if (http_parse_token(&hparser, &attribute) <= 0) {
                            parse_error = TRUE;
                            break;
                        }

                        /* BWS "=" BWS */
                        http_parse_ows(&hparser);
                        if (hparser.cur >= hparser.end || *hparser.cur != '=') {
                            parse_error = TRUE;
                            break;
                        }
                        hparser.cur++;
                        http_parse_ows(&hparser);

                        /* token / quoted-string */
                        if (http_parse_token_or_qstring(&hparser, &value) <= 0) {
                            parse_error = TRUE;
                            break;
                        }

                        if (!array_is_created(&coding->parameters))
                            p_array_init(&coding->parameters, pool, 2);
                        param = array_append_space(&coding->parameters);
                        param->attribute = p_strdup(pool, attribute);
                        param->value = p_strdup(pool, value);
                    }
                    if (parse_error)
                        break;

                } else {
                    /* RFC 7230, Section 7: ABNF List Extension: #rule

                         For compatibility with legacy list rules, a recipient MUST parse
                       and ignore a reasonable number of empty list elements: enough to
                       handle common mistakes by senders that merge values, but not so
                       much that they could be used as a denial-of-service mechanism.
                     */
                    // FIXME: limit allowed number of empty list elements
                    // FIXME: handle invalid transfer encoding
                }
                http_parse_ows(&hparser);
                if (hparser.cur >= hparser.end || *hparser.cur != ',')
                    break;
                hparser.cur++;
                http_parse_ows(&hparser);
            }

            if (hparser.cur < hparser.end ||
                array_count(&parser->msg.transfer_encoding) == 0) {
                parser->error = "Invalid Transfer-Encoding header";
                parser->error_code = HTTP_MESSAGE_PARSE_ERROR_BROKEN_MESSAGE;
                return -1;
            }
            return 0;
        }
        break;
    default:
        break;
    }
    return 0;
}

int http_message_parse_headers(struct http_message_parser *parser)
{
    const unsigned char *field_data;
    struct http_message *msg = &parser->msg;
    const char *field_name, *error;
    size_t field_size;
    int ret;

    parser->error_code = HTTP_MESSAGE_PARSE_ERROR_NONE;
    parser->error = NULL;

    /* *( header-field CRLF ) CRLF */
    while ((ret=http_header_parse_next_field(parser->header_parser,
        &field_name, &field_data, &field_size, &error)) > 0) {
        if (field_name == NULL) {
            pool_t pool;
            /* EOH */

            /* Create empty header if there is none */
            pool = http_message_parser_get_pool(parser);
            if (parser->msg.header == NULL)
                parser->msg.header = http_header_create(pool, 1);

            /* handle HTTP/1.0 persistence */
            if (msg->version_major == 1 && msg->version_minor == 0 &&
                !msg->connection_close) {
                const char *const *option;

                msg->connection_close = TRUE;
                if (array_is_created(&parser->msg.connection_options)) {
                    array_foreach(&msg->connection_options, option) {
                        if (strcasecmp(*option, "Keep-Alive") == 0) {
                            msg->connection_close = FALSE;
                            break;
                        }
                    }
                }
            }
            return 1;
        }

        if (http_message_parse_header(parser,
            field_name, field_data, field_size) < 0)
            return -1;
    }

    if (ret < 0) {
        if (parser->input->eof || parser->input->stream_errno != 0)  {
            parser->error_code = HTTP_MESSAGE_PARSE_ERROR_BROKEN_STREAM;
            parser->error = "Broken stream";
        } else {
            parser->error_code = HTTP_MESSAGE_PARSE_ERROR_BROKEN_MESSAGE;
            parser->error = t_strdup_printf("Failed to parse header: %s", error);
        }

    }
    return ret;
}

static const char *
http_istream_error_callback(const struct istream_sized_error_data *data,
                struct istream *input)
{
    i_assert(data->eof);
    i_assert(data->v_offset + data->new_bytes < data->wanted_size);

    return t_strdup_printf("Disconnected while reading response payload at offset %"PRIuUOFF_T
        " (wanted %"PRIuUOFF_T"): %s", data->v_offset + data->new_bytes,
        data->wanted_size, io_stream_get_disconnect_reason(input, NULL));
}

int http_message_parse_body(struct http_message_parser *parser, bool request)
{
    struct istream *input;

    i_assert(parser->payload == NULL);

    parser->error_code = HTTP_MESSAGE_PARSE_ERROR_NONE;
    parser->error = NULL;

    if (array_is_created(&parser->msg.transfer_encoding)) {
        const struct http_transfer_coding *coding;

        bool chunked_last = FALSE;

        array_foreach(&parser->msg.transfer_encoding, coding) {
            if (strcasecmp(coding->name, "chunked") == 0) {
                chunked_last = TRUE;

                if ((parser->error_code == HTTP_MESSAGE_PARSE_ERROR_NONE)
                    && array_is_created(&coding->parameters)
                    && array_count(&coding->parameters) > 0) {
                    const struct http_transfer_param *param =
                        array_idx(&coding->parameters, 0);

                    parser->error_code = HTTP_MESSAGE_PARSE_ERROR_BAD_MESSAGE;
                    parser->error = t_strdup_printf(
                        "Unexpected parameter `%s' specified"
                        "for the `%s' transfer coding", param->attribute, coding->name);
                    /* recoverable */
                }
            } else if (chunked_last) {
                parser->error_code = HTTP_MESSAGE_PARSE_ERROR_BROKEN_MESSAGE;
                parser->error = "Chunked Transfer-Encoding must be last";
                return -1;
            } else if (parser->error_code == HTTP_MESSAGE_PARSE_ERROR_NONE) {
                parser->error_code = HTTP_MESSAGE_PARSE_ERROR_NOT_IMPLEMENTED;
                parser->error = t_strdup_printf(
                "Unknown transfer coding `%s'", coding->name);
                /* recoverable */
        }
    }

        if (chunked_last) {
            parser->payload = http_transfer_chunked_istream_create
                (parser->input, parser->max_payload_size);
        } else if (!request) {
            /* RFC 7230, Section 3.3.3: Message Body Length

               If a Transfer-Encoding header field is present in a response and
               the chunked transfer coding is not the final encoding, the
               message body length is determined by reading the connection until
               it is closed by the server.
             */
            /* FIXME: enforce max payload size (relevant to http-client only) */
            parser->payload =
                    i_stream_create_limit(parser->input, (size_t)-1);
        } else {
            /* RFC 7230, Section 3.3.3: Message Body Length

               If a Transfer-Encoding header field is present in a request and
               the chunked transfer coding is not the final encoding, the
               message body length cannot be determined reliably; the server
               MUST respond with the 400 (Bad Request) status code and then
               close the connection.
             */
            parser->error_code = HTTP_MESSAGE_PARSE_ERROR_BROKEN_MESSAGE;
            parser->error = "Final Transfer-Encoding in request is not chunked";
            return -1;
        }

        /* RFC 7230, Section 3.3.3: Message Body Length

           If a message is received with both a Transfer-Encoding and a
           Content-Length header field, the Transfer-Encoding overrides the
           Content-Length.  Such a message might indicate an attempt to
           perform request smuggling (Section 9.5 of [RFC7230]) or response
           splitting (Section 9.4 of [RFC7230]) and ought to be handled as
           an error.  A sender MUST remove the received Content-Length field
           prior to forwarding such a message downstream.
         */
        // FIXME: make this an error?
        if (parser->msg.have_content_length)
            http_header_field_delete(parser->msg.header, "Content-Length");

    } else if (parser->msg.content_length > 0) {
        if (parser->max_payload_size > 0
            && parser->msg.content_length > parser->max_payload_size) {
            parser->error_code = HTTP_MESSAGE_PARSE_ERROR_PAYLOAD_TOO_LARGE;
            parser->error = "Payload is too large";
            return -1;
        }

        /* Got explicit message size from Content-Length: header */
        input = i_stream_create_limit(parser->input,
                          parser->msg.content_length);
        /* Make sure we return failure if HTTP connection closes before
           we've finished reading the full input. */
        parser->payload = i_stream_create_sized_with_callback(input,
                    parser->msg.content_length,
                    http_istream_error_callback, input);
        i_stream_unref(&input);
    } else if (!parser->msg.have_content_length && !request) {
        /* RFC 7230, Section 3.3.3: Message Body Length

           6.  If this is a request message and none of the above are true, then
               the message body length is zero (no message body is present).

           7.  Otherwise, this is a response message without a declared message
               body length, so the message body length is determined by the
               number of octets received prior to the server closing the
               connection
         */
        // FIXME: enforce max payload size (relevant to http-client only)
        // FIXME: handle request case correctly.
        parser->payload =
            i_stream_create_limit(parser->input, (size_t)-1);
    }
    if (parser->error_code != HTTP_MESSAGE_PARSE_ERROR_NONE)
        return -1;
    return 0;
}