]> git.ipfire.org Git - thirdparty/squid.git/blob - src/HttpHeader.cc
c52f44d357e25831f0075802d9429146221555be
[thirdparty/squid.git] / src / HttpHeader.cc
1 /*
2 * Copyright (C) 1996-2025 The Squid Software Foundation and contributors
3 *
4 * Squid software is distributed under GPLv2+ license and includes
5 * contributions from numerous individuals and organizations.
6 * Please see the COPYING and CONTRIBUTORS files for details.
7 */
8
9 /* DEBUG: section 55 HTTP Header */
10
11 #include "squid.h"
12 #include "base/Assure.h"
13 #include "base/CharacterSet.h"
14 #include "base/EnumIterator.h"
15 #include "base/Raw.h"
16 #include "base64.h"
17 #include "globals.h"
18 #include "http/ContentLengthInterpreter.h"
19 #include "HttpHdrCc.h"
20 #include "HttpHdrContRange.h"
21 #include "HttpHdrScTarget.h" // also includes HttpHdrSc.h
22 #include "HttpHeader.h"
23 #include "HttpHeaderFieldStat.h"
24 #include "HttpHeaderStat.h"
25 #include "HttpHeaderTools.h"
26 #include "MemBuf.h"
27 #include "mgr/Registration.h"
28 #include "mime_header.h"
29 #include "sbuf/StringConvert.h"
30 #include "SquidConfig.h"
31 #include "StatHist.h"
32 #include "Store.h"
33 #include "StrList.h"
34 #include "time/gadgets.h"
35 #include "TimeOrTag.h"
36 #include "util.h"
37
38 #include <algorithm>
39 #include <array>
40
41 /* XXX: the whole set of API managing the entries vector should be rethought
42 * after the parse4r-ng effort is complete.
43 */
44
45 /*
46 * On naming conventions:
47 *
48 * HTTP/1.1 defines message-header as
49 *
50 * message-header = field-name ":" [ field-value ] CRLF
51 * field-name = token
52 * field-value = *( field-content | LWS )
53 *
54 * HTTP/1.1 does not give a name name a group of all message-headers in a message.
55 * Squid 1.1 seems to refer to that group _plus_ start-line as "headers".
56 *
57 * HttpHeader is an object that represents all message-headers in a message.
58 * HttpHeader does not manage start-line.
59 *
60 * HttpHeader is implemented as a collection of header "entries".
61 * An entry is a (field_id, field_name, field_value) triplet.
62 */
63
64 /*
65 * local constants and vars
66 */
67
68 // statistics counters for headers. clients must not allow Http::HdrType::BAD_HDR to be counted
69 std::vector<HttpHeaderFieldStat> headerStatsTable(Http::HdrType::enumEnd_);
70
71 /* request-only headers. Used for cachemgr */
72 static HttpHeaderMask RequestHeadersMask; /* set run-time using RequestHeaders */
73
74 /* reply-only headers. Used for cachemgr */
75 static HttpHeaderMask ReplyHeadersMask; /* set run-time using ReplyHeaders */
76
77 /* header accounting */
78 // NP: keep in sync with enum http_hdr_owner_type
79 static std::array<HttpHeaderStat, hoEnd> HttpHeaderStats = {{
80 HttpHeaderStat(/*hoNone*/ "all", nullptr),
81 #if USE_HTCP
82 HttpHeaderStat(/*hoHtcpReply*/ "HTCP reply", &ReplyHeadersMask),
83 #endif
84 HttpHeaderStat(/*hoRequest*/ "request", &RequestHeadersMask),
85 HttpHeaderStat(/*hoReply*/ "reply", &ReplyHeadersMask)
86 #if USE_OPENSSL
87 , HttpHeaderStat(/*hoErrorDetail*/ "error detail templates", nullptr)
88 #endif
89 /* hoEnd */
90 }
91 };
92
93 static int HeaderEntryParsedCount = 0;
94
95 /*
96 * forward declarations and local routines
97 */
98
99 class StoreEntry;
100
101 // update parse statistics for header id; if error is true also account
102 // for errors and write to debug log what happened
103 static void httpHeaderNoteParsedEntry(Http::HdrType id, String const &value, bool error);
104 static void httpHeaderStatDump(const HttpHeaderStat * hs, StoreEntry * e);
105 /** store report about current header usage and other stats */
106 static void httpHeaderStoreReport(StoreEntry * e);
107
108 /*
109 * Module initialization routines
110 */
111
112 static void
113 httpHeaderRegisterWithCacheManager(void)
114 {
115 Mgr::RegisterAction("http_headers",
116 "HTTP Header Statistics",
117 httpHeaderStoreReport, 0, 1);
118 }
119
120 void
121 httpHeaderInitModule(void)
122 {
123 /* check that we have enough space for masks */
124 assert(8 * sizeof(HttpHeaderMask) >= Http::HdrType::enumEnd_);
125
126 // masks are needed for stats page still
127 for (auto h : WholeEnum<Http::HdrType>()) {
128 if (Http::HeaderLookupTable.lookup(h).request)
129 CBIT_SET(RequestHeadersMask,h);
130 if (Http::HeaderLookupTable.lookup(h).reply)
131 CBIT_SET(ReplyHeadersMask,h);
132 }
133
134 assert(HttpHeaderStats[0].label && "httpHeaderInitModule() called via main()");
135 assert(HttpHeaderStats[hoEnd-1].label && "HttpHeaderStats created with all elements");
136
137 /* init dependent modules */
138 httpHdrScInitModule();
139
140 httpHeaderRegisterWithCacheManager();
141 }
142
143 /*
144 * HttpHeader Implementation
145 */
146
147 HttpHeader::HttpHeader(const http_hdr_owner_type anOwner): owner(anOwner), len(0), conflictingContentLength_(false)
148 {
149 assert(anOwner > hoNone && anOwner < hoEnd);
150 debugs(55, 7, "init-ing hdr: " << this << " owner: " << owner);
151 entries.reserve(32);
152 httpHeaderMaskInit(&mask, 0);
153 }
154
155 // XXX: Delete as unused, expensive, and violating copy semantics by skipping Warnings
156 HttpHeader::HttpHeader(const HttpHeader &other): owner(other.owner), len(other.len), conflictingContentLength_(false)
157 {
158 entries.reserve(other.entries.capacity());
159 httpHeaderMaskInit(&mask, 0);
160 update(&other); // will update the mask as well
161 }
162
163 HttpHeader::~HttpHeader()
164 {
165 clean();
166 }
167
168 // XXX: Delete as unused, expensive, and violating assignment semantics by skipping Warnings
169 HttpHeader &
170 HttpHeader::operator =(const HttpHeader &other)
171 {
172 if (this != &other) {
173 // we do not really care, but the caller probably does
174 assert(owner == other.owner);
175 clean();
176 update(&other); // will update the mask as well
177 len = other.len;
178 conflictingContentLength_ = other.conflictingContentLength_;
179 teUnsupported_ = other.teUnsupported_;
180 }
181 return *this;
182 }
183
184 void
185 HttpHeader::clean()
186 {
187
188 assert(owner > hoNone && owner < hoEnd);
189 debugs(55, 7, "cleaning hdr: " << this << " owner: " << owner);
190
191 if (owner <= hoReply) {
192 /*
193 * An unfortunate bug. The entries array is initialized
194 * such that count is set to zero. httpHeaderClean() seems to
195 * be called both when 'hdr' is created, and destroyed. Thus,
196 * we accumulate a large number of zero counts for 'hdr' before
197 * it is ever used. Can't think of a good way to fix it, except
198 * adding a state variable that indicates whether or not 'hdr'
199 * has been used. As a hack, just never count zero-sized header
200 * arrays.
201 */
202 if (!entries.empty())
203 HttpHeaderStats[owner].hdrUCountDistr.count(entries.size());
204
205 ++ HttpHeaderStats[owner].destroyedCount;
206
207 HttpHeaderStats[owner].busyDestroyedCount += entries.size() > 0;
208 } // if (owner <= hoReply)
209
210 for (HttpHeaderEntry *e : entries) {
211 if (e == nullptr)
212 continue;
213 if (!Http::any_valid_header(e->id)) {
214 debugs(55, DBG_CRITICAL, "ERROR: Squid BUG: invalid entry (" << e->id << "). Ignored.");
215 } else {
216 if (owner <= hoReply)
217 HttpHeaderStats[owner].fieldTypeDistr.count(e->id);
218 delete e;
219 }
220 }
221
222 entries.clear();
223 httpHeaderMaskInit(&mask, 0);
224 len = 0;
225 conflictingContentLength_ = false;
226 teUnsupported_ = false;
227 }
228
229 /* append entries (also see httpHeaderUpdate) */
230 void
231 HttpHeader::append(const HttpHeader * src)
232 {
233 assert(src);
234 assert(src != this);
235 debugs(55, 7, "appending hdr: " << this << " += " << src);
236
237 for (auto e : src->entries) {
238 if (e)
239 addEntry(e->clone());
240 }
241 }
242
243 bool
244 HttpHeader::needUpdate(HttpHeader const *fresh) const
245 {
246 for (const auto e: fresh->entries) {
247 if (!e || skipUpdateHeader(e->id))
248 continue;
249 String value;
250 if (!hasNamed(e->name, &value) ||
251 (value != fresh->getByName(e->name)))
252 return true;
253 }
254 return false;
255 }
256
257 bool
258 HttpHeader::skipUpdateHeader(const Http::HdrType id) const
259 {
260 return
261 // TODO: Consider updating Vary headers after comparing the magnitude of
262 // the required changes (and/or cache losses) with compliance gains.
263 (id == Http::HdrType::VARY);
264 }
265
266 void
267 HttpHeader::update(HttpHeader const *fresh)
268 {
269 assert(fresh);
270 assert(this != fresh);
271
272 const HttpHeaderEntry *e;
273 HttpHeaderPos pos = HttpHeaderInitPos;
274
275 while ((e = fresh->getEntry(&pos))) {
276 /* deny bad guys (ok to check for Http::HdrType::OTHER) here */
277
278 if (skipUpdateHeader(e->id))
279 continue;
280
281 if (e->id != Http::HdrType::OTHER)
282 delById(e->id);
283 else
284 delByName(e->name);
285 }
286
287 pos = HttpHeaderInitPos;
288 while ((e = fresh->getEntry(&pos))) {
289 /* deny bad guys (ok to check for Http::HdrType::OTHER) here */
290
291 if (skipUpdateHeader(e->id))
292 continue;
293
294 debugs(55, 7, "Updating header '" << Http::HeaderLookupTable.lookup(e->id).name << "' in cached entry");
295
296 addEntry(e->clone());
297 }
298 }
299
300 bool
301 HttpHeader::Isolate(const char **parse_start, size_t l, const char **blk_start, const char **blk_end)
302 {
303 /*
304 * parse_start points to the first line of HTTP message *headers*,
305 * not including the request or status lines
306 */
307 const size_t end = headersEnd(*parse_start, l);
308
309 if (end) {
310 *blk_start = *parse_start;
311 *blk_end = *parse_start + end - 1;
312 assert(**blk_end == '\n');
313 // Point blk_end to the first character after the last header field.
314 // In other words, blk_end should point to the CR?LF header terminator.
315 if (end > 1 && *(*blk_end - 1) == '\r')
316 --(*blk_end);
317 *parse_start += end;
318 }
319 return end;
320 }
321
322 int
323 HttpHeader::parse(const char *buf, size_t buf_len, bool atEnd, size_t &hdr_sz, Http::ContentLengthInterpreter &clen)
324 {
325 const char *parse_start = buf;
326 const char *blk_start, *blk_end;
327 hdr_sz = 0;
328
329 if (!Isolate(&parse_start, buf_len, &blk_start, &blk_end)) {
330 // XXX: do not parse non-isolated headers even if the connection is closed.
331 // Treat unterminated headers as "partial headers" framing errors.
332 if (!atEnd)
333 return 0;
334 blk_start = parse_start;
335 blk_end = blk_start + strlen(blk_start);
336 }
337
338 if (parse(blk_start, blk_end - blk_start, clen)) {
339 hdr_sz = parse_start - buf;
340 return 1;
341 }
342 return -1;
343 }
344
345 // XXX: callers treat this return as boolean.
346 // XXX: A better mechanism is needed to signal different types of error.
347 // lexicon, syntax, semantics, validation, access policy - are all (ab)using 'return 0'
348 int
349 HttpHeader::parse(const char *header_start, size_t hdrLen, Http::ContentLengthInterpreter &clen)
350 {
351 const char *field_ptr = header_start;
352 const char *header_end = header_start + hdrLen; // XXX: remove
353 int warnOnError = (Config.onoff.relaxed_header_parser <= 0 ? DBG_IMPORTANT : 2);
354
355 assert(header_start && header_end);
356 debugs(55, 7, "parsing hdr: (" << this << ")" << std::endl << getStringPrefix(header_start, hdrLen));
357 ++ HttpHeaderStats[owner].parsedCount;
358
359 char *nulpos;
360 if ((nulpos = (char*)memchr(header_start, '\0', hdrLen))) {
361 debugs(55, DBG_IMPORTANT, "WARNING: HTTP header contains NULL characters {" <<
362 getStringPrefix(header_start, nulpos-header_start) << "}\nNULL\n{" << getStringPrefix(nulpos+1, hdrLen-(nulpos-header_start)-1));
363 clean();
364 return 0;
365 }
366
367 /* common format headers are "<name>:[ws]<value>" lines delimited by <CRLF>.
368 * continuation lines start with a (single) space or tab */
369 while (field_ptr < header_end) {
370 const char *field_start = field_ptr;
371 const char *field_end;
372
373 const char *hasBareCr = nullptr;
374 size_t lines = 0;
375 do {
376 const char *this_line = field_ptr;
377 field_ptr = (const char *)memchr(field_ptr, '\n', header_end - field_ptr);
378 ++lines;
379
380 if (!field_ptr) {
381 // missing <LF>
382 clean();
383 return 0;
384 }
385
386 field_end = field_ptr;
387
388 ++field_ptr; /* Move to next line */
389
390 if (field_end > this_line && field_end[-1] == '\r') {
391 --field_end; /* Ignore CR LF */
392
393 if (owner == hoRequest && field_end > this_line) {
394 bool cr_only = true;
395 for (const char *p = this_line; p < field_end && cr_only; ++p) {
396 if (*p != '\r')
397 cr_only = false;
398 }
399 if (cr_only) {
400 debugs(55, DBG_IMPORTANT, "SECURITY WARNING: Rejecting HTTP request with a CR+ "
401 "header field to prevent request smuggling attacks: {" <<
402 getStringPrefix(header_start, hdrLen) << "}");
403 clean();
404 return 0;
405 }
406 }
407 }
408
409 /* Barf on stray CR characters */
410 if (memchr(this_line, '\r', field_end - this_line)) {
411 hasBareCr = "bare CR";
412 debugs(55, warnOnError, "WARNING: suspicious CR characters in HTTP header {" <<
413 getStringPrefix(field_start, field_end-field_start) << "}");
414
415 if (Config.onoff.relaxed_header_parser) {
416 char *p = (char *) this_line; /* XXX Warning! This destroys original header content and violates specifications somewhat */
417
418 while ((p = (char *)memchr(p, '\r', field_end - p)) != nullptr) {
419 *p = ' ';
420 ++p;
421 }
422 } else {
423 clean();
424 return 0;
425 }
426 }
427
428 if (this_line + 1 == field_end && this_line > field_start) {
429 debugs(55, warnOnError, "WARNING: Blank continuation line in HTTP header {" <<
430 getStringPrefix(header_start, hdrLen) << "}");
431 clean();
432 return 0;
433 }
434 } while (field_ptr < header_end && (*field_ptr == ' ' || *field_ptr == '\t'));
435
436 if (field_start == field_end) {
437 if (field_ptr < header_end) {
438 debugs(55, warnOnError, "WARNING: unparsable HTTP header field near {" <<
439 getStringPrefix(field_start, hdrLen-(field_start-header_start)) << "}");
440 clean();
441 return 0;
442 }
443
444 break; /* terminating blank line */
445 }
446
447 const auto e = HttpHeaderEntry::parse(field_start, field_end, owner);
448 if (!e) {
449 debugs(55, warnOnError, "WARNING: unparsable HTTP header field {" <<
450 getStringPrefix(field_start, field_end-field_start) << "}");
451 debugs(55, warnOnError, " in {" << getStringPrefix(header_start, hdrLen) << "}");
452
453 clean();
454 return 0;
455 }
456
457 if (lines > 1 || hasBareCr) {
458 const auto framingHeader = (e->id == Http::HdrType::CONTENT_LENGTH || e->id == Http::HdrType::TRANSFER_ENCODING);
459 if (framingHeader) {
460 if (!hasBareCr) // already warned about bare CRs
461 debugs(55, warnOnError, "WARNING: obs-fold in framing-sensitive " << e->name << ": " << e->value);
462 delete e;
463 clean();
464 return 0;
465 }
466 }
467
468 if (e->id == Http::HdrType::CONTENT_LENGTH && !clen.checkField(e->value)) {
469 delete e;
470
471 if (Config.onoff.relaxed_header_parser)
472 continue; // clen has printed any necessary warnings
473
474 clean();
475 return 0;
476 }
477
478 addEntry(e);
479 }
480
481 if (clen.headerWideProblem) {
482 debugs(55, warnOnError, "WARNING: " << clen.headerWideProblem <<
483 " Content-Length field values in" <<
484 Raw("header", header_start, hdrLen));
485 }
486
487 String rawTe;
488 if (clen.prohibitedAndIgnored()) {
489 // prohibitedAndIgnored() includes trailer header blocks
490 // being parsed as a case to forbid/ignore these headers.
491
492 // RFC 7230 section 3.3.2: A server MUST NOT send a Content-Length
493 // header field in any response with a status code of 1xx (Informational)
494 // or 204 (No Content). And RFC 7230 3.3.3#1 tells recipients to ignore
495 // such Content-Lengths.
496 if (delById(Http::HdrType::CONTENT_LENGTH))
497 debugs(55, 3, "Content-Length is " << clen.prohibitedAndIgnored());
498
499 // The same RFC 7230 3.3.3#1-based logic applies to Transfer-Encoding
500 // banned by RFC 7230 section 3.3.1.
501 if (delById(Http::HdrType::TRANSFER_ENCODING))
502 debugs(55, 3, "Transfer-Encoding is " << clen.prohibitedAndIgnored());
503
504 } else if (getByIdIfPresent(Http::HdrType::TRANSFER_ENCODING, &rawTe)) {
505 // RFC 2616 section 4.4: ignore Content-Length with Transfer-Encoding
506 // RFC 7230 section 3.3.3 #3: Transfer-Encoding overwrites Content-Length
507 delById(Http::HdrType::CONTENT_LENGTH);
508 // and clen state becomes irrelevant
509
510 if (rawTe.caseCmp("chunked") == 0) {
511 ; // leave header present for chunked() method
512 } else if (rawTe.caseCmp("identity") == 0) { // deprecated. no coding
513 delById(Http::HdrType::TRANSFER_ENCODING);
514 } else {
515 // This also rejects multiple encodings until we support them properly.
516 debugs(55, warnOnError, "WARNING: unsupported Transfer-Encoding used by client: " << rawTe);
517 teUnsupported_ = true;
518 }
519
520 } else if (clen.sawBad) {
521 // ensure our callers do not accidentally see bad Content-Length values
522 delById(Http::HdrType::CONTENT_LENGTH);
523 conflictingContentLength_ = true; // TODO: Rename to badContentLength_.
524 } else if (clen.needsSanitizing) {
525 // RFC 7230 section 3.3.2: MUST either reject or ... [sanitize];
526 // ensure our callers see a clean Content-Length value or none at all
527 delById(Http::HdrType::CONTENT_LENGTH);
528 if (clen.sawGood) {
529 putInt64(Http::HdrType::CONTENT_LENGTH, clen.value);
530 debugs(55, 5, "sanitized Content-Length to be " << clen.value);
531 }
532 }
533
534 return 1; /* even if no fields where found, it is a valid header */
535 }
536
537 /* packs all the entries using supplied packer */
538 void
539 HttpHeader::packInto(Packable * p, bool mask_sensitive_info) const
540 {
541 HttpHeaderPos pos = HttpHeaderInitPos;
542 const HttpHeaderEntry *e;
543 assert(p);
544 debugs(55, 7, this << " into " << p <<
545 (mask_sensitive_info ? " while masking" : ""));
546 /* pack all entries one by one */
547 while ((e = getEntry(&pos))) {
548 if (!mask_sensitive_info) {
549 e->packInto(p);
550 continue;
551 }
552
553 bool maskThisEntry = false;
554 switch (e->id) {
555 case Http::HdrType::AUTHORIZATION:
556 case Http::HdrType::PROXY_AUTHORIZATION:
557 maskThisEntry = true;
558 break;
559
560 case Http::HdrType::FTP_ARGUMENTS:
561 if (const HttpHeaderEntry *cmd = findEntry(Http::HdrType::FTP_COMMAND))
562 maskThisEntry = (cmd->value == "PASS");
563 break;
564
565 default:
566 break;
567 }
568 if (maskThisEntry) {
569 p->append(e->name.rawContent(), e->name.length());
570 p->append(": ** NOT DISPLAYED **\r\n", 23);
571 } else {
572 e->packInto(p);
573 }
574
575 }
576 /* Pack in the "special" entries */
577
578 /* Cache-Control */
579 }
580
581 /* returns next valid entry */
582 HttpHeaderEntry *
583 HttpHeader::getEntry(HttpHeaderPos * pos) const
584 {
585 assert(pos);
586 assert(*pos >= HttpHeaderInitPos && *pos < static_cast<ssize_t>(entries.size()));
587
588 for (++(*pos); *pos < static_cast<ssize_t>(entries.size()); ++(*pos)) {
589 if (entries[*pos])
590 return static_cast<HttpHeaderEntry*>(entries[*pos]);
591 }
592
593 return nullptr;
594 }
595
596 /*
597 * returns a pointer to a specified entry if any
598 * note that we return one entry so it does not make much sense to ask for
599 * "list" headers
600 */
601 HttpHeaderEntry *
602 HttpHeader::findEntry(Http::HdrType id) const
603 {
604 assert(any_registered_header(id));
605 assert(!Http::HeaderLookupTable.lookup(id).list);
606
607 /* check mask first */
608
609 if (!CBIT_TEST(mask, id))
610 return nullptr;
611
612 /* looks like we must have it, do linear search */
613 for (auto e : entries) {
614 if (e && e->id == id)
615 return e;
616 }
617
618 /* hm.. we thought it was there, but it was not found */
619 assert(false);
620 return nullptr; /* not reached */
621 }
622
623 /*
624 * same as httpHeaderFindEntry
625 */
626 HttpHeaderEntry *
627 HttpHeader::findLastEntry(Http::HdrType id) const
628 {
629 assert(any_registered_header(id));
630 assert(!Http::HeaderLookupTable.lookup(id).list);
631
632 /* check mask first */
633 if (!CBIT_TEST(mask, id))
634 return nullptr;
635
636 for (auto e = entries.rbegin(); e != entries.rend(); ++e) {
637 if (*e && (*e)->id == id)
638 return *e;
639 }
640
641 /* hm.. we thought it was there, but it was not found */
642 assert(false);
643 return nullptr; /* not reached */
644 }
645
646 int
647 HttpHeader::delByName(const SBuf &name)
648 {
649 int count = 0;
650 HttpHeaderPos pos = HttpHeaderInitPos;
651 httpHeaderMaskInit(&mask, 0); /* temporal inconsistency */
652 debugs(55, 9, "deleting '" << name << "' fields in hdr " << this);
653
654 while (const HttpHeaderEntry *e = getEntry(&pos)) {
655 if (!e->name.caseCmp(name))
656 delAt(pos, count);
657 else
658 CBIT_SET(mask, e->id);
659 }
660
661 return count;
662 }
663
664 /* deletes all entries with a given id, returns the #entries deleted */
665 int
666 HttpHeader::delById(Http::HdrType id)
667 {
668 debugs(55, 8, this << " del-by-id " << id);
669 assert(any_registered_header(id));
670
671 if (!CBIT_TEST(mask, id))
672 return 0;
673
674 int count = 0;
675
676 HttpHeaderPos pos = HttpHeaderInitPos;
677 while (HttpHeaderEntry *e = getEntry(&pos)) {
678 if (e->id == id)
679 delAt(pos, count); // deletes e
680 }
681
682 CBIT_CLR(mask, id);
683 assert(count);
684 return count;
685 }
686
687 /*
688 * deletes an entry at pos and leaves a gap; leaving a gap makes it
689 * possible to iterate(search) and delete fields at the same time
690 * NOTE: Does not update the header mask. Caller must follow up with
691 * a call to refreshMask() if headers_deleted was incremented.
692 */
693 void
694 HttpHeader::delAt(HttpHeaderPos pos, int &headers_deleted)
695 {
696 HttpHeaderEntry *e;
697 assert(pos >= HttpHeaderInitPos && pos < static_cast<ssize_t>(entries.size()));
698 e = static_cast<HttpHeaderEntry*>(entries[pos]);
699 entries[pos] = nullptr;
700 /* decrement header length, allow for ": " and crlf */
701 len -= e->name.length() + 2 + e->value.size() + 2;
702 assert(len >= 0);
703 delete e;
704 ++headers_deleted;
705 }
706
707 /*
708 * Compacts the header storage
709 */
710 void
711 HttpHeader::compact()
712 {
713 // TODO: optimize removal, or possibly make it so that's not needed.
714 entries.erase( std::remove(entries.begin(), entries.end(), nullptr),
715 entries.end());
716 }
717
718 /*
719 * Refreshes the header mask. Required after delAt() calls.
720 */
721 void
722 HttpHeader::refreshMask()
723 {
724 httpHeaderMaskInit(&mask, 0);
725 debugs(55, 7, "refreshing the mask in hdr " << this);
726 for (auto e : entries) {
727 if (e)
728 CBIT_SET(mask, e->id);
729 }
730 }
731
732 /* appends an entry;
733 * does not call e->clone() so one should not reuse "*e"
734 */
735 void
736 HttpHeader::addEntry(HttpHeaderEntry * e)
737 {
738 assert(e);
739 assert(any_HdrType_enum_value(e->id));
740 assert(e->name.length());
741
742 debugs(55, 7, this << " adding entry: " << e->id << " at " << entries.size());
743
744 if (e->id != Http::HdrType::BAD_HDR) {
745 if (CBIT_TEST(mask, e->id)) {
746 ++ headerStatsTable[e->id].repCount;
747 } else {
748 CBIT_SET(mask, e->id);
749 }
750 }
751
752 entries.push_back(e);
753
754 len += e->length();
755 }
756
757 bool
758 HttpHeader::getList(Http::HdrType id, String *s) const
759 {
760 debugs(55, 9, this << " joining for id " << id);
761 /* only fields from ListHeaders array can be "listed" */
762 assert(Http::HeaderLookupTable.lookup(id).list);
763
764 if (!CBIT_TEST(mask, id))
765 return false;
766
767 for (auto e: entries) {
768 if (e && e->id == id)
769 strListAdd(s, e->value.termedBuf(), ',');
770 }
771
772 /*
773 * note: we might get an empty (size==0) string if there was an "empty"
774 * header. This results in an empty length String, which may have a NULL
775 * buffer.
776 */
777 /* temporary warning: remove it? (Is it useful for diagnostics ?) */
778 if (!s->size())
779 debugs(55, 3, "empty list header: " << Http::HeaderLookupTable.lookup(id).name << "(" << id << ")");
780 else
781 debugs(55, 6, this << ": joined for id " << id << ": " << s);
782
783 return true;
784 }
785
786 /* return a list of entries with the same id separated by ',' and ws */
787 String
788 HttpHeader::getList(Http::HdrType id) const
789 {
790 HttpHeaderEntry *e;
791 HttpHeaderPos pos = HttpHeaderInitPos;
792 debugs(55, 9, this << "joining for id " << id);
793 /* only fields from ListHeaders array can be "listed" */
794 assert(Http::HeaderLookupTable.lookup(id).list);
795
796 if (!CBIT_TEST(mask, id))
797 return String();
798
799 String s;
800
801 while ((e = getEntry(&pos))) {
802 if (e->id == id)
803 strListAdd(&s, e->value.termedBuf(), ',');
804 }
805
806 /*
807 * note: we might get an empty (size==0) string if there was an "empty"
808 * header. This results in an empty length String, which may have a NULL
809 * buffer.
810 */
811 /* temporary warning: remove it? (Is it useful for diagnostics ?) */
812 if (!s.size())
813 debugs(55, 3, "empty list header: " << Http::HeaderLookupTable.lookup(id).name << "(" << id << ")");
814 else
815 debugs(55, 6, this << ": joined for id " << id << ": " << s);
816
817 return s;
818 }
819
820 /* return a string or list of entries with the same id separated by ',' and ws */
821 String
822 HttpHeader::getStrOrList(Http::HdrType id) const
823 {
824 HttpHeaderEntry *e;
825
826 if (Http::HeaderLookupTable.lookup(id).list)
827 return getList(id);
828
829 if ((e = findEntry(id)))
830 return e->value;
831
832 return String();
833 }
834
835 /*
836 * Returns the value of the specified header and/or an undefined String.
837 */
838 String
839 HttpHeader::getByName(const char *name) const
840 {
841 String result;
842 // ignore presence: return undefined string if an empty header is present
843 (void)hasNamed(name, strlen(name), &result);
844 return result;
845 }
846
847 String
848 HttpHeader::getByName(const SBuf &name) const
849 {
850 String result;
851 // ignore presence: return undefined string if an empty header is present
852 (void)hasNamed(name, &result);
853 return result;
854 }
855
856 String
857 HttpHeader::getById(Http::HdrType id) const
858 {
859 String result;
860 (void)getByIdIfPresent(id, &result);
861 return result;
862 }
863
864 bool
865 HttpHeader::hasNamed(const SBuf &s, String *result) const
866 {
867 return hasNamed(s.rawContent(), s.length(), result);
868 }
869
870 bool
871 HttpHeader::getByIdIfPresent(Http::HdrType id, String *result) const
872 {
873 if (id == Http::HdrType::BAD_HDR)
874 return false;
875 if (!has(id))
876 return false;
877 if (result)
878 *result = getStrOrList(id);
879 return true;
880 }
881
882 bool
883 HttpHeader::hasNamed(const char *name, unsigned int namelen, String *result) const
884 {
885 Http::HdrType id;
886 HttpHeaderPos pos = HttpHeaderInitPos;
887 HttpHeaderEntry *e;
888
889 assert(name);
890
891 /* First try the quick path */
892 id = Http::HeaderLookupTable.lookup(name,namelen).id;
893
894 if (id != Http::HdrType::BAD_HDR) {
895 if (getByIdIfPresent(id, result))
896 return true;
897 }
898
899 /* Sorry, an unknown header name. Do linear search */
900 bool found = false;
901 while ((e = getEntry(&pos))) {
902 if (e->id == Http::HdrType::OTHER && e->name.length() == namelen && e->name.caseCmp(name, namelen) == 0) {
903 found = true;
904 if (!result)
905 break;
906 strListAdd(result, e->value.termedBuf(), ',');
907 }
908 }
909
910 return found;
911 }
912
913 /*
914 * Returns a the value of the specified list member, if any.
915 */
916 SBuf
917 HttpHeader::getByNameListMember(const char *name, const char *member, const char separator) const
918 {
919 assert(name);
920 const auto header = getByName(name);
921 return ::getListMember(header, member, separator);
922 }
923
924 /*
925 * returns a the value of the specified list member, if any.
926 */
927 SBuf
928 HttpHeader::getListMember(Http::HdrType id, const char *member, const char separator) const
929 {
930 assert(any_registered_header(id));
931 const auto header = getStrOrList(id);
932 return ::getListMember(header, member, separator);
933 }
934
935 /* test if a field is present */
936 int
937 HttpHeader::has(Http::HdrType id) const
938 {
939 assert(any_registered_header(id));
940 debugs(55, 9, this << " lookup for " << id);
941 return CBIT_TEST(mask, id);
942 }
943
944 void
945 HttpHeader::addVia(const AnyP::ProtocolVersion &ver, const HttpHeader *from)
946 {
947 // TODO: do not add Via header for messages where Squid itself
948 // generated the message (i.e., Downloader) there should be no Via header added at all.
949
950 if (Config.onoff.via) {
951 SBuf buf;
952 // RFC 7230 section 5.7.1.: protocol-name is omitted when
953 // the received protocol is HTTP.
954 if (ver.protocol > AnyP::PROTO_NONE && ver.protocol < AnyP::PROTO_UNKNOWN &&
955 ver.protocol != AnyP::PROTO_HTTP && ver.protocol != AnyP::PROTO_HTTPS)
956 buf.appendf("%s/", AnyP::ProtocolType_str[ver.protocol]);
957 buf.appendf("%d.%d %s", ver.major, ver.minor, ThisCache);
958 const HttpHeader *hdr = from ? from : this;
959 SBuf strVia = StringToSBuf(hdr->getList(Http::HdrType::VIA));
960 if (!strVia.isEmpty())
961 strVia.append(", ", 2);
962 strVia.append(buf);
963 updateOrAddStr(Http::HdrType::VIA, strVia);
964 }
965 }
966
967 void
968 HttpHeader::putInt(Http::HdrType id, int number)
969 {
970 assert(any_registered_header(id));
971 assert(Http::HeaderLookupTable.lookup(id).type == Http::HdrFieldType::ftInt); /* must be of an appropriate type */
972 assert(number >= 0);
973 addEntry(new HttpHeaderEntry(id, SBuf(), xitoa(number)));
974 }
975
976 void
977 HttpHeader::putInt64(Http::HdrType id, int64_t number)
978 {
979 assert(any_registered_header(id));
980 assert(Http::HeaderLookupTable.lookup(id).type == Http::HdrFieldType::ftInt64); /* must be of an appropriate type */
981 assert(number >= 0);
982 addEntry(new HttpHeaderEntry(id, SBuf(), xint64toa(number)));
983 }
984
985 void
986 HttpHeader::putTime(Http::HdrType id, time_t htime)
987 {
988 assert(any_registered_header(id));
989 assert(Http::HeaderLookupTable.lookup(id).type == Http::HdrFieldType::ftDate_1123); /* must be of an appropriate type */
990 assert(htime >= 0);
991 addEntry(new HttpHeaderEntry(id, SBuf(), Time::FormatRfc1123(htime)));
992 }
993
994 void
995 HttpHeader::putStr(Http::HdrType id, const char *str)
996 {
997 assert(any_registered_header(id));
998 assert(Http::HeaderLookupTable.lookup(id).type == Http::HdrFieldType::ftStr); /* must be of an appropriate type */
999 assert(str);
1000 addEntry(new HttpHeaderEntry(id, SBuf(), str));
1001 }
1002
1003 void
1004 HttpHeader::putAuth(const char *auth_scheme, const char *realm)
1005 {
1006 assert(auth_scheme && realm);
1007 httpHeaderPutStrf(this, Http::HdrType::WWW_AUTHENTICATE, "%s realm=\"%s\"", auth_scheme, realm);
1008 }
1009
1010 void
1011 HttpHeader::putCc(const HttpHdrCc &cc)
1012 {
1013 /* remove old directives if any */
1014 delById(Http::HdrType::CACHE_CONTROL);
1015 /* pack into mb */
1016 MemBuf mb;
1017 mb.init();
1018 cc.packInto(&mb);
1019 /* put */
1020 addEntry(new HttpHeaderEntry(Http::HdrType::CACHE_CONTROL, SBuf(), mb.buf));
1021 /* cleanup */
1022 mb.clean();
1023 }
1024
1025 void
1026 HttpHeader::putContRange(const HttpHdrContRange * cr)
1027 {
1028 assert(cr);
1029 /* remove old directives if any */
1030 delById(Http::HdrType::CONTENT_RANGE);
1031 /* pack into mb */
1032 MemBuf mb;
1033 mb.init();
1034 httpHdrContRangePackInto(cr, &mb);
1035 /* put */
1036 addEntry(new HttpHeaderEntry(Http::HdrType::CONTENT_RANGE, SBuf(), mb.buf));
1037 /* cleanup */
1038 mb.clean();
1039 }
1040
1041 void
1042 HttpHeader::putRange(const HttpHdrRange * range)
1043 {
1044 assert(range);
1045 /* remove old directives if any */
1046 delById(Http::HdrType::RANGE);
1047 /* pack into mb */
1048 MemBuf mb;
1049 mb.init();
1050 range->packInto(&mb);
1051 /* put */
1052 addEntry(new HttpHeaderEntry(Http::HdrType::RANGE, SBuf(), mb.buf));
1053 /* cleanup */
1054 mb.clean();
1055 }
1056
1057 void
1058 HttpHeader::putSc(HttpHdrSc *sc)
1059 {
1060 assert(sc);
1061 /* remove old directives if any */
1062 delById(Http::HdrType::SURROGATE_CONTROL);
1063 /* pack into mb */
1064 MemBuf mb;
1065 mb.init();
1066 sc->packInto(&mb);
1067 /* put */
1068 addEntry(new HttpHeaderEntry(Http::HdrType::SURROGATE_CONTROL, SBuf(), mb.buf));
1069 /* cleanup */
1070 mb.clean();
1071 }
1072
1073 /* add extension header (these fields are not parsed/analyzed/joined, etc.) */
1074 void
1075 HttpHeader::putExt(const char *name, const char *value)
1076 {
1077 assert(name && value);
1078 debugs(55, 8, this << " adds ext entry " << name << " : " << value);
1079 addEntry(new HttpHeaderEntry(Http::HdrType::OTHER, SBuf(name), value));
1080 }
1081
1082 void
1083 HttpHeader::updateOrAddStr(const Http::HdrType id, const SBuf &newValue)
1084 {
1085 assert(any_registered_header(id));
1086 assert(Http::HeaderLookupTable.lookup(id).type == Http::HdrFieldType::ftStr);
1087
1088 // XXX: HttpHeaderEntry::value suffers from String size limits
1089 Assure(newValue.length() < String::SizeMaxXXX());
1090
1091 if (!CBIT_TEST(mask, id)) {
1092 auto newValueCopy = newValue; // until HttpHeaderEntry::value becomes SBuf
1093 addEntry(new HttpHeaderEntry(id, SBuf(), newValueCopy.c_str()));
1094 return;
1095 }
1096
1097 auto foundSameName = false;
1098 for (auto &e: entries) {
1099 if (!e || e->id != id)
1100 continue;
1101
1102 if (foundSameName) {
1103 // get rid of this repeated same-name entry
1104 delete e;
1105 e = nullptr;
1106 continue;
1107 }
1108
1109 if (newValue.cmp(e->value.termedBuf()) != 0)
1110 e->value.assign(newValue.rawContent(), newValue.plength());
1111
1112 foundSameName = true;
1113 // continue to delete any repeated same-name entries
1114 }
1115 assert(foundSameName);
1116 debugs(55, 5, "synced: " << Http::HeaderLookupTable.lookup(id).name << ": " << newValue);
1117 }
1118
1119 int
1120 HttpHeader::getInt(Http::HdrType id) const
1121 {
1122 assert(any_registered_header(id));
1123 assert(Http::HeaderLookupTable.lookup(id).type == Http::HdrFieldType::ftInt); /* must be of an appropriate type */
1124 HttpHeaderEntry *e;
1125
1126 if ((e = findEntry(id)))
1127 return e->getInt();
1128
1129 return -1;
1130 }
1131
1132 int64_t
1133 HttpHeader::getInt64(Http::HdrType id) const
1134 {
1135 assert(any_registered_header(id));
1136 assert(Http::HeaderLookupTable.lookup(id).type == Http::HdrFieldType::ftInt64); /* must be of an appropriate type */
1137 HttpHeaderEntry *e;
1138
1139 if ((e = findEntry(id)))
1140 return e->getInt64();
1141
1142 return -1;
1143 }
1144
1145 time_t
1146 HttpHeader::getTime(Http::HdrType id) const
1147 {
1148 HttpHeaderEntry *e;
1149 time_t value = -1;
1150 assert(any_registered_header(id));
1151 assert(Http::HeaderLookupTable.lookup(id).type == Http::HdrFieldType::ftDate_1123); /* must be of an appropriate type */
1152
1153 if ((e = findEntry(id))) {
1154 value = Time::ParseRfc1123(e->value.termedBuf());
1155 httpHeaderNoteParsedEntry(e->id, e->value, value < 0);
1156 }
1157
1158 return value;
1159 }
1160
1161 /* sync with httpHeaderGetLastStr */
1162 const char *
1163 HttpHeader::getStr(Http::HdrType id) const
1164 {
1165 HttpHeaderEntry *e;
1166 assert(any_registered_header(id));
1167 assert(Http::HeaderLookupTable.lookup(id).type == Http::HdrFieldType::ftStr); /* must be of an appropriate type */
1168
1169 if ((e = findEntry(id))) {
1170 httpHeaderNoteParsedEntry(e->id, e->value, false); /* no errors are possible */
1171 return e->value.termedBuf();
1172 }
1173
1174 return nullptr;
1175 }
1176
1177 /* unusual */
1178 const char *
1179 HttpHeader::getLastStr(Http::HdrType id) const
1180 {
1181 HttpHeaderEntry *e;
1182 assert(any_registered_header(id));
1183 assert(Http::HeaderLookupTable.lookup(id).type == Http::HdrFieldType::ftStr); /* must be of an appropriate type */
1184
1185 if ((e = findLastEntry(id))) {
1186 httpHeaderNoteParsedEntry(e->id, e->value, false); /* no errors are possible */
1187 return e->value.termedBuf();
1188 }
1189
1190 return nullptr;
1191 }
1192
1193 HttpHdrCc *
1194 HttpHeader::getCc() const
1195 {
1196 if (!CBIT_TEST(mask, Http::HdrType::CACHE_CONTROL))
1197 return nullptr;
1198
1199 String s;
1200 getList(Http::HdrType::CACHE_CONTROL, &s);
1201
1202 HttpHdrCc *cc=new HttpHdrCc();
1203
1204 if (!cc->parse(s)) {
1205 delete cc;
1206 cc = nullptr;
1207 }
1208
1209 ++ HttpHeaderStats[owner].ccParsedCount;
1210
1211 if (cc)
1212 httpHdrCcUpdateStats(cc, &HttpHeaderStats[owner].ccTypeDistr);
1213
1214 httpHeaderNoteParsedEntry(Http::HdrType::CACHE_CONTROL, s, !cc);
1215
1216 return cc;
1217 }
1218
1219 HttpHdrRange *
1220 HttpHeader::getRange() const
1221 {
1222 HttpHdrRange *r = nullptr;
1223 HttpHeaderEntry *e;
1224 /* some clients will send "Request-Range" _and_ *matching* "Range"
1225 * who knows, some clients might send Request-Range only;
1226 * this "if" should work correctly in both cases;
1227 * hopefully no clients send mismatched headers! */
1228
1229 if ((e = findEntry(Http::HdrType::RANGE)) ||
1230 (e = findEntry(Http::HdrType::REQUEST_RANGE))) {
1231 r = HttpHdrRange::ParseCreate(&e->value);
1232 httpHeaderNoteParsedEntry(e->id, e->value, !r);
1233 }
1234
1235 return r;
1236 }
1237
1238 HttpHdrSc *
1239 HttpHeader::getSc() const
1240 {
1241 if (!CBIT_TEST(mask, Http::HdrType::SURROGATE_CONTROL))
1242 return nullptr;
1243
1244 String s;
1245
1246 (void) getList(Http::HdrType::SURROGATE_CONTROL, &s);
1247
1248 HttpHdrSc *sc = httpHdrScParseCreate(s);
1249
1250 ++ HttpHeaderStats[owner].ccParsedCount;
1251
1252 if (sc)
1253 sc->updateStats(&HttpHeaderStats[owner].scTypeDistr);
1254
1255 httpHeaderNoteParsedEntry(Http::HdrType::SURROGATE_CONTROL, s, !sc);
1256
1257 return sc;
1258 }
1259
1260 HttpHdrContRange *
1261 HttpHeader::getContRange() const
1262 {
1263 HttpHdrContRange *cr = nullptr;
1264 HttpHeaderEntry *e;
1265
1266 if ((e = findEntry(Http::HdrType::CONTENT_RANGE))) {
1267 cr = httpHdrContRangeParseCreate(e->value.termedBuf());
1268 httpHeaderNoteParsedEntry(e->id, e->value, !cr);
1269 }
1270
1271 return cr;
1272 }
1273
1274 SBuf
1275 HttpHeader::getAuthToken(Http::HdrType id, const char *auth_scheme) const
1276 {
1277 const char *field;
1278 int l;
1279 assert(auth_scheme);
1280 field = getStr(id);
1281
1282 static const SBuf nil;
1283 if (!field) /* no authorization field */
1284 return nil;
1285
1286 l = strlen(auth_scheme);
1287
1288 if (!l || strncasecmp(field, auth_scheme, l)) /* wrong scheme */
1289 return nil;
1290
1291 field += l;
1292
1293 if (!xisspace(*field)) /* wrong scheme */
1294 return nil;
1295
1296 /* skip white space */
1297 for (; field && xisspace(*field); ++field);
1298
1299 if (!*field) /* no authorization cookie */
1300 return nil;
1301
1302 const auto fieldLen = strlen(field);
1303 SBuf result;
1304 char *decodedAuthToken = result.rawAppendStart(BASE64_DECODE_LENGTH(fieldLen));
1305 struct base64_decode_ctx ctx;
1306 base64_decode_init(&ctx);
1307 size_t decodedLen = 0;
1308 if (!base64_decode_update(&ctx, &decodedLen, reinterpret_cast<uint8_t*>(decodedAuthToken), fieldLen, field) ||
1309 !base64_decode_final(&ctx)) {
1310 return nil;
1311 }
1312 result.rawAppendFinish(decodedAuthToken, decodedLen);
1313 return result;
1314 }
1315
1316 ETag
1317 HttpHeader::getETag(Http::HdrType id) const
1318 {
1319 ETag etag = {nullptr, -1};
1320 HttpHeaderEntry *e;
1321 assert(Http::HeaderLookupTable.lookup(id).type == Http::HdrFieldType::ftETag); /* must be of an appropriate type */
1322
1323 if ((e = findEntry(id)))
1324 etagParseInit(&etag, e->value.termedBuf());
1325
1326 return etag;
1327 }
1328
1329 TimeOrTag
1330 HttpHeader::getTimeOrTag(Http::HdrType id) const
1331 {
1332 TimeOrTag tot;
1333 HttpHeaderEntry *e;
1334 assert(Http::HeaderLookupTable.lookup(id).type == Http::HdrFieldType::ftDate_1123_or_ETag); /* must be of an appropriate type */
1335 memset(&tot, 0, sizeof(tot));
1336
1337 if ((e = findEntry(id))) {
1338 const char *str = e->value.termedBuf();
1339 /* try as an ETag */
1340
1341 if (etagParseInit(&tot.tag, str)) {
1342 tot.valid = tot.tag.str != nullptr;
1343 tot.time = -1;
1344 } else {
1345 /* or maybe it is time? */
1346 tot.time = Time::ParseRfc1123(str);
1347 tot.valid = tot.time >= 0;
1348 tot.tag.str = nullptr;
1349 }
1350 }
1351
1352 assert(tot.time < 0 || !tot.tag.str); /* paranoid */
1353 return tot;
1354 }
1355
1356 /*
1357 * HttpHeaderEntry
1358 */
1359
1360 HttpHeaderEntry::HttpHeaderEntry(Http::HdrType anId, const SBuf &aName, const char *aValue)
1361 {
1362 assert(any_HdrType_enum_value(anId));
1363 id = anId;
1364
1365 if (id != Http::HdrType::OTHER)
1366 name = Http::HeaderLookupTable.lookup(id).name;
1367 else
1368 name = aName;
1369
1370 value = aValue;
1371
1372 if (id != Http::HdrType::BAD_HDR)
1373 ++ headerStatsTable[id].aliveCount;
1374
1375 debugs(55, 9, "created HttpHeaderEntry " << this << ": '" << name << " : " << value );
1376 }
1377
1378 HttpHeaderEntry::~HttpHeaderEntry()
1379 {
1380 debugs(55, 9, "destroying entry " << this << ": '" << name << ": " << value << "'");
1381
1382 if (id != Http::HdrType::BAD_HDR) {
1383 assert(headerStatsTable[id].aliveCount);
1384 -- headerStatsTable[id].aliveCount;
1385 id = Http::HdrType::BAD_HDR; // it already is BAD_HDR, no sense in resetting it
1386 }
1387
1388 }
1389
1390 /* parses and inits header entry, returns true/false */
1391 HttpHeaderEntry *
1392 HttpHeaderEntry::parse(const char *field_start, const char *field_end, const http_hdr_owner_type msgType)
1393 {
1394 /* note: name_start == field_start */
1395 const char *name_end = (const char *)memchr(field_start, ':', field_end - field_start);
1396 int name_len = name_end ? name_end - field_start :0;
1397 const char *value_start = field_start + name_len + 1; /* skip ':' */
1398 /* note: value_end == field_end */
1399
1400 ++ HeaderEntryParsedCount;
1401
1402 /* do we have a valid field name within this field? */
1403
1404 if (!name_len || name_end > field_end)
1405 return nullptr;
1406
1407 if (name_len > 65534) {
1408 /* String must be LESS THAN 64K and it adds a terminating NULL */
1409 // TODO: update this to show proper name_len in Raw markup, but not print all that
1410 debugs(55, 2, "ignoring huge header field (" << Raw("field_start", field_start, 100) << "...)");
1411 return nullptr;
1412 }
1413
1414 /*
1415 * RFC 7230 section 3.2.4:
1416 * "No whitespace is allowed between the header field-name and colon.
1417 * ...
1418 * A server MUST reject any received request message that contains
1419 * whitespace between a header field-name and colon with a response code
1420 * of 400 (Bad Request). A proxy MUST remove any such whitespace from a
1421 * response message before forwarding the message downstream."
1422 */
1423 if (xisspace(field_start[name_len - 1])) {
1424
1425 if (msgType == hoRequest)
1426 return nullptr;
1427
1428 // for now, also let relaxed parser remove this BWS from any non-HTTP messages
1429 const bool stripWhitespace = (msgType == hoReply) ||
1430 Config.onoff.relaxed_header_parser;
1431 if (!stripWhitespace)
1432 return nullptr; // reject if we cannot strip
1433
1434 debugs(55, Config.onoff.relaxed_header_parser <= 0 ? 1 : 2,
1435 "WARNING: Whitespace after header name in '" << getStringPrefix(field_start, field_end-field_start) << "'");
1436
1437 while (name_len > 0 && xisspace(field_start[name_len - 1]))
1438 --name_len;
1439
1440 if (!name_len) {
1441 debugs(55, 2, "found header with only whitespace for name");
1442 return nullptr;
1443 }
1444 }
1445
1446 /* RFC 7230 section 3.2:
1447 *
1448 * header-field = field-name ":" OWS field-value OWS
1449 * field-name = token
1450 * token = 1*TCHAR
1451 */
1452 for (const char *pos = field_start; pos < (field_start+name_len); ++pos) {
1453 if (!CharacterSet::TCHAR[*pos]) {
1454 debugs(55, 2, "found header with invalid characters in " <<
1455 Raw("field-name", field_start, min(name_len,100)) << "...");
1456 return nullptr;
1457 }
1458 }
1459
1460 /* now we know we can parse it */
1461
1462 debugs(55, 9, "parsing HttpHeaderEntry: near '" << getStringPrefix(field_start, field_end-field_start) << "'");
1463
1464 /* is it a "known" field? */
1465 Http::HdrType id = Http::HeaderLookupTable.lookup(field_start,name_len).id;
1466 debugs(55, 9, "got hdr-id=" << id);
1467
1468 SBuf theName;
1469
1470 String value;
1471
1472 if (id == Http::HdrType::BAD_HDR)
1473 id = Http::HdrType::OTHER;
1474
1475 /* set field name */
1476 if (id == Http::HdrType::OTHER)
1477 theName.append(field_start, name_len);
1478 else
1479 theName = Http::HeaderLookupTable.lookup(id).name;
1480
1481 /* trim field value */
1482 while (value_start < field_end && xisspace(*value_start))
1483 ++value_start;
1484
1485 while (value_start < field_end && xisspace(field_end[-1]))
1486 --field_end;
1487
1488 if (field_end - value_start > 65534) {
1489 /* String must be LESS THAN 64K and it adds a terminating NULL */
1490 debugs(55, 2, "WARNING: found '" << theName << "' header of " << (field_end - value_start) << " bytes");
1491 return nullptr;
1492 }
1493
1494 /* set field value */
1495 value.assign(value_start, field_end - value_start);
1496
1497 if (id != Http::HdrType::BAD_HDR)
1498 ++ headerStatsTable[id].seenCount;
1499
1500 debugs(55, 9, "parsed HttpHeaderEntry: '" << theName << ": " << value << "'");
1501
1502 return new HttpHeaderEntry(id, theName, value.termedBuf());
1503 }
1504
1505 HttpHeaderEntry *
1506 HttpHeaderEntry::clone() const
1507 {
1508 return new HttpHeaderEntry(id, name, value.termedBuf());
1509 }
1510
1511 void
1512 HttpHeaderEntry::packInto(Packable * p) const
1513 {
1514 assert(p);
1515 p->append(name.rawContent(), name.length());
1516 p->append(": ", 2);
1517 p->append(value.rawBuf(), value.size());
1518 p->append("\r\n", 2);
1519 }
1520
1521 int
1522 HttpHeaderEntry::getInt() const
1523 {
1524 int val = -1;
1525 int ok = httpHeaderParseInt(value.termedBuf(), &val);
1526 httpHeaderNoteParsedEntry(id, value, ok == 0);
1527 /* XXX: Should we check ok - ie
1528 * return ok ? -1 : value;
1529 */
1530 return val;
1531 }
1532
1533 int64_t
1534 HttpHeaderEntry::getInt64() const
1535 {
1536 int64_t val = -1;
1537 const bool ok = httpHeaderParseOffset(value.termedBuf(), &val);
1538 httpHeaderNoteParsedEntry(id, value, !ok);
1539 return val; // remains -1 if !ok (XXX: bad method API)
1540 }
1541
1542 static void
1543 httpHeaderNoteParsedEntry(Http::HdrType id, String const &context, bool error)
1544 {
1545 if (id != Http::HdrType::BAD_HDR)
1546 ++ headerStatsTable[id].parsCount;
1547
1548 if (error) {
1549 if (id != Http::HdrType::BAD_HDR)
1550 ++ headerStatsTable[id].errCount;
1551 debugs(55, 2, "cannot parse hdr field: '" << Http::HeaderLookupTable.lookup(id).name << ": " << context << "'");
1552 }
1553 }
1554
1555 /*
1556 * Reports
1557 */
1558
1559 /* tmp variable used to pass stat info to dumpers */
1560 extern const HttpHeaderStat *dump_stat; /* argh! */
1561 const HttpHeaderStat *dump_stat = nullptr;
1562
1563 static void
1564 httpHeaderFieldStatDumper(StoreEntry * sentry, int, double val, double, int count)
1565 {
1566 const int id = static_cast<int>(val);
1567 const bool valid_id = Http::any_valid_header(static_cast<Http::HdrType>(id));
1568 const char *name = valid_id ? Http::HeaderLookupTable.lookup(static_cast<Http::HdrType>(id)).name : "INVALID";
1569 int visible = count > 0;
1570 /* for entries with zero count, list only those that belong to current type of message */
1571
1572 if (!visible && valid_id && dump_stat->owner_mask)
1573 visible = CBIT_TEST(*dump_stat->owner_mask, id);
1574
1575 if (visible)
1576 storeAppendPrintf(sentry, "%2d\t %-20s\t %5d\t %6.2f\n",
1577 id, name, count, xdiv(count, dump_stat->busyDestroyedCount));
1578 }
1579
1580 static void
1581 httpHeaderFldsPerHdrDumper(StoreEntry * sentry, int idx, double val, double, int count)
1582 {
1583 if (count)
1584 storeAppendPrintf(sentry, "%2d\t %5d\t %5d\t %6.2f\n",
1585 idx, (int) val, count,
1586 xpercent(count, dump_stat->destroyedCount));
1587 }
1588
1589 static void
1590 httpHeaderStatDump(const HttpHeaderStat * hs, StoreEntry * e)
1591 {
1592 assert(hs);
1593 assert(e);
1594
1595 if (!hs->owner_mask)
1596 return; // these HttpHeaderStat objects were not meant to be dumped here
1597
1598 dump_stat = hs;
1599 storeAppendPrintf(e, "\nHeader Stats: %s\n", hs->label);
1600 storeAppendPrintf(e, "\nField type distribution\n");
1601 storeAppendPrintf(e, "%2s\t %-20s\t %5s\t %6s\n",
1602 "id", "name", "count", "#/header");
1603 hs->fieldTypeDistr.dump(e, httpHeaderFieldStatDumper);
1604 storeAppendPrintf(e, "\nCache-control directives distribution\n");
1605 storeAppendPrintf(e, "%2s\t %-20s\t %5s\t %6s\n",
1606 "id", "name", "count", "#/cc_field");
1607 hs->ccTypeDistr.dump(e, httpHdrCcStatDumper);
1608 storeAppendPrintf(e, "\nSurrogate-control directives distribution\n");
1609 storeAppendPrintf(e, "%2s\t %-20s\t %5s\t %6s\n",
1610 "id", "name", "count", "#/sc_field");
1611 hs->scTypeDistr.dump(e, httpHdrScStatDumper);
1612 storeAppendPrintf(e, "\nNumber of fields per header distribution\n");
1613 storeAppendPrintf(e, "%2s\t %-5s\t %5s\t %6s\n",
1614 "id", "#flds", "count", "%total");
1615 hs->hdrUCountDistr.dump(e, httpHeaderFldsPerHdrDumper);
1616 storeAppendPrintf(e, "\n");
1617 dump_stat = nullptr;
1618 }
1619
1620 void
1621 httpHeaderStoreReport(StoreEntry * e)
1622 {
1623 assert(e);
1624
1625 HttpHeaderStats[0].parsedCount =
1626 HttpHeaderStats[hoRequest].parsedCount + HttpHeaderStats[hoReply].parsedCount;
1627 HttpHeaderStats[0].ccParsedCount =
1628 HttpHeaderStats[hoRequest].ccParsedCount + HttpHeaderStats[hoReply].ccParsedCount;
1629 HttpHeaderStats[0].destroyedCount =
1630 HttpHeaderStats[hoRequest].destroyedCount + HttpHeaderStats[hoReply].destroyedCount;
1631 HttpHeaderStats[0].busyDestroyedCount =
1632 HttpHeaderStats[hoRequest].busyDestroyedCount + HttpHeaderStats[hoReply].busyDestroyedCount;
1633
1634 for (const auto &stats: HttpHeaderStats)
1635 httpHeaderStatDump(&stats, e);
1636
1637 /* field stats for all messages */
1638 storeAppendPrintf(e, "\nHttp Fields Stats (replies and requests)\n");
1639
1640 storeAppendPrintf(e, "%2s\t %-25s\t %5s\t %6s\t %6s\n",
1641 "id", "name", "#alive", "%err", "%repeat");
1642
1643 // scan heaaderTable and output
1644 for (auto h : WholeEnum<Http::HdrType>()) {
1645 auto stats = headerStatsTable[h];
1646 storeAppendPrintf(e, "%2d\t %-25s\t %5d\t %6.3f\t %6.3f\n",
1647 Http::HeaderLookupTable.lookup(h).id,
1648 Http::HeaderLookupTable.lookup(h).name,
1649 stats.aliveCount,
1650 xpercent(stats.errCount, stats.parsCount),
1651 xpercent(stats.repCount, stats.seenCount));
1652 }
1653
1654 storeAppendPrintf(e, "Headers Parsed: %d + %d = %d\n",
1655 HttpHeaderStats[hoRequest].parsedCount,
1656 HttpHeaderStats[hoReply].parsedCount,
1657 HttpHeaderStats[0].parsedCount);
1658 storeAppendPrintf(e, "Hdr Fields Parsed: %d\n", HeaderEntryParsedCount);
1659 }
1660
1661 int
1662 HttpHeader::hasListMember(Http::HdrType id, const char *member, const char separator) const
1663 {
1664 int result = 0;
1665 const char *pos = nullptr;
1666 const char *item;
1667 int ilen;
1668 int mlen = strlen(member);
1669
1670 assert(any_registered_header(id));
1671
1672 String header (getStrOrList(id));
1673
1674 while (strListGetItem(&header, separator, &item, &ilen, &pos)) {
1675 if (strncasecmp(item, member, mlen) == 0
1676 && (item[mlen] == '=' || item[mlen] == separator || item[mlen] == ';' || item[mlen] == '\0')) {
1677 result = 1;
1678 break;
1679 }
1680 }
1681
1682 return result;
1683 }
1684
1685 int
1686 HttpHeader::hasByNameListMember(const char *name, const char *member, const char separator) const
1687 {
1688 int result = 0;
1689 const char *pos = nullptr;
1690 const char *item;
1691 int ilen;
1692 int mlen = strlen(member);
1693
1694 assert(name);
1695
1696 String header (getByName(name));
1697
1698 while (strListGetItem(&header, separator, &item, &ilen, &pos)) {
1699 if (strncasecmp(item, member, mlen) == 0
1700 && (item[mlen] == '=' || item[mlen] == separator || item[mlen] == ';' || item[mlen] == '\0')) {
1701 result = 1;
1702 break;
1703 }
1704 }
1705
1706 return result;
1707 }
1708
1709 void
1710 HttpHeader::removeHopByHopEntries()
1711 {
1712 removeConnectionHeaderEntries();
1713
1714 const HttpHeaderEntry *e;
1715 HttpHeaderPos pos = HttpHeaderInitPos;
1716 int headers_deleted = 0;
1717 while ((e = getEntry(&pos))) {
1718 Http::HdrType id = e->id;
1719 if (Http::HeaderLookupTable.lookup(id).hopbyhop) {
1720 delAt(pos, headers_deleted);
1721 CBIT_CLR(mask, id);
1722 }
1723 }
1724 }
1725
1726 void
1727 HttpHeader::removeConnectionHeaderEntries()
1728 {
1729 if (has(Http::HdrType::CONNECTION)) {
1730 /* anything that matches Connection list member will be deleted */
1731 String strConnection;
1732
1733 (void) getList(Http::HdrType::CONNECTION, &strConnection);
1734 const HttpHeaderEntry *e;
1735 HttpHeaderPos pos = HttpHeaderInitPos;
1736 /*
1737 * think: on-average-best nesting of the two loops (hdrEntry
1738 * and strListItem) @?@
1739 */
1740 /*
1741 * maybe we should delete standard stuff ("keep-alive","close")
1742 * from strConnection first?
1743 */
1744
1745 int headers_deleted = 0;
1746 while ((e = getEntry(&pos))) {
1747 if (strListIsMember(&strConnection, e->name, ','))
1748 delAt(pos, headers_deleted);
1749 }
1750 if (headers_deleted)
1751 refreshMask();
1752 }
1753 }
1754