/*
- * Copyright 2001-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2001-2024 The OpenSSL Project Authors. All Rights Reserved.
* Copyright Siemens AG 2018-2020
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* https://www.openssl.org/source/license.html
*/
-#include "e_os.h"
+#include "internal/e_os.h"
#include <stdio.h>
#include <stdlib.h>
#include "crypto/ctype.h"
#include <openssl/cmperr.h>
#include <openssl/buffer.h>
#include <openssl/http.h>
+#include <openssl/trace.h>
#include "internal/sockets.h"
-#include "internal/cryptlib.h" /* for ossl_assert() */
-
-#include "http_local.h"
+#include "internal/common.h" /* for ossl_assert() */
#define HTTP_PREFIX "HTTP/"
#define HTTP_VERSION_PATT "1." /* allow 1.x */
+#define HTTP_VERSION_STR_LEN sizeof(HTTP_VERSION_PATT) /* == strlen("1.0") */
#define HTTP_PREFIX_VERSION HTTP_PREFIX""HTTP_VERSION_PATT
#define HTTP_1_0 HTTP_PREFIX_VERSION"0" /* "HTTP/1.0" */
-#define HTTP_VERSION_PATT_LEN strlen(HTTP_PREFIX_VERSION)
-#define HTTP_VERSION_STR_LEN (HTTP_VERSION_PATT_LEN + 1)
-#define HTTP_LINE1_MINLEN ((int)strlen(HTTP_PREFIX_VERSION "x 200\n"))
+#define HTTP_LINE1_MINLEN (sizeof(HTTP_PREFIX_VERSION "x 200\n") - 1)
#define HTTP_VERSION_MAX_REDIRECTIONS 50
#define HTTP_STATUS_CODE_OK 200
struct ossl_http_req_ctx_st {
int state; /* Current I/O state */
- unsigned char *readbuf; /* Buffer for reading response by line */
- int readbuflen; /* Buffer length, equals buf_size */
+ unsigned char *buf; /* Buffer to write request or read response */
+ int buf_size; /* Buffer size */
int free_wbio; /* wbio allocated internally, free with ctx */
BIO *wbio; /* BIO to write/send request to */
BIO *rbio; /* BIO to read/receive response from */
void *upd_arg; /* Optional arg for update callback function */
int use_ssl; /* Use HTTPS */
char *proxy; /* Optional proxy name or URI */
- char *server; /* Optional server host name */
+ char *server; /* Optional server hostname */
char *port; /* Optional server port */
- BIO *mem; /* Memory BIO holding request and response */
+ BIO *mem; /* Mem BIO holding request header or response */
+ BIO *req; /* BIO holding the request provided by caller */
int method_POST; /* HTTP method is POST (else GET) */
+ int text; /* Request content type is (likely) text */
char *expected_ct; /* Optional expected Content-Type */
int expect_asn1; /* Response must be ASN.1-encoded */
- long len_to_send; /* Number of bytes in request still to send */
- unsigned long resp_len; /* Length of response */
- size_t max_resp_len; /* Maximum length of response */
+ unsigned char *pos; /* Current position sending data */
+ long len_to_send; /* Number of bytes still to send */
+ size_t resp_len; /* Length of response */
+ size_t max_resp_len; /* Maximum length of response, or 0 */
int keep_alive; /* Persistent conn. 0=no, 1=prefer, 2=require */
time_t max_time; /* Maximum end time of current transfer, or 0 */
time_t max_total_time; /* Maximum end time of total transfer, or 0 */
char *redirection_url; /* Location obtained from HTTP status 301/302 */
+ size_t max_hdr_lines; /* Max. number of http hdr lines, or 0 */
};
/* HTTP states */
-#define OHS_NOREAD 0x1000 /* If set no reading should be performed */
-#define OHS_ERROR (0 | OHS_NOREAD) /* Error condition */
-#define OHS_FIRSTLINE 1 /* First line being read */
-#define OHS_REDIRECT 0xa /* Looking for redirection location */
-#define OHS_HEADERS 2 /* MIME headers being read */
-#define OHS_ASN1_HEADER 3 /* HTTP initial header (tag+length) being read */
-#define OHS_CONTENT 4 /* HTTP content octets being read */
-#define OHS_WRITE_INIT (5 | OHS_NOREAD) /* 1st call: ready to start send */
-#define OHS_WRITE (6 | OHS_NOREAD) /* Request being sent */
-#define OHS_FLUSH (7 | OHS_NOREAD) /* Request being flushed */
-#define OHS_DONE (8 | OHS_NOREAD) /* Completed */
-#define OHS_HTTP_HEADER (9 | OHS_NOREAD) /* Headers set, w/o final \r\n */
+#define OHS_NOREAD 0x1000 /* If set no reading should be performed */
+#define OHS_ERROR (0 | OHS_NOREAD) /* Error condition */
+#define OHS_ADD_HEADERS (1 | OHS_NOREAD) /* Adding header lines to request */
+#define OHS_WRITE_INIT (2 | OHS_NOREAD) /* 1st call: ready to start send */
+#define OHS_WRITE_HDR1 (3 | OHS_NOREAD) /* Request header to be sent */
+#define OHS_WRITE_HDR (4 | OHS_NOREAD) /* Request header being sent */
+#define OHS_WRITE_REQ (5 | OHS_NOREAD) /* Request content being sent */
+#define OHS_FLUSH (6 | OHS_NOREAD) /* Request being flushed */
+#define OHS_FIRSTLINE 1 /* First line of response being read */
+#define OHS_HEADERS 2 /* MIME headers of response being read */
+#define OHS_HEADERS_ERROR 3 /* MIME headers of resp. being read after error */
+#define OHS_REDIRECT 4 /* MIME headers being read, expecting Location */
+#define OHS_ASN1_HEADER 5 /* ASN1 sequence header (tag+length) being read */
+#define OHS_ASN1_CONTENT 6 /* ASN1 content octets being read */
+#define OHS_ASN1_DONE (7 | OHS_NOREAD) /* ASN1 content read completed */
+#define OHS_STREAM (8 | OHS_NOREAD) /* HTTP content stream to be read */
/* Low-level HTTP API implementation */
if ((rctx = OPENSSL_zalloc(sizeof(*rctx))) == NULL)
return NULL;
rctx->state = OHS_ERROR;
- rctx->readbuflen = buf_size > 0 ? buf_size : HTTP_DEFAULT_MAX_LINE_LENGTH;
- rctx->readbuf = OPENSSL_malloc(rctx->readbuflen);
+ rctx->buf_size = buf_size > 0 ? buf_size : OSSL_HTTP_DEFAULT_MAX_LINE_LEN;
+ rctx->buf = OPENSSL_malloc(rctx->buf_size);
rctx->wbio = wbio;
rctx->rbio = rbio;
- if (rctx->readbuf == NULL) {
+ rctx->max_hdr_lines = OSSL_HTTP_DEFAULT_MAX_RESP_HDR_LINES;
+ if (rctx->buf == NULL) {
OPENSSL_free(rctx);
return NULL;
}
- rctx->max_resp_len = HTTP_DEFAULT_MAX_RESP_LEN;
+ rctx->max_resp_len = OSSL_HTTP_DEFAULT_MAX_RESP_LEN;
/* everything else is 0, e.g. rctx->len_to_send, or NULL, e.g. rctx->mem */
return rctx;
}
if (rctx->free_wbio)
BIO_free_all(rctx->wbio);
/* do not free rctx->rbio */
- BIO_free(rctx->mem); /* this may indirectly call ERR_clear_error() */
- OPENSSL_free(rctx->readbuf);
+ BIO_free(rctx->mem);
+ BIO_free(rctx->req);
+ OPENSSL_free(rctx->buf);
OPENSSL_free(rctx->proxy);
OPENSSL_free(rctx->server);
OPENSSL_free(rctx->port);
ERR_raise(ERR_LIB_HTTP, ERR_R_PASSED_NULL_PARAMETER);
return;
}
- rctx->max_resp_len = len != 0 ? (size_t)len : HTTP_DEFAULT_MAX_RESP_LEN;
+ rctx->max_resp_len = len != 0 ? (size_t)len : OSSL_HTTP_DEFAULT_MAX_RESP_LEN;
}
/*
* Create request line using |rctx| and |path| (or "/" in case |path| is NULL).
- * Server name (and port) must be given if and only if plain HTTP proxy is used.
+ * Server name (and optional port) must be given if and only if
+ * a plain HTTP proxy is used and |path| does not begin with 'http://'.
*/
int OSSL_HTTP_REQ_CTX_set_request_line(OSSL_HTTP_REQ_CTX *rctx, int method_POST,
const char *server, const char *port,
return 0;
}
- /* Make sure path includes a forward slash */
- if (path == NULL)
+ /* Make sure path includes a forward slash (abs_path) */
+ if (path == NULL) {
path = "/";
- if (path[0] != '/' && BIO_printf(rctx->mem, "/") <= 0)
+ } else if (HAS_PREFIX(path, "http://")) { /* absoluteURI for proxy use */
+ if (server != NULL) {
+ ERR_raise(ERR_LIB_HTTP, ERR_R_PASSED_INVALID_ARGUMENT);
+ return 0;
+ }
+ } else if (path[0] != '/' && BIO_printf(rctx->mem, "/") <= 0) {
return 0;
-
+ }
+ /*
+ * Add (the rest of) the path and the HTTP version,
+ * which is fixed to 1.0 for straightforward implementation of keep-alive
+ */
if (BIO_printf(rctx->mem, "%s "HTTP_1_0"\r\n", path) <= 0)
return 0;
+
rctx->resp_len = 0;
- rctx->state = OHS_HTTP_HEADER;
+ rctx->state = OHS_ADD_HEADERS;
return 1;
}
return 0;
}
if (keep_alive != 0
- && rctx->state != OHS_ERROR && rctx->state != OHS_HTTP_HEADER) {
+ && rctx->state != OHS_ERROR && rctx->state != OHS_ADD_HEADERS) {
/* Cannot anymore set keep-alive in request header */
ERR_raise(ERR_LIB_HTTP, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
return 0;
rctx->expect_asn1 = asn1;
if (timeout >= 0)
rctx->max_time = timeout > 0 ? time(NULL) + timeout : 0;
- else
+ else /* take over any |overall_timeout| arg of OSSL_HTTP_open(), else 0 */
rctx->max_time = rctx->max_total_time;
rctx->keep_alive = keep_alive;
return 1;
}
-static int ossl_http_req_ctx_set_content(OSSL_HTTP_REQ_CTX *rctx,
- const char *content_type, BIO *req_mem)
+static int set1_content(OSSL_HTTP_REQ_CTX *rctx,
+ const char *content_type, BIO *req)
{
- const unsigned char *req;
- long req_len;
+ long req_len = 0;
+#ifndef OPENSSL_NO_STDIO
+ FILE *fp = NULL;
+#endif
- if (rctx == NULL || (req_mem == NULL && content_type != NULL)) {
+ if (rctx == NULL || (req == NULL && content_type != NULL)) {
ERR_raise(ERR_LIB_HTTP, ERR_R_PASSED_NULL_PARAMETER);
return 0;
}
if (rctx->keep_alive != 0
&& !OSSL_HTTP_REQ_CTX_add1_header(rctx, "Connection", "keep-alive"))
return 0;
- rctx->state = OHS_WRITE_INIT;
- if (req_mem == NULL)
+ BIO_free(rctx->req);
+ rctx->req = NULL;
+ if (req == NULL)
return 1;
if (!rctx->method_POST) {
ERR_raise(ERR_LIB_HTTP, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
return 0;
}
- if (content_type != NULL
- && BIO_printf(rctx->mem, "Content-Type: %s\r\n", content_type) <= 0)
- return 0;
+ if (content_type == NULL) {
+ rctx->text = 1; /* assuming text by default, used just for tracing */
+ } else {
+ if (OPENSSL_strncasecmp(content_type, "text/", 5) == 0)
+ rctx->text = 1;
+ if (BIO_printf(rctx->mem, "Content-Type: %s\r\n", content_type) <= 0)
+ return 0;
+ }
- if ((req_len = BIO_get_mem_data(req_mem, &req)) <= 0)
+ /*
+ * BIO_CTRL_INFO yields the data length at least for memory BIOs, but for
+ * file-based BIOs it gives the current position, which is not what we need.
+ */
+ if (BIO_method_type(req) == BIO_TYPE_FILE) {
+#ifndef OPENSSL_NO_STDIO
+ if (BIO_get_fp(req, &fp) == 1 && fseek(fp, 0, SEEK_END) == 0) {
+ req_len = ftell(fp);
+ (void)fseek(fp, 0, SEEK_SET);
+ } else {
+ fp = NULL;
+ }
+#endif
+ } else {
+ req_len = BIO_ctrl(req, BIO_CTRL_INFO, 0, NULL);
+ /*
+ * Streaming BIOs likely will not support querying the size at all,
+ * and we assume we got a correct value if req_len > 0.
+ */
+ }
+ if ((
+#ifndef OPENSSL_NO_STDIO
+ fp != NULL /* definitely correct req_len */ ||
+#endif
+ req_len > 0)
+ && BIO_printf(rctx->mem, "Content-Length: %ld\r\n", req_len) < 0)
return 0;
- return BIO_printf(rctx->mem, "Content-Length: %ld\r\n\r\n", req_len) > 0
- && BIO_write(rctx->mem, req, req_len) == (int)req_len;
+ if (!BIO_up_ref(req))
+ return 0;
+ rctx->req = req;
+ return 1;
}
int OSSL_HTTP_REQ_CTX_set1_req(OSSL_HTTP_REQ_CTX *rctx, const char *content_type,
const ASN1_ITEM *it, const ASN1_VALUE *req)
{
- BIO *mem;
- int res;
+ BIO *mem = NULL;
+ int res = 1;
- if (rctx == NULL || it == NULL || req == NULL) {
- ERR_raise(ERR_LIB_HTTP, ERR_R_PASSED_NULL_PARAMETER);
- return 0;
- }
-
- res = (mem = ASN1_item_i2d_mem_bio(it, req)) != NULL
- && ossl_http_req_ctx_set_content(rctx, content_type, mem);
+ if (req != NULL)
+ res = (mem = ASN1_item_i2d_mem_bio(it, req)) != NULL;
+ res = res && set1_content(rctx, content_type, mem);
BIO_free(mem);
return res;
}
-static int OSSL_HTTP_REQ_CTX_add1_headers(OSSL_HTTP_REQ_CTX *rctx,
- const STACK_OF(CONF_VALUE) *headers,
- const char *host)
+void OSSL_HTTP_REQ_CTX_set_max_response_hdr_lines(OSSL_HTTP_REQ_CTX *rctx,
+ size_t count)
+{
+ if (rctx == NULL) {
+ ERR_raise(ERR_LIB_HTTP, ERR_R_PASSED_NULL_PARAMETER);
+ return;
+ }
+ rctx->max_hdr_lines = count;
+}
+
+static int add1_headers(OSSL_HTTP_REQ_CTX *rctx,
+ const STACK_OF(CONF_VALUE) *headers, const char *host)
{
int i;
int add_host = host != NULL && *host != '\0';
for (i = 0; i < sk_CONF_VALUE_num(headers); i++) {
hdr = sk_CONF_VALUE_value(headers, i);
- if (add_host && strcasecmp("host", hdr->name) == 0)
+ if (add_host && OPENSSL_strcasecmp("host", hdr->name) == 0)
add_host = 0;
if (!OSSL_HTTP_REQ_CTX_add1_header(rctx, hdr->name, hdr->value))
return 0;
void *arg, int use_ssl,
const char *proxy,
const char *server, const char *port,
- int buf_size, unsigned long max_len,
- int overall_timeout)
+ int buf_size, int overall_timeout)
{
OSSL_HTTP_REQ_CTX *rctx = OSSL_HTTP_REQ_CTX_new(wbio, rbio, buf_size);
if (rctx == NULL)
return NULL;
- OSSL_HTTP_REQ_CTX_set_max_response_length(rctx, max_len);
rctx->free_wbio = free_wbio;
rctx->upd_fn = bio_update_fn;
rctx->upd_arg = arg;
/*
* Parse first HTTP response line. This should be like this: "HTTP/1.0 200 OK".
- * We need to obtain the numeric code and (optional) informational message.
+ * We need to obtain the status code and (optional) informational message.
+ * Return any received HTTP response status code, or 0 on fatal error.
*/
static int parse_http_line1(char *line, int *found_keep_alive)
{
- int retcode;
+ int i, retcode, err;
char *code, *reason, *end;
- if (strncmp(line, HTTP_PREFIX_VERSION, HTTP_VERSION_PATT_LEN) != 0)
+ if (!CHECK_AND_SKIP_PREFIX(line, HTTP_PREFIX_VERSION))
goto err;
/* above HTTP 1.0, connection persistence is the default */
- *found_keep_alive = line[HTTP_VERSION_PATT_LEN] > '0';
+ *found_keep_alive = *line > '0';
/* Skip to first whitespace (past protocol info) */
for (code = line; *code != '\0' && !ossl_isspace(*code); code++)
case HTTP_STATUS_CODE_FOUND:
return retcode;
default:
+ err = HTTP_R_RECEIVED_ERROR;
if (retcode < 400)
- retcode = HTTP_R_STATUS_CODE_UNSUPPORTED;
- else
- retcode = HTTP_R_RECEIVED_ERROR;
+ err = HTTP_R_STATUS_CODE_UNSUPPORTED;
if (*reason == '\0')
- ERR_raise_data(ERR_LIB_HTTP, retcode, "Code=%s", code);
+ ERR_raise_data(ERR_LIB_HTTP, err, "code=%s", code);
else
- ERR_raise_data(ERR_LIB_HTTP, retcode,
- "Code=%s, Reason=%s", code, reason);
- return 0;
+ ERR_raise_data(ERR_LIB_HTTP, err, "code=%s, reason=%s", code,
+ reason);
+ return retcode;
}
err:
- ERR_raise_data(ERR_LIB_HTTP, HTTP_R_HEADER_PARSE_ERROR, "%.40s", line);
+ for (i = 0; i < 60 && line[i] != '\0'; i++)
+ if (!ossl_isprint(line[i]))
+ line[i] = ' ';
+ line[i] = '\0';
+ ERR_raise_data(ERR_LIB_HTTP, HTTP_R_HEADER_PARSE_ERROR, "content=%s", line);
return 0;
}
-static int check_set_resp_len(OSSL_HTTP_REQ_CTX *rctx, unsigned long len)
+static int check_set_resp_len(OSSL_HTTP_REQ_CTX *rctx, size_t len)
{
- if (len > rctx->max_resp_len)
+ if (rctx->max_resp_len != 0 && len > rctx->max_resp_len) {
ERR_raise_data(ERR_LIB_HTTP, HTTP_R_MAX_RESP_LEN_EXCEEDED,
- "length=%lu, max=%lu", len, rctx->max_resp_len);
- if (rctx->resp_len != 0 && rctx->resp_len != len)
+ "length=%zu, max=%zu", len, rctx->max_resp_len);
+ return 0;
+ }
+ if (rctx->resp_len != 0 && rctx->resp_len != len) {
ERR_raise_data(ERR_LIB_HTTP, HTTP_R_INCONSISTENT_CONTENT_LENGTH,
- "ASN.1 length=%lu, Content-Length=%lu",
+ "ASN.1 length=%zu, Content-Length=%zu",
len, rctx->resp_len);
+ return 0;
+ }
rctx->resp_len = len;
return 1;
}
+static int may_still_retry(time_t max_time, int *ptimeout)
+{
+ time_t time_diff, now = time(NULL);
+
+ if (max_time != 0) {
+ if (max_time < now) {
+ ERR_raise(ERR_LIB_HTTP, HTTP_R_RETRY_TIMEOUT);
+ return 0;
+ }
+ time_diff = max_time - now;
+ *ptimeout = time_diff > INT_MAX ? INT_MAX : (int)time_diff;
+ }
+ return 1;
+}
+
/*
* Try exchanging request and response via HTTP on (non-)blocking BIO in rctx.
* Returns 1 on success, 0 on error or redirection, -1 on BIO_should_retry.
int OSSL_HTTP_REQ_CTX_nbio(OSSL_HTTP_REQ_CTX *rctx)
{
int i, found_expected_ct = 0, found_keep_alive = 0;
+ int got_text = 1;
long n;
- unsigned long resp_len;
+ size_t resp_len;
const unsigned char *p;
- char *key, *value, *line_end = NULL;
+ char *buf, *key, *value, *line_end = NULL;
+ size_t resp_hdr_lines = 0;
if (rctx == NULL) {
ERR_raise(ERR_LIB_HTTP, ERR_R_PASSED_NULL_PARAMETER);
rctx->redirection_url = NULL;
next_io:
+ buf = (char *)rctx->buf;
if ((rctx->state & OHS_NOREAD) == 0) {
- n = BIO_read(rctx->rbio, rctx->readbuf, rctx->readbuflen);
+ if (rctx->expect_asn1) {
+ n = BIO_read(rctx->rbio, rctx->buf, rctx->buf_size);
+ } else {
+ (void)ERR_set_mark();
+ n = BIO_gets(rctx->rbio, buf, rctx->buf_size);
+ if (n == -2) { /* some BIOs, such as SSL, do not support "gets" */
+ (void)ERR_pop_to_mark();
+ n = BIO_get_line(rctx->rbio, buf, rctx->buf_size);
+ } else {
+ (void)ERR_clear_last_mark();
+ }
+ }
if (n <= 0) {
if (BIO_should_retry(rctx->rbio))
return -1;
}
/* Write data to memory BIO */
- if (BIO_write(rctx->mem, rctx->readbuf, n) != n)
+ if (BIO_write(rctx->mem, rctx->buf, n) != n)
return 0;
}
switch (rctx->state) {
- case OHS_HTTP_HEADER:
+ case OHS_ADD_HEADERS:
/* Last operation was adding headers: need a final \r\n */
if (BIO_write(rctx->mem, "\r\n", 2) != 2) {
rctx->state = OHS_ERROR;
}
rctx->state = OHS_WRITE_INIT;
- /* fall thru */
+ /* fall through */
case OHS_WRITE_INIT:
- rctx->len_to_send = BIO_get_mem_data(rctx->mem, NULL);
- rctx->state = OHS_WRITE;
-
- /* fall thru */
- case OHS_WRITE:
- n = BIO_get_mem_data(rctx->mem, &p) - rctx->len_to_send;
- i = BIO_write(rctx->wbio, p + n, rctx->len_to_send);
-
- if (i <= 0) {
- if (BIO_should_retry(rctx->wbio))
- return -1;
- rctx->state = OHS_ERROR;
- return 0;
+ rctx->len_to_send = BIO_get_mem_data(rctx->mem, &rctx->pos);
+ rctx->state = OHS_WRITE_HDR1;
+
+ /* fall through */
+ case OHS_WRITE_HDR1:
+ case OHS_WRITE_HDR:
+ /* Copy some chunk of data from rctx->mem to rctx->wbio */
+ case OHS_WRITE_REQ:
+ /* Copy some chunk of data from rctx->req to rctx->wbio */
+
+ if (rctx->len_to_send > 0) {
+ size_t sz;
+
+ if (!BIO_write_ex(rctx->wbio, rctx->pos, rctx->len_to_send, &sz)) {
+ if (BIO_should_retry(rctx->wbio))
+ return -1;
+ rctx->state = OHS_ERROR;
+ return 0;
+ }
+ if (OSSL_TRACE_ENABLED(HTTP) && rctx->state == OHS_WRITE_HDR1)
+ OSSL_TRACE(HTTP, "Sending request: [\n");
+ OSSL_TRACE_STRING(HTTP, rctx->state != OHS_WRITE_REQ || rctx->text,
+ rctx->state != OHS_WRITE_REQ, rctx->pos, sz);
+ if (rctx->state == OHS_WRITE_HDR1)
+ rctx->state = OHS_WRITE_HDR;
+ rctx->pos += sz;
+ rctx->len_to_send -= sz;
+ goto next_io;
}
-
- rctx->len_to_send -= i;
-
- if (rctx->len_to_send > 0)
+ if (rctx->state == OHS_WRITE_HDR) {
+ (void)BIO_reset(rctx->mem);
+ rctx->state = OHS_WRITE_REQ;
+ }
+ if (rctx->req != NULL && !BIO_eof(rctx->req)) {
+ n = BIO_read(rctx->req, rctx->buf, rctx->buf_size);
+ if (n <= 0) {
+ if (BIO_should_retry(rctx->req))
+ return -1;
+ ERR_raise(ERR_LIB_HTTP, HTTP_R_FAILED_READING_DATA);
+ return 0;
+ }
+ rctx->pos = rctx->buf;
+ rctx->len_to_send = n;
goto next_io;
-
+ }
+ if (OSSL_TRACE_ENABLED(HTTP))
+ OSSL_TRACE(HTTP, "]\n");
rctx->state = OHS_FLUSH;
- (void)BIO_reset(rctx->mem);
-
- /* fall thru */
+ /* fall through */
case OHS_FLUSH:
i = BIO_flush(rctx->wbio);
*/
n = BIO_get_mem_data(rctx->mem, &p);
if (n <= 0 || memchr(p, '\n', n) == 0) {
- if (n >= rctx->readbuflen) {
+ if (n >= rctx->buf_size) {
rctx->state = OHS_ERROR;
return 0;
}
goto next_io;
}
- n = BIO_gets(rctx->mem, (char *)rctx->readbuf, rctx->readbuflen);
+ n = BIO_gets(rctx->mem, buf, rctx->buf_size);
if (n <= 0) {
if (BIO_should_retry(rctx->mem))
return 0;
}
+ resp_hdr_lines++;
+ if (rctx->max_hdr_lines != 0 && rctx->max_hdr_lines < resp_hdr_lines) {
+ ERR_raise(ERR_LIB_HTTP, HTTP_R_RESPONSE_TOO_MANY_HDRLINES);
+ OSSL_TRACE(HTTP, "Received too many headers\n");
+ rctx->state = OHS_ERROR;
+ return 0;
+ }
+
/* Don't allow excessive lines */
- if (n == rctx->readbuflen) {
+ if (n == rctx->buf_size) {
ERR_raise(ERR_LIB_HTTP, HTTP_R_RESPONSE_LINE_TOO_LONG);
rctx->state = OHS_ERROR;
return 0;
}
+ /* dump all response header lines */
+ if (OSSL_TRACE_ENABLED(HTTP)) {
+ if (rctx->state == OHS_FIRSTLINE)
+ OSSL_TRACE(HTTP, "Received response header: [\n");
+ OSSL_TRACE1(HTTP, "%s", buf);
+ }
+
/* First line */
if (rctx->state == OHS_FIRSTLINE) {
- switch (parse_http_line1((char *)rctx->readbuf, &found_keep_alive)) {
+ switch (parse_http_line1(buf, &found_keep_alive)) {
case HTTP_STATUS_CODE_OK:
rctx->state = OHS_HEADERS;
goto next_line;
/* redirection is not supported/recommended for POST */
/* fall through */
default:
- rctx->state = OHS_ERROR;
- return 0;
+ rctx->state = OHS_HEADERS_ERROR;
+ goto next_line; /* continue parsing and reporting header */
}
}
- key = (char *)rctx->readbuf;
+ key = buf;
value = strchr(key, ':');
if (value != NULL) {
*(value++) = '\0';
}
if (value != NULL && line_end != NULL) {
if (rctx->state == OHS_REDIRECT
- && strcasecmp(key, "Location") == 0) {
+ && OPENSSL_strcasecmp(key, "Location") == 0) {
rctx->redirection_url = value;
return 0;
}
- if (rctx->expected_ct != NULL
- && strcasecmp(key, "Content-Type") == 0) {
- if (strcasecmp(rctx->expected_ct, value) != 0) {
- ERR_raise_data(ERR_LIB_HTTP, HTTP_R_UNEXPECTED_CONTENT_TYPE,
- "expected=%s, actual=%s",
- rctx->expected_ct, value);
- return 0;
+ if (OPENSSL_strcasecmp(key, "Content-Type") == 0) {
+ got_text = OPENSSL_strncasecmp(value, "text/", 5) == 0;
+ if (rctx->state == OHS_HEADERS
+ && rctx->expected_ct != NULL) {
+ const char *semicolon;
+
+ if (OPENSSL_strcasecmp(rctx->expected_ct, value) != 0
+ /* ignore past ';' unless expected_ct contains ';' */
+ && (strchr(rctx->expected_ct, ';') != NULL
+ || (semicolon = strchr(value, ';')) == NULL
+ || (size_t)(semicolon - value) != strlen(rctx->expected_ct)
+ || OPENSSL_strncasecmp(rctx->expected_ct, value,
+ semicolon - value) != 0)) {
+ ERR_raise_data(ERR_LIB_HTTP,
+ HTTP_R_UNEXPECTED_CONTENT_TYPE,
+ "expected=%s, actual=%s",
+ rctx->expected_ct, value);
+ return 0;
+ }
+ found_expected_ct = 1;
}
- found_expected_ct = 1;
}
/* https://tools.ietf.org/html/rfc7230#section-6.3 Persistence */
- if (strcasecmp(key, "Connection") == 0) {
- if (strcasecmp(value, "keep-alive") == 0)
+ if (OPENSSL_strcasecmp(key, "Connection") == 0) {
+ if (OPENSSL_strcasecmp(value, "keep-alive") == 0)
found_keep_alive = 1;
- else if (strcasecmp(value, "close") == 0)
+ else if (OPENSSL_strcasecmp(value, "close") == 0)
found_keep_alive = 0;
- }
- if (strcasecmp(key, "Content-Length") == 0) {
- resp_len = strtoul(value, &line_end, 10);
+ } else if (OPENSSL_strcasecmp(key, "Content-Length") == 0) {
+ resp_len = (size_t)strtoul(value, &line_end, 10);
if (line_end == value || *line_end != '\0') {
ERR_raise_data(ERR_LIB_HTTP,
HTTP_R_ERROR_PARSING_CONTENT_LENGTH,
}
/* Look for blank line indicating end of headers */
- for (p = rctx->readbuf; *p != '\0'; p++) {
+ for (p = rctx->buf; *p != '\0'; p++) {
if (*p != '\r' && *p != '\n')
break;
}
if (*p != '\0') /* not end of headers */
goto next_line;
+ if (OSSL_TRACE_ENABLED(HTTP))
+ OSSL_TRACE(HTTP, "]\n");
+
+ resp_hdr_lines = 0;
- if (rctx->expected_ct != NULL && !found_expected_ct) {
- ERR_raise_data(ERR_LIB_HTTP, HTTP_R_MISSING_CONTENT_TYPE,
- "expected=%s", rctx->expected_ct);
- return 0;
- }
if (rctx->keep_alive != 0 /* do not let server initiate keep_alive */
&& !found_keep_alive /* otherwise there is no change */) {
if (rctx->keep_alive == 2) {
rctx->keep_alive = 0;
}
+ if (rctx->state == OHS_HEADERS_ERROR) {
+ if (OSSL_TRACE_ENABLED(HTTP)) {
+ int printed_final_nl = 0;
+
+ OSSL_TRACE(HTTP, "Received error response body: [\n");
+ while ((n = BIO_read(rctx->rbio, rctx->buf, rctx->buf_size)) > 0
+ || (OSSL_sleep(100), BIO_should_retry(rctx->rbio))) {
+ OSSL_TRACE_STRING(HTTP, got_text, 1, rctx->buf, n);
+ if (n > 0)
+ printed_final_nl = rctx->buf[n - 1] == '\n';
+ }
+ OSSL_TRACE1(HTTP, "%s]\n", printed_final_nl ? "" : "\n");
+ (void)printed_final_nl; /* avoid warning unless enable-trace */
+ }
+ return 0;
+ }
+
+ if (rctx->expected_ct != NULL && !found_expected_ct) {
+ ERR_raise_data(ERR_LIB_HTTP, HTTP_R_MISSING_CONTENT_TYPE,
+ "expected=%s", rctx->expected_ct);
+ return 0;
+ }
if (rctx->state == OHS_REDIRECT) {
/* http status code indicated redirect but there was no Location */
ERR_raise(ERR_LIB_HTTP, HTTP_R_MISSING_REDIRECT_LOCATION);
}
if (!rctx->expect_asn1) {
- rctx->state = OHS_CONTENT;
- goto content;
+ rctx->state = OHS_STREAM;
+ return 1;
}
rctx->state = OHS_ASN1_HEADER;
if (!check_set_resp_len(rctx, resp_len))
return 0;
- content:
- rctx->state = OHS_CONTENT;
+ rctx->state = OHS_ASN1_CONTENT;
/* Fall thru */
- case OHS_CONTENT:
+ case OHS_ASN1_CONTENT:
default:
n = BIO_get_mem_data(rctx->mem, NULL);
- if (n < (long)rctx->resp_len /* may be 0 if no Content-Length or ASN.1 */)
+ if (n < 0 || (size_t)n < rctx->resp_len)
goto next_io;
- rctx->state = OHS_DONE;
+ rctx->state = OHS_ASN1_DONE;
return 1;
}
}
#ifndef OPENSSL_NO_SOCK
/* set up a new connection BIO, to HTTP server or to HTTP(S) proxy if given */
-static BIO *HTTP_new_bio(const char *server /* optionally includes ":port" */,
+static BIO *http_new_bio(const char *server /* optionally includes ":port" */,
const char *server_port /* explicit server port */,
int use_ssl,
const char *proxy /* optionally includes ":port" */,
}
return NULL;
}
- return rctx->mem;
+ return rctx->state == OHS_STREAM ? rctx->rbio : rctx->mem;
}
int OSSL_HTTP_is_alive(const OSSL_HTTP_REQ_CTX *rctx)
const char *proxy, const char *no_proxy,
int use_ssl, BIO *bio, BIO *rbio,
OSSL_HTTP_bio_cb_t bio_update_fn, void *arg,
- int buf_size, unsigned long max_resp_len,
- int overall_timeout)
+ int buf_size, int overall_timeout)
{
BIO *cbio; /* == bio if supplied, used as connection BIO if rbio is NULL */
OSSL_HTTP_REQ_CTX *rctx = NULL;
port = NULL;
if (port == NULL && strchr(server, ':') == NULL)
port = use_ssl ? OSSL_HTTPS_PORT : OSSL_HTTP_PORT;
- proxy = ossl_http_adapt_proxy(proxy, no_proxy, server, use_ssl);
+ proxy = OSSL_HTTP_adapt_proxy(proxy, no_proxy, server, use_ssl);
if (proxy != NULL
&& !OSSL_HTTP_parse_url(proxy, NULL /* use_ssl */, NULL /* user */,
&proxy_host, &proxy_port, NULL /* num */,
NULL /* path */, NULL, NULL))
return NULL;
- cbio = HTTP_new_bio(server, port, use_ssl, proxy_host, proxy_port);
+ cbio = http_new_bio(server, port, use_ssl, proxy_host, proxy_port);
OPENSSL_free(proxy_host);
OPENSSL_free(proxy_port);
if (cbio == NULL)
}
/* now overall_timeout is guaranteed to be >= 0 */
+ /* adapt in order to fix callback design flaw, see #17088 */
/* callback can be used to wrap or prepend TLS session */
if (bio_update_fn != NULL) {
BIO *orig_bio = cbio;
- cbio = (*bio_update_fn)(cbio, arg, 1 /* connect */, use_ssl);
+ cbio = (*bio_update_fn)(cbio, arg, 1 /* connect */, use_ssl != 0);
if (cbio == NULL) {
- cbio = orig_bio;
+ if (bio == NULL) /* cbio was not provided by caller */
+ BIO_free_all(orig_bio);
goto end;
}
}
rctx = http_req_ctx_new(bio == NULL, cbio, rbio != NULL ? rbio : cbio,
bio_update_fn, arg, use_ssl, proxy, server, port,
- buf_size, max_resp_len, overall_timeout);
+ buf_size, overall_timeout);
end:
if (rctx != NULL)
return rctx;
}
-int OSSL_HTTP_set_request(OSSL_HTTP_REQ_CTX *rctx, const char *path,
- const STACK_OF(CONF_VALUE) *headers,
- const char *content_type, BIO *req_mem,
- const char *expected_content_type, int expect_asn1,
- int timeout, int keep_alive)
+int OSSL_HTTP_set1_request(OSSL_HTTP_REQ_CTX *rctx, const char *path,
+ const STACK_OF(CONF_VALUE) *headers,
+ const char *content_type, BIO *req,
+ const char *expected_content_type, int expect_asn1,
+ size_t max_resp_len, int timeout, int keep_alive)
{
int use_http_proxy;
return 0;
}
use_http_proxy = rctx->proxy != NULL && !rctx->use_ssl;
- if (use_http_proxy && (rctx->server == NULL || rctx->port == NULL)) {
+ if (use_http_proxy && rctx->server == NULL) {
ERR_raise(ERR_LIB_HTTP, ERR_R_PASSED_INVALID_ARGUMENT);
return 0;
}
+ rctx->max_resp_len = max_resp_len; /* allows for 0: indefinite */
- return OSSL_HTTP_REQ_CTX_set_request_line(rctx, req_mem != NULL,
+ return OSSL_HTTP_REQ_CTX_set_request_line(rctx, req != NULL,
use_http_proxy ? rctx->server
: NULL, rctx->port, path)
- && OSSL_HTTP_REQ_CTX_add1_headers(rctx, headers, rctx->server)
+ && add1_headers(rctx, headers, rctx->server)
&& OSSL_HTTP_REQ_CTX_set_expected(rctx, expected_content_type,
expect_asn1, timeout, keep_alive)
- && ossl_http_req_ctx_set_content(rctx, content_type, req_mem);
+ && set1_content(rctx, content_type, req);
}
/*-
static int redirection_ok(int n_redir, const char *old_url, const char *new_url)
{
- size_t https_len = strlen(OSSL_HTTPS_NAME":");
-
if (n_redir >= HTTP_VERSION_MAX_REDIRECTIONS) {
ERR_raise(ERR_LIB_HTTP, HTTP_R_TOO_MANY_REDIRECTIONS);
return 0;
}
if (*new_url == '/') /* redirection to same server => same protocol */
return 1;
- if (strncmp(old_url, OSSL_HTTPS_NAME":", https_len) == 0 &&
- strncmp(new_url, OSSL_HTTPS_NAME":", https_len) != 0) {
+ if (HAS_PREFIX(old_url, OSSL_HTTPS_NAME":") &&
+ !HAS_PREFIX(new_url, OSSL_HTTPS_NAME":")) {
ERR_raise(ERR_LIB_HTTP, HTTP_R_REDIRECTION_FROM_HTTPS_TO_HTTP);
return 0;
}
const char *expected_ct, int expect_asn1,
size_t max_resp_len, int timeout)
{
- char *current_url, *redirection_url = NULL;
+ char *current_url;
int n_redirs = 0;
char *host;
char *port;
char *path;
int use_ssl;
- OSSL_HTTP_REQ_CTX *rctx;
BIO *resp = NULL;
+ time_t max_time = timeout > 0 ? time(NULL) + timeout : 0;
if (url == NULL) {
ERR_raise(ERR_LIB_HTTP, ERR_R_PASSED_NULL_PARAMETER);
return NULL;
for (;;) {
+ OSSL_HTTP_REQ_CTX *rctx;
+ char *redirection_url;
+
if (!OSSL_HTTP_parse_url(current_url, &use_ssl, NULL /* user */, &host,
&port, NULL /* port_num */, &path, NULL, NULL))
break;
rctx = OSSL_HTTP_open(host, port, proxy, no_proxy,
use_ssl, bio, rbio, bio_update_fn, arg,
- buf_size, max_resp_len, timeout);
+ buf_size, timeout);
new_rpath:
+ redirection_url = NULL;
if (rctx != NULL) {
- if (!OSSL_HTTP_set_request(rctx, path, headers,
- NULL /* content_type */,
- NULL /* req_mem */,
- expected_ct, expect_asn1,
- -1 /* use same max time (timeout) */,
- 0 /* no keep_alive */))
+ if (!OSSL_HTTP_set1_request(rctx, path, headers,
+ NULL /* content_type */,
+ NULL /* req */,
+ expected_ct, expect_asn1, max_resp_len,
+ -1 /* use same max time (timeout) */,
+ 0 /* no keep_alive */)) {
OSSL_HTTP_REQ_CTX_free(rctx);
- else
+ rctx = NULL;
+ } else {
resp = OSSL_HTTP_exchange(rctx, &redirection_url);
+ }
}
OPENSSL_free(path);
if (resp == NULL && redirection_url != NULL) {
- if (redirection_ok(++n_redirs, current_url, redirection_url)) {
+ if (redirection_ok(++n_redirs, current_url, redirection_url)
+ && may_still_retry(max_time, &timeout)) {
(void)BIO_reset(bio);
OPENSSL_free(current_url);
current_url = redirection_url;
if (*redirection_url == '/') { /* redirection to same server */
path = OPENSSL_strdup(redirection_url);
+ if (path == NULL) {
+ OPENSSL_free(host);
+ OPENSSL_free(port);
+ (void)OSSL_HTTP_close(rctx, 1);
+ BIO_free(resp);
+ OPENSSL_free(current_url);
+ return NULL;
+ }
goto new_rpath;
}
OPENSSL_free(host);
int buf_size, const STACK_OF(CONF_VALUE) *headers,
const char *content_type, BIO *req,
const char *expected_ct, int expect_asn1,
- unsigned long max_resp_len, int timeout, int keep_alive)
+ size_t max_resp_len, int timeout, int keep_alive)
{
OSSL_HTTP_REQ_CTX *rctx = prctx == NULL ? NULL : *prctx;
BIO *resp = NULL;
if (rctx == NULL) {
rctx = OSSL_HTTP_open(server, port, proxy, no_proxy,
use_ssl, bio, rbio, bio_update_fn, arg,
- buf_size, max_resp_len, timeout);
+ buf_size, timeout);
timeout = -1; /* Already set during opening the connection */
}
if (rctx != NULL) {
- if (OSSL_HTTP_set_request(rctx, path, headers, content_type, req,
- expected_ct, expect_asn1,
- timeout, keep_alive))
+ if (OSSL_HTTP_set1_request(rctx, path, headers, content_type, req,
+ expected_ct, expect_asn1,
+ max_resp_len, timeout, keep_alive))
resp = OSSL_HTTP_exchange(rctx, NULL);
if (resp == NULL || !OSSL_HTTP_is_alive(rctx)) {
if (!OSSL_HTTP_close(rctx, resp != NULL)) {
int OSSL_HTTP_close(OSSL_HTTP_REQ_CTX *rctx, int ok)
{
+ BIO *wbio;
int ret = 1;
- /* callback can be used to clean up TLS session on disconnect */
- if (rctx != NULL && rctx->upd_fn != NULL)
- ret = (*rctx->upd_fn)(rctx->wbio, rctx->upd_arg, 0, ok) != NULL;
+ /* callback can be used to finish TLS session and free its BIO */
+ if (rctx != NULL && rctx->upd_fn != NULL) {
+ wbio = (*rctx->upd_fn)(rctx->wbio, rctx->upd_arg,
+ 0 /* disconnect */, ok);
+ ret = wbio != NULL;
+ if (ret)
+ rctx->wbio = wbio;
+ }
OSSL_HTTP_REQ_CTX_free(rctx);
return ret;
}
/*-
* The first line is the HTTP response.
* According to RFC 7230, it is formatted exactly like this:
- * HTTP/d.d ddd Reason text\r\n
+ * HTTP/d.d ddd reason text\r\n
*/
read_len = BIO_gets(fbio, mbuf, BUF_SIZE);
/* the BIO may not block, so we must wait for the 1st line to come in */
- if (read_len < HTTP_LINE1_MINLEN)
+ if (read_len < (int)HTTP_LINE1_MINLEN)
continue;
/* Check for HTTP/1.x */
- if (strncmp(mbuf, HTTP_PREFIX, strlen(HTTP_PREFIX)) != 0) {
+ mbufp = mbuf;
+ if (!CHECK_AND_SKIP_PREFIX(mbufp, HTTP_PREFIX)) {
ERR_raise(ERR_LIB_HTTP, HTTP_R_HEADER_PARSE_ERROR);
BIO_printf(bio_err, "%s: HTTP CONNECT failed, non-HTTP response\n",
prog);
/* Wrong protocol, not even HTTP, so stop reading headers */
goto end;
}
- mbufp = mbuf + strlen(HTTP_PREFIX);
- if (strncmp(mbufp, HTTP_VERSION_PATT, HTTP_VERSION_PATT_LEN) != 0) {
+ if (!HAS_PREFIX(mbufp, HTTP_VERSION_PATT)) {
ERR_raise(ERR_LIB_HTTP, HTTP_R_RECEIVED_WRONG_HTTP_VERSION);
BIO_printf(bio_err,
"%s: HTTP CONNECT failed, bad HTTP version %.*s\n",
mbufp += HTTP_VERSION_STR_LEN;
/* RFC 7231 4.3.6: any 2xx status code is valid */
- if (strncmp(mbufp, " 2", strlen(" 2")) != 0) {
- mbufp += 1;
+ if (!HAS_PREFIX(mbufp, " 2")) {
+ if (ossl_isspace(*mbufp))
+ mbufp++;
/* chop any trailing whitespace */
while (read_len > 0 && ossl_isspace(mbuf[read_len - 1]))
read_len--;
mbuf[read_len] = '\0';
ERR_raise_data(ERR_LIB_HTTP, HTTP_R_CONNECT_FAILURE,
- "Reason=%s", mbufp);
- BIO_printf(bio_err, "%s: HTTP CONNECT failed, Reason=%s\n",
+ "reason=%s", mbufp);
+ BIO_printf(bio_err, "%s: HTTP CONNECT failed, reason=%s\n",
prog, mbufp);
goto end;
}
/* Read past all following headers */
do {
/*
- * TODO: This does not necessarily catch the case when the full
- * HTTP response came in in more than a single TCP message.
+ * This does not necessarily catch the case when the full
+ * HTTP response came in more than a single TCP message.
*/
read_len = BIO_gets(fbio, mbuf, BUF_SIZE);
} while (read_len > 2);
projects / thirdparty / openssl.git / blobdiff