http_protocol.c revision fc251eb7714d158c2952bc2ddbbcfb9169098212
* Code originally by Rob McCool; much redone by Robert S. Thau * and the Apache Software Foundation. #
include "http_log.h" /* For errors detected in basic auth common#
include "apr_date.h" /* For apr_date_parse_http and APR_DATE_BAD *//* New Apache routine to map status codes into array indicies * e.g. 100 -> 0, 101 -> 1, 200 -> 2 ... * The number of status lines must equal the value of * RESPONSE_CODES (httpd.h) and must be listed in order. * No gaps are allowed between X00 and the largest Xnn * for any X (see ap_index_of_response). * When adding a new code here, add a define to httpd.h "101 Switching Protocols",
"203 Non-Authoritative Information",
"307 Temporary Redirect",
"308 Permanent Redirect",
"405 Method Not Allowed",
"407 Proxy Authentication Required",
"412 Precondition Failed",
"413 Request Entity Too Large",
"414 Request-URI Too Long",
"415 Unsupported Media Type",
"416 Requested Range Not Satisfiable",
"417 Expectation Failed",
"422 Unprocessable Entity",
"428 Precondition Required",
"431 Request Header Fields Too Large",
"500 Internal Server Error",
"503 Service Unavailable",
"505 HTTP Version Not Supported",
"506 Variant Also Negotiates",
"507 Insufficient Storage",
"511 Network Authentication Required" /* The index of the first bit field that is used to index into a limit * bitmask. M_INVALID + 1 to METHOD_NUMBER_LAST. /* The max method number. Method numbers are used to shift bitmasks, * so this cannot exceed 63, and all bits high is equal to -1, which is a * special flag, so the last bit used has index 62. /* The following convoluted conditional determines whether or not * the current connection should remain persistent after this response * (a.k.a. HTTP Keep-Alive) and whether or not the output message * body should use the HTTP/1.1 chunked transfer-coding. In English, * IF we have not marked this connection as errored; * and the client isn't expecting 100-continue (PR47087 - more * input here could be the client continuing when we're * and the response body has a defined length due to the status code * being 304 or 204, the request method being HEAD, already * having defined Content-Length or Transfer-Encoding: chunked, or * the request version being HTTP/1.1 and thus capable of being set * as chunked [we know the (r->chunked = 1) side-effect is ugly]; * and the server configuration enables keep-alive; * and the server configuration has a reasonable inter-request timeout; * and there is no maximum # requests or the max hasn't been reached; * and the response status does not require a close; * and the response generator has not already indicated close; * and the client did not request non-persistence (Connection: close); * and we haven't been configured to ignore the buggy twit * or they're a buggy twit coming through a HTTP/1.1 proxy * and the client is requesting an HTTP/1.0-style keep-alive * or the client claims to be HTTP/1.1 compliant (perhaps a proxy); * and this MPM process is not already exiting * THEN we can be persistent, which requires more headers be output. * Note that the condition evaluation order is extremely important. && (r->
chunked =
1)))
/* THIS CODE IS CORRECT, see above. */ /* If they sent a Keep-Alive token, send one back */ /* Otherwise, we need to indicate that we will be closing this * connection immediately after the current response. * We only really need to send "close" to HTTP/1.1 clients, but we * always send it anyway, because a broken proxy may identify itself * as HTTP/1.0, but pass our request along with our HTTP/1.1 tag * to a HTTP/1.1 client. Better safe than sorry. * If we had previously been a keepalive connection and this * is the last one, then bump up the number of keepalives /* Check for conditional requests --- note that we only want to do * this if we are successful so far and we are not processing a * subrequest or an ErrorDocument. * The order of the checks is important, since ETag checks are supposed * to be more accurate than checks relative to the modification time. * However, not all documents are guaranteed to *have* ETags, and some * might have Last-Modified values w/o ETags, so this gets a little /* All of our comparisons must be in seconds, because that's the * highest time resolution the HTTP specification allows. /* XXX: we should define a "time unset" constant */ /* If an If-Match request-header field was given * AND the field value is not "*" (meaning match anything) * AND if our strong ETag does not match any entity tag in that field, * respond with a status of 412 (Precondition Failed). /* Else if a valid If-Unmodified-Since request-header field was given * AND the requested resource has been modified since the time * specified in this field, then the server MUST * respond with a status of 412 (Precondition Failed). /* If an If-None-Match request-header field was given * AND the field value is "*" (meaning match anything) * OR our ETag matches any of the entity tags in that field, fail. * If the request method was GET or HEAD, failure means the server * SHOULD respond with a 304 (Not Modified) response. * For all other request methods, failure means the server MUST * respond with a status of 412 (Precondition Failed). * GET or HEAD allow weak etag comparison, all other methods require * strong comparison. We can only use weak if it's not a range request. /* If a valid If-Modified-Since request-header field was given * AND it is a GET or HEAD request * AND the requested resource has not been modified since the time * specified in this field, then the server MUST * respond with a status of 304 (Not Modified). * A date later than the server's current request time is invalid. "If-Modified-Since")) !=
NULL) {
* Singleton registry of additional methods. This maps new method names * such as "MYGET" to methnums, which are int offsets into bitmasks. * This follows the same technique as standard M_GET, M_POST, etc. These * are dynamically assigned when modules are loaded and <Limit GET MYGET> * directives are processed. /* This internal function is used to clear the method registry * and reset the cur_method_number counter. /* put all the standard methods into the registry hash to ease the mapping operations between name and number */ /* Check if the method was previously registered. If it was * return the associated method number. /* The method registry has run out of dynamically * assignable method numbers. Log this and return M_INVALID. "Maximum new request methods %d reached while " "registering method %s.",
/* Note: the following code was generated by the "shilka" tool from based on analysis of the input keywords. Postprocessing was done on the shilka output, but the basic structure and analysis is from there. Should new HTTP methods be added, then manual insertion into this code is fine, or simply re-running the shilka tool on the appropriate input. */ /* Note: it is also quite reasonable to just use our method_registry, but I'm assuming (probably incorrectly) we want more speed here (based on the optimizations the previous code was doing). */ /* Get the method number associated with the given string, assumed to * contain an HTTP method. Returns M_INVALID if not recognized. * This is the first step toward placing method names in a configurable * list. Hopefully it (and other routines) can eventually be moved to /* check if the method has been dynamically registered */ * Turn a known method number into a name. /* scan through the hash table, looking for a value that matches the provided method number. */ /* it wasn't found in the hash */ /* The index is found by its offset from the x00 code of each level. * Although this is fast, it will need to be replaced if some nutcase * decides to define a high-numbered code before the lower numbers. * If that sad event occurs, replace the code below with a linear search * from status_lines[shortcut[i]] to status_lines[shortcut[i+1]-1]; * or use NULL to fill the gaps. if (
status <
100) {
/* Below 100 is illegal for HTTP status */ for (i = 0; i <
5; i++) {
return LEVEL_500;
/* status unknown (falls in gap) */ return LEVEL_500;
/* 600 or above is also illegal */ /* Build the Allow field-value from the request handler method mask. /* the M_GET method actually refers to two methods */ /* TRACE is tested on a per-server basis */ /* ### this is rather annoying. we should enforce registration of /* the request finalization will send an EOS, which will flush all * the headers out (including the Allow header) /* construct and return the default error message for a given * HTTP defined error code "<p>The document has moved <a href=\"",
"<p>The answer to your request is located " "<p>This resource is only accessible " "<br />\nYou will need to configure " "your client to use that proxy.</p>\n",
return(
"<p>This server could not verify that you\n" "are authorized to access the document\n" "requested. Either you supplied the wrong\n" "credentials (e.g., bad password), or your\n" "browser doesn't understand how to supply\n" "the credentials required.</p>\n");
"<p>Your browser sent a request that " "this server could not understand.<br />\n",
"<p>You don't have permission to access ",
"\non this server.</p>\n",
" was not found on this server.</p>\n",
"<p>The requested method ",
" is not allowed for the URL ",
"<p>An appropriate representation of the " " could not be found on this server.</p>\n",
"<p>A request of the requested method ",
" requires a valid Content-length.<br />\n",
"<p>The precondition on the request " " evaluated to false.</p>\n",
" not supported.<br />\n",
s1 =
"<p>The proxy server received an invalid" CRLF "response from an upstream server.<br />" CRLF;
"<p>A variant for the requested " "\n</pre>\nis itself a negotiable resource. " "This indicates a configuration error.</p>\n",
return(
"<p>Server timeout waiting for the HTTP request from the client.</p>\n");
"<p>The requested resource<br />",
"<br />\nis no longer available on this server " "and there is no forwarding address.\n" "Please remove all references to this " "The requested resource<br />",
"does not allow request data with ",
" requests, or the amount of data provided in\n" "the request exceeds the capacity limit.\n",
s1 =
"<p>The requested URL's length exceeds the capacity\n" "limit for this server.<br />\n";
return(
"<p>The supplied request data is not in a format\n" "acceptable for processing by this resource.</p>\n");
return(
"<p>None of the range-specifier values in the Range\n" "request-header field overlap the current extent\n" "of the selected resource.</p>\n");
"<p>The expectation given in the Expect request-header\n" "field could not be met by this server.\n" "The client sent<pre>\n Expect: ",
s1 =
"<p>No expectation was seen, the Expect request-header \n" "field was not presented by the client.\n";
"<p>Only the 100-continue expectation is supported.</p>\n");
return(
"<p>The server understands the media type of the\n" "request entity, but was unable to process the\n" "contained instructions.</p>\n");
return(
"<p>The requested resource is currently locked.\n" "The lock must be released or proper identification\n" "given before the method can be applied.</p>\n");
return(
"<p>The method could not be performed on the resource\n" "because the requested action depended on another\n" "action and that other action failed.</p>\n");
return(
"<p>The requested resource can only be retrieved\n" "using SSL. The server is willing to upgrade the current\n" "connection to SSL, but your client doesn't support it.\n" "Either upgrade your client, or try requesting the page\n" return(
"<p>The request is required to be conditional.</p>\n");
return(
"<p>The user has sent too many requests\n" "in a given amount of time.</p>\n");
return(
"<p>The server refused this request because\n" "the request header fields are too large.</p>\n");
return(
"<p>The method could not be performed on the resource\n" "because the server is unable to store the\n" "representation needed to successfully complete the\n" "request. There is insufficient free space left in\n" "your storage allocation.</p>\n");
return(
"<p>The server is temporarily unable to service your\n" "request due to maintenance downtime or capacity\n" "problems. Please try again later.</p>\n");
return(
"<p>The gateway did not receive a timely response\n" "from the upstream server or application.</p>\n");
return(
"<p>The server terminated an operation because\n" "it encountered an infinite loop.</p>\n");
return(
"<p>A mandatory extension policy in the request is not\n" "accepted by the server for this resource.</p>\n");
return(
"<p>The client needs to authenticate to gain\n" "network access.</p>\n");
default:
/* HTTP_INTERNAL_SERVER_ERROR */ * This comparison to expose error-notes could be modified to * use a configuration directive and export based on that * directive. For now "*" is used to designate an error-notes * that is totally safe for any user to see (ie lacks paths, * database passwords, etc.) "<p>The server encountered an internal " "misconfiguration and was unable to complete\n" "<p>Please contact the server " " to inform them of the time this " " and the actions you performed just before " "<p>More information about this error " "in the server error log.</p>\n",
* It would be nice to give the user the information they need to * fix the problem directly since many users don't have access to * the error_log (think University sites) even though they can easily * get this error by misconfiguring an htaccess file. However, the * e error notes tend to include the real file pathname in this case, * which some people consider to be a breach of privacy. Until we * can figure out a way to remove the pathname, leave this commented. * if ((error_notes = apr_table_get(r->notes, * "error-notes")) != NULL) { * return(apr_pstrcat(p, error_notes, "<p />\n", NULL); /* We should have named this send_canned_response, since it is used for any * response that can be generated by the server from the request record. * This includes all 204 (no content), 3xx (redirect), 4xx (client error), * and 5xx (server error) messages that have not been redirected to another * handler via the ErrorDocument feature. /* At this point, we are starting the response over, so we have to reset /* and we need to get rid of any RESOURCE filters that might be lurking * around, thinking they are in the middle of the original request * It's possible that the Location field might be in r->err_headers_out * instead of r->headers_out; use the latter if possible, else the /* We need to special-case the handling of 204 and 304 responses, * since they have specific HTTP requirements and do not include a * message body. Note that being assbackwards here is not an option. /* For all HTTP/1.x responses for which we generate the message, * we need to avoid inheriting the "normal status" header fields * that may have been set by the request handler before the * error or redirect, except for Location on external redirects. location =
"";
/* avoids coredump when printing, below */ "suppress-error-charset") !=
NULL) {
* We have a custom response output. This should only be * a text-string to write back. But if the ErrorDocument * was a local redirect and the requested resource failed * for any reason, the custom_response will still hold the * redirect URL. We don't really want to output this URL * as a text message, so first check the custom response * string to ensure that it is a text-string (using the * same test used in ap_die(), i.e. does it start with a "). * If it's not a text string, we've got a recursive error or * an external redirect. If it's a recursive error, ap_die passes * us the second error code so we can write both, and has already * backed up to the original error. If it's an external redirect, * it hasn't happened yet; we may never know if it fails. /* Accept a status_line set by a module, but only if it begins * with the correct 3 digit status code /* Since we passed the above check, we know that length three * is equivalent to only a 3 digit numeric http status. * RFC2616 mandates a trailing space, let's add it. * If we have an empty reason phrase, we also add "Unknown Reason". /* folks decided they didn't want the error code in the H1 text */ /* can't count on a charset filter being in place here, * so do ebcdic->ascii translation explicitly (if needed) "<html><head>\n<title>",
title,
"</title>\n</head><body>\n<h1>",
h1,
"</h1>\n",
"\nerror was encountered while trying to use an " "ErrorDocument to handle the request.</p>\n",
NULL);
* Create a new method list with the specified number of preallocated * Make a copy of a method list (primarily for subrequests that may * subsequently change it; don't want them changing the parent's, too!). * Return true if the specified HTTP method is in the provided * If it's one of our known methods, use the shortcut and check the * Otherwise, see if the method name is in the array or string names * Add the specified method to a method list (if it isn't already there). * If it's one of our known methods, use the shortcut and use the * Otherwise, see if the method name is in the array of string names. * Remove the specified method from a method list. * If it's a known methods, either builtin or registered * by a module, use the bitmask. * Otherwise, see if the method name is in the array of string names. * Reset a method list to be completely empty.