src/client_side.h

   1 /*
   2  * Copyright (C) 1996-2017 The Squid Software Foundation and contributors
   3  *
   4  * Squid software is distributed under GPLv2+ license and includes
   5  * contributions from numerous individuals and organizations.
   6  * Please see the COPYING and CONTRIBUTORS files for details.
   7  */
   8
   9 /* DEBUG: section 33    Client-side Routines */
  10
  11 #ifndef SQUID_CLIENTSIDE_H
  12 #define SQUID_CLIENTSIDE_H
  13
  14 #include "base/RunnersRegistry.h"
  15 #include "clientStreamForward.h"
  16 #include "comm.h"
  17 #include "helper/forward.h"
  18 #include "http/forward.h"
  19 #include "HttpControlMsg.h"
  20 #include "ipc/FdNotes.h"
  21 #include "sbuf/SBuf.h"
  22 #include "servers/Server.h"
  23 #if USE_AUTH
  24 #include "auth/UserRequest.h"
  25 #endif
  26 #if USE_OPENSSL
  27 #include "security/Handshake.h"
  28 #include "ssl/support.h"
  29 #endif
  30 #if USE_DELAY_POOLS
  31 #include "MessageBucket.h"
  32 #endif
  33
  34 #include <iosfwd>
  35
  36 class ClientHttpRequest;
  37 class HttpHdrRangeSpec;
  38
  39 class MasterXaction;
  40 typedef RefCount<MasterXaction> MasterXactionPointer;
  41
  42 #if USE_OPENSSL
  43 namespace Ssl
  44 {
  45 class ServerBump;
  46 }
  47 #endif
  48
  49 /**
  50  * Legacy Server code managing a connection to a client.
  51  *
  52  * NP: presents AsyncJob API but does not operate autonomously as a Job.
  53  *     So Must() is not safe to use.
  54  *
  55  * Multiple requests (up to pipeline_prefetch) can be pipelined.
  56  * This object is responsible for managing which one is currently being
  57  * fulfilled and what happens to the queue if the current one causes the client
  58  * connection to be closed early.
  59  *
  60  * Act as a manager for the client connection and passes data in buffer to a
  61  * Parser relevant to the state (message headers vs body) that is being
  62  * processed.
  63  *
  64  * Performs HTTP message processing to kick off the actual HTTP request
  65  * handling objects (Http::Stream, ClientHttpRequest, HttpRequest).
  66  *
  67  * Performs SSL-Bump processing for switching between HTTP and HTTPS protocols.
  68  *
  69  * To terminate a ConnStateData close() the client Comm::Connection it is
  70  * managing, or for graceful half-close use the stopReceiving() or
  71  * stopSending() methods.
  72  */
  73 class ConnStateData : public Server, public HttpControlMsgSink, private IndependentRunner
  74 {
  75
  76 public:
  77     explicit ConnStateData(const MasterXactionPointer &xact);
  78     virtual ~ConnStateData();
  79
  80     /* ::Server API */
  81     virtual void receivedFirstByte();
  82     virtual bool handleReadData();
  83     virtual void afterClientRead();
  84     virtual void afterClientWrite(size_t);
  85
  86     /* HttpControlMsgSink API */
  87     virtual void sendControlMsg(HttpControlMsg);
  88     virtual void doneWithControlMsg();
  89
  90     /// Traffic parsing
  91     bool clientParseRequests();
  92     void readNextRequest();
  93
  94     /// try to make progress on a transaction or read more I/O
  95     void kick();
  96
  97     bool isOpen() const;
  98
  99     Http1::TeChunkedParser *bodyParser; ///< parses HTTP/1.1 chunked request body
 100
 101     /** number of body bytes we need to comm_read for the "current" request
 102      *
 103      * \retval 0         We do not need to read any [more] body bytes
 104      * \retval negative  May need more but do not know how many; could be zero!
 105      * \retval positive  Need to read exactly that many more body bytes
 106      */
 107     int64_t mayNeedToReadMoreBody() const;
 108
 109 #if USE_AUTH
 110     /**
 111      * Fetch the user details for connection based authentication
 112      * NOTE: this is ONLY connection based because NTLM and Negotiate is against HTTP spec.
 113      */
 114     const Auth::UserRequest::Pointer &getAuth() const { return auth_; }
 115
 116     /**
 117      * Set the user details for connection-based authentication to use from now until connection closure.
 118      *
 119      * Any change to existing credentials shows that something invalid has happened. Such as:
 120      * - NTLM/Negotiate auth was violated by the per-request headers missing a revalidation token
 121      * - NTLM/Negotiate auth was violated by the per-request headers being for another user
 122      * - SSL-Bump CONNECT tunnel with persistent credentials has ended
 123      */
 124     void setAuth(const Auth::UserRequest::Pointer &aur, const char *cause);
 125 #endif
 126
 127     Ip::Address log_addr;
 128
 129     struct {
 130         bool readMore; ///< needs comm_read (for this request or new requests)
 131         bool swanSang; // XXX: temporary flag to check proper cleanup
 132     } flags;
 133     struct {
 134         Comm::ConnectionPointer serverConnection; /* pinned server side connection */
 135         char *host;             /* host name of pinned connection */
 136         int port;               /* port of pinned connection */
 137         bool pinned;             /* this connection was pinned */
 138         bool auth;               /* pinned for www authentication */
 139         bool reading;   ///< we are monitoring for peer connection closure
 140         bool zeroReply; ///< server closed w/o response (ERR_ZERO_SIZE_OBJECT)
 141         CachePeer *peer;             /* CachePeer the connection goes via */
 142         AsyncCall::Pointer readHandler; ///< detects serverConnection closure
 143         AsyncCall::Pointer closeHandler; /*The close handler for pinned server side connection*/
 144     } pinning;
 145
 146     bool transparent() const;
 147
 148     /// true if we stopped receiving the request
 149     const char *stoppedReceiving() const { return stoppedReceiving_; }
 150     /// true if we stopped sending the response
 151     const char *stoppedSending() const { return stoppedSending_; }
 152     /// note request receiving error and close as soon as we write the response
 153     void stopReceiving(const char *error);
 154     /// note response sending error and close as soon as we read the request
 155     void stopSending(const char *error);
 156
 157     void expectNoForwarding(); ///< cleans up virgin request [body] forwarding state
 158
 159     /* BodyPipe API */
 160     BodyPipe::Pointer expectRequestBody(int64_t size);
 161     virtual void noteMoreBodySpaceAvailable(BodyPipe::Pointer) = 0;
 162     virtual void noteBodyConsumerAborted(BodyPipe::Pointer) = 0;
 163
 164     bool handleRequestBodyData();
 165
 166     /// parameters for the async notePinnedConnectionBecameIdle() call
 167     class PinnedIdleContext
 168     {
 169     public:
 170         PinnedIdleContext(const Comm::ConnectionPointer &conn, const HttpRequest::Pointer &req): connection(conn), request(req) {}
 171
 172         Comm::ConnectionPointer connection; ///< to-server connection to be pinned
 173         HttpRequest::Pointer request; ///< to-server request that initiated serverConnection
 174     };
 175
 176     /// Called when a pinned connection becomes available for forwarding the next request.
 177     void notePinnedConnectionBecameIdle(PinnedIdleContext pic);
 178     /// Forward future client requests using the given to-server connection.
 179     /// The connection is still being used by the current client request.
 180     void pinBusyConnection(const Comm::ConnectionPointer &pinServerConn, const HttpRequest::Pointer &request);
 181     /// Undo pinConnection() and, optionally, close the pinned connection.
 182     void unpinConnection(const bool andClose);
 183     /// Returns validated pinnned server connection (and stops its monitoring).
 184     Comm::ConnectionPointer borrowPinnedConnection(HttpRequest *request, const CachePeer *aPeer);
 185     /**
 186      * Checks if there is pinning info if it is valid. It can close the server side connection
 187      * if pinned info is not valid.
 188      \param request   if it is not NULL also checks if the pinning info refers to the request client side HttpRequest
 189      \param CachePeer      if it is not NULL also check if the CachePeer is the pinning CachePeer
 190      \return          The details of the server side connection (may be closed if failures were present).
 191      */
 192     const Comm::ConnectionPointer validatePinnedConnection(HttpRequest *request, const CachePeer *peer);
 193     /**
 194      * returts the pinned CachePeer if exists, NULL otherwise
 195      */
 196     CachePeer *pinnedPeer() const {return pinning.peer;}
 197     bool pinnedAuth() const {return pinning.auth;}
 198
 199     /// called just before a FwdState-dispatched job starts using connection
 200     virtual void notePeerConnection(Comm::ConnectionPointer) {}
 201
 202     // pining related comm callbacks
 203     virtual void clientPinnedConnectionClosed(const CommCloseCbParams &io);
 204
 205     // comm callbacks
 206     void clientReadFtpData(const CommIoCbParams &io);
 207     void connStateClosed(const CommCloseCbParams &io);
 208     void requestTimeout(const CommTimeoutCbParams &params);
 209
 210     // AsyncJob API
 211     virtual void start();
 212     virtual bool doneAll() const { return BodyProducer::doneAll() && false;}
 213     virtual void swanSong();
 214
 215     /// Changes state so that we close the connection and quit after serving
 216     /// the client-side-detected error response instead of getting stuck.
 217     void quitAfterError(HttpRequest *request); // meant to be private
 218
 219     /// The caller assumes responsibility for connection closure detection.
 220     void stopPinnedConnectionMonitoring();
 221
 222 #if USE_OPENSSL
 223     /// the second part of old httpsAccept, waiting for future HttpsServer home
 224     void postHttpsAccept();
 225
 226     /// Initializes and starts a peek-and-splice negotiation with the SSL client
 227     void startPeekAndSplice();
 228
 229     /// Called when a peek-and-splice step finished. For example after
 230     /// server SSL certificates received and fake server SSL certificates
 231     /// generated
 232     void doPeekAndSpliceStep();
 233     /// called by FwdState when it is done bumping the server
 234     void httpsPeeked(PinnedIdleContext pic);
 235
 236     /// Splice a bumped client connection on peek-and-splice mode
 237     bool splice();
 238
 239     /// Start to create dynamic Security::ContextPointer for host or uses static port SSL context.
 240     void getSslContextStart();
 241     /**
 242      * Done create dynamic ssl certificate.
 243      *
 244      * \param[in] isNew if generated certificate is new, so we need to add this certificate to storage.
 245      */
 246     void getSslContextDone(Security::ContextPointer &, bool isNew = false);
 247     /// Callback function. It is called when squid receive message from ssl_crtd.
 248     static void sslCrtdHandleReplyWrapper(void *data, const Helper::Reply &reply);
 249     /// Proccess response from ssl_crtd.
 250     void sslCrtdHandleReply(const Helper::Reply &reply);
 251
 252     void switchToHttps(HttpRequest *request, Ssl::BumpMode bumpServerMode);
 253     void parseTlsHandshake();
 254     bool switchedToHttps() const { return switchedToHttps_; }
 255     Ssl::ServerBump *serverBump() {return sslServerBump;}
 256     inline void setServerBump(Ssl::ServerBump *srvBump) {
 257         if (!sslServerBump)
 258             sslServerBump = srvBump;
 259         else
 260             assert(sslServerBump == srvBump);
 261     }
 262     const SBuf &sslCommonName() const {return sslCommonName_;}
 263     void resetSslCommonName(const char *name) {sslCommonName_ = name;}
 264     const SBuf &tlsClientSni() const { return tlsClientSni_; }
 265     /// Fill the certAdaptParams with the required data for certificate adaptation
 266     /// and create the key for storing/retrieve the certificate to/from the cache
 267     void buildSslCertGenerationParams(Ssl::CertificateProperties &certProperties);
 268     /// Called when the client sends the first request on a bumped connection.
 269     /// Returns false if no [delayed] error should be written to the client.
 270     /// Otherwise, writes the error to the client and returns true. Also checks
 271     /// for SQUID_X509_V_ERR_DOMAIN_MISMATCH on bumped requests.
 272     bool serveDelayedError(Http::Stream *);
 273
 274     Ssl::BumpMode sslBumpMode; ///< ssl_bump decision (Ssl::bumpEnd if n/a).
 275
 276     /// Tls parser to use for client HELLO messages parsing on bumped
 277     /// connections.
 278     Security::HandshakeParser tlsParser;
 279 #else
 280     bool switchedToHttps() const { return false; }
 281 #endif
 282
 283     /// handle a control message received by context from a peer and call back
 284     virtual bool writeControlMsgAndCall(HttpReply *rep, AsyncCall::Pointer &call) = 0;
 285
 286     /// ClientStream calls this to supply response header (once) and data
 287     /// for the current Http::Stream.
 288     virtual void handleReply(HttpReply *header, StoreIOBuffer receivedData) = 0;
 289
 290     /// remove no longer needed leading bytes from the input buffer
 291     void consumeInput(const size_t byteCount);
 292
 293     /* TODO: Make the methods below (at least) non-public when possible. */
 294
 295     /// stop parsing the request and create context for relaying error info
 296     Http::Stream *abortRequestParsing(const char *const errUri);
 297
 298     /// generate a fake CONNECT request with the given payload
 299     /// at the beginning of the client I/O buffer
 300     bool fakeAConnectRequest(const char *reason, const SBuf &payload);
 301
 302     /// generates and sends to tunnel.cc a fake request with a given payload
 303     bool initiateTunneledRequest(HttpRequest::Pointer const &cause, Http::MethodType const method, const char *reason, const SBuf &payload);
 304
 305     /// whether tunneling of unsupported protocol is allowed for this connection
 306     bool mayTunnelUnsupportedProto();
 307
 308     /// build a fake http request
 309     ClientHttpRequest *buildFakeRequest(Http::MethodType const method, SBuf &useHost, unsigned short usePort, const SBuf &payload);
 310
 311     /// client data which may need to forward as-is to server after an
 312     /// on_unsupported_protocol tunnel decision.
 313     SBuf preservedClientData;
 314
 315     /* Registered Runner API */
 316     virtual void startShutdown();
 317     virtual void endingShutdown();
 318
 319     /// \returns existing non-empty connection annotations,
 320     /// creates and returns empty annotations otherwise
 321     NotePairs::Pointer notes();
 322     bool hasNotes() const { return bool(theNotes) && !theNotes->empty(); }
 323
 324 protected:
 325     void startDechunkingRequest();
 326     void finishDechunkingRequest(bool withSuccess);
 327     void abortChunkedRequestBody(const err_type error);
 328     err_type handleChunkedRequestBody();
 329
 330     void startPinnedConnectionMonitoring();
 331     void clientPinnedConnectionRead(const CommIoCbParams &io);
 332 #if USE_OPENSSL
 333     /// Handles a ready-for-reading TLS squid-to-server connection that
 334     /// we thought was idle.
 335     /// \return false if and only if the connection should be closed.
 336     bool handleIdleClientPinnedTlsRead();
 337 #endif
 338
 339     /// parse input buffer prefix into a single transfer protocol request
 340     /// return NULL to request more header bytes (after checking any limits)
 341     /// use abortRequestParsing() to handle parsing errors w/o creating request
 342     virtual Http::Stream *parseOneRequest() = 0;
 343
 344     /// start processing a freshly parsed request
 345     virtual void processParsedRequest(Http::StreamPointer &) = 0;
 346
 347     /// returning N allows a pipeline of 1+N requests (see pipeline_prefetch)
 348     virtual int pipelinePrefetchMax() const;
 349
 350     /// timeout to use when waiting for the next request
 351     virtual time_t idleTimeout() const = 0;
 352
 353     /// Perform client data lookups that depend on client src-IP.
 354     /// The PROXY protocol may require some data input first.
 355     void whenClientIpKnown();
 356
 357     BodyPipe::Pointer bodyPipe; ///< set when we are reading request body
 358
 359 private:
 360     /* ::Server API */
 361     virtual bool connFinishedWithConn(int size);
 362     virtual void checkLogging();
 363
 364     void clientAfterReadingRequests();
 365     bool concurrentRequestQueueFilled() const;
 366
 367     void pinConnection(const Comm::ConnectionPointer &pinServerConn, const HttpRequest &request);
 368
 369     /* PROXY protocol functionality */
 370     bool proxyProtocolValidateClient();
 371     bool parseProxyProtocolHeader();
 372     bool parseProxy1p0();
 373     bool parseProxy2p0();
 374     bool proxyProtocolError(const char *reason);
 375
 376     /// whether PROXY protocol header is still expected
 377     bool needProxyProtocolHeader_;
 378
 379 #if USE_AUTH
 380     /// some user details that can be used to perform authentication on this connection
 381     Auth::UserRequest::Pointer auth_;
 382 #endif
 383
 384     /// the parser state for current HTTP/1.x input buffer processing
 385     Http1::RequestParserPointer parser_;
 386
 387 #if USE_OPENSSL
 388     bool switchedToHttps_;
 389     bool parsingTlsHandshake; ///< whether we are getting/parsing TLS Hello bytes
 390
 391     /// The SSL server host name appears in CONNECT request or the server ip address for the intercepted requests
 392     String sslConnectHostOrIp; ///< The SSL server host name as passed in the CONNECT request
 393     SBuf sslCommonName_; ///< CN name for SSL certificate generation
 394
 395     /// TLS client delivered SNI value. Empty string if none has been received.
 396     SBuf tlsClientSni_;
 397     String sslBumpCertKey; ///< Key to use to store/retrieve generated certificate
 398
 399     /// HTTPS server cert. fetching state for bump-ssl-server-first
 400     Ssl::ServerBump *sslServerBump;
 401     Ssl::CertSignAlgorithm signAlgorithm; ///< The signing algorithm to use
 402 #endif
 403
 404     /// the reason why we no longer write the response or nil
 405     const char *stoppedSending_;
 406     /// the reason why we no longer read the request or nil
 407     const char *stoppedReceiving_;
 408     /// Connection annotations, clt_conn_tag and other tags are stored here.
 409     /// If set, are propagated to the current and all future master transactions
 410     /// on the connection.
 411     NotePairs::Pointer theNotes;
 412 };
 413
 414 void setLogUri(ClientHttpRequest * http, char const *uri, bool cleanUrl = false);
 415
 416 const char *findTrailingHTTPVersion(const char *uriAndHTTPVersion, const char *end = NULL);
 417
 418 int varyEvaluateMatch(StoreEntry * entry, HttpRequest * req);
 419
 420 /// accept requests to a given port and inform subCall about them
 421 void clientStartListeningOn(AnyP::PortCfgPointer &port, const RefCount< CommCbFunPtrCallT<CommAcceptCbPtrFun> > &subCall, const Ipc::FdNoteId noteId);
 422
 423 void clientOpenListenSockets(void);
 424 void clientConnectionsClose(void);
 425 void httpRequestFree(void *);
 426
 427 /// decide whether to expect multiple requests on the corresponding connection
 428 void clientSetKeepaliveFlag(ClientHttpRequest *http);
 429
 430 /// append a "part" HTTP header (as in a multi-part/range reply) to the buffer
 431 void clientPackRangeHdr(const HttpReplyPointer &, const HttpHdrRangeSpec *, String boundary, MemBuf *);
 432
 433 /// put terminating boundary for multiparts to the buffer
 434 void clientPackTermBound(String boundary, MemBuf *);
 435
 436 /* misplaced declaratrions of Stream callbacks provided/used by client side */
 437 SQUIDCEXTERN CSR clientGetMoreData;
 438 SQUIDCEXTERN CSS clientReplyStatus;
 439 SQUIDCEXTERN CSD clientReplyDetach;
 440 CSCB clientSocketRecipient;
 441 CSD clientSocketDetach;
 442
 443 /* TODO: Move to HttpServer. Warning: Move requires large code nonchanges! */
 444 Http::Stream *parseHttpRequest(ConnStateData *, const Http1::RequestParserPointer &);
 445 void clientProcessRequest(ConnStateData *, const Http1::RequestParserPointer &, Http::Stream *);
 446 void clientPostHttpsAccept(ConnStateData *);
 447
 448 std::ostream &operator <<(std::ostream &os, const ConnStateData::PinnedIdleContext &pic);
 449
 450 #endif /* SQUID_CLIENTSIDE_H */
 451