1 #include "first.h"
2 
3 #include "sys-time.h"
4 
5 #include "base.h"
6 #include "array.h"
7 #include "buffer.h"
8 #include "chunk.h"
9 #include "fdevent.h"
10 #include "log.h"
11 #include "http_chunk.h"
12 #include "http_cgi.h"
13 #include "http_date.h"
14 #include "http_etag.h"
15 #include "http_header.h"
16 #include "response.h"
17 #include "sock_addr.h"
18 #include "stat_cache.h"
19 
20 #include <stdlib.h>
21 #include <string.h>
22 #include <errno.h>
23 
24 #include "sys-socket.h"
25 #include <unistd.h>
26 
27 /**
28  * max size of the HTTP response header from backends
29  * (differs from server.max-request-field-size for max request field size)
30  */
31 #define MAX_HTTP_RESPONSE_FIELD_SIZE 65535
32 
33 
34 __attribute_cold__
http_response_buffer_append_authority(request_st * const r,buffer * const o)35 int http_response_buffer_append_authority(request_st * const r, buffer * const o) {
36 	if (!buffer_is_blank(&r->uri.authority)) {
37 		buffer_append_string_buffer(o, &r->uri.authority);
38 	} else {
39 		/* get the name of the currently connected socket */
40 		sock_addr our_addr;
41 		socklen_t our_addr_len;
42 
43 		our_addr.plain.sa_family = 0;
44 		our_addr_len = sizeof(our_addr);
45 
46 		if (-1 == getsockname(r->con->fd, (struct sockaddr *)&our_addr, &our_addr_len)
47 		    || our_addr_len > (socklen_t)sizeof(our_addr)) {
48 			r->http_status = 500;
49 			log_perror(r->conf.errh, __FILE__, __LINE__, "can't get sockname");
50 			return -1;
51 		}
52 
53 		if (our_addr.plain.sa_family == AF_INET
54 		    && our_addr.ipv4.sin_addr.s_addr == htonl(INADDR_LOOPBACK)) {
55 			static char lhost[32];
56 			static size_t lhost_len = 0;
57 			if (0 != lhost_len) {
58 				buffer_append_string_len(o, lhost, lhost_len);
59 			}
60 			else {
61 				size_t olen = buffer_clen(o);
62 				if (0 == sock_addr_nameinfo_append_buffer(o, &our_addr, r->conf.errh)) {
63 					lhost_len = buffer_clen(o) - olen;
64 					if (lhost_len < sizeof(lhost)) {
65 						memcpy(lhost, o->ptr+olen, lhost_len+1); /*(+1 for '\0')*/
66 					}
67 					else {
68 						lhost_len = 0;
69 					}
70 				}
71 				else {
72 					lhost_len = sizeof("localhost")-1;
73 					memcpy(lhost, "localhost", lhost_len+1); /*(+1 for '\0')*/
74 					buffer_append_string_len(o, lhost, lhost_len);
75 				}
76 			}
77 		} else if (!buffer_is_blank(r->server_name)) {
78 			buffer_append_string_buffer(o, r->server_name);
79 		} else
80 		/* Lookup name: secondly try to get hostname for bind address */
81 		if (0 != sock_addr_nameinfo_append_buffer(o, &our_addr, r->conf.errh)) {
82 			r->http_status = 500;
83 			return -1;
84 		}
85 
86 		{
87 			unsigned short listen_port = sock_addr_get_port(&our_addr);
88 			unsigned short default_port = 80;
89 			if (buffer_is_equal_string(&r->uri.scheme, CONST_STR_LEN("https"))) {
90 				default_port = 443;
91 			}
92 			if (0 == listen_port) listen_port = r->con->srv->srvconf.port;
93 			if (default_port != listen_port) {
94 				buffer_append_string_len(o, CONST_STR_LEN(":"));
95 				buffer_append_int(o, listen_port);
96 			}
97 		}
98 	}
99 	return 0;
100 }
101 
http_response_redirect_to_directory(request_st * const r,int status)102 int http_response_redirect_to_directory(request_st * const r, int status) {
103 	buffer *o = r->tmp_buf;
104 	buffer_clear(o);
105 	/* XXX: store flag in global at startup? */
106 	if (r->con->srv->srvconf.absolute_dir_redirect) {
107 		buffer_append_str2(o, BUF_PTR_LEN(&r->uri.scheme),
108 		                      CONST_STR_LEN("://"));
109 		if (0 != http_response_buffer_append_authority(r, o)) {
110 			return -1;
111 		}
112 	}
113 	buffer *vb;
114 	if (status >= 300) {
115 		r->http_status = status;
116 		r->resp_body_finished = 1;
117 		vb = http_header_response_set_ptr(r, HTTP_HEADER_LOCATION,
118 		                                  CONST_STR_LEN("Location"));
119 	}
120 	else {
121 		vb = http_header_response_set_ptr(r, HTTP_HEADER_CONTENT_LOCATION,
122 		                                  CONST_STR_LEN("Content-Location"));
123 	}
124 	buffer_copy_buffer(vb, o);
125 	buffer_append_string_encoded(vb, BUF_PTR_LEN(&r->uri.path),
126 	                             ENCODING_REL_URI);
127 	buffer_append_string_len(vb, CONST_STR_LEN("/"));
128 	if (!buffer_is_blank(&r->uri.query))
129 		buffer_append_str2(vb, CONST_STR_LEN("?"),
130 		                       BUF_PTR_LEN(&r->uri.query));
131 
132 	return 0;
133 }
134 
135 #define MTIME_CACHE_MAX 16
136 struct mtime_cache_type {
137     unix_time64_t mtime;  /* key */
138     buffer str;    /* buffer for string representation */
139 };
140 static struct mtime_cache_type mtime_cache[MTIME_CACHE_MAX];
141 static char mtime_cache_str[MTIME_CACHE_MAX][HTTP_DATE_SZ];
142 /* 30-chars for "%a, %d %b %Y %T GMT" */
143 
strftime_cache_reset(void)144 void strftime_cache_reset(void) {
145     for (int i = 0; i < MTIME_CACHE_MAX; ++i) {
146         mtime_cache[i].mtime = -1;
147         mtime_cache[i].str.ptr = mtime_cache_str[i];
148         mtime_cache[i].str.used = sizeof(mtime_cache_str[0]);
149         mtime_cache[i].str.size = sizeof(mtime_cache_str[0]);
150     }
151 }
152 
strftime_cache_get(const unix_time64_t last_mod)153 static const buffer * strftime_cache_get(const unix_time64_t last_mod) {
154     /*(note: not bothering to convert *here* if last_mod < 0 (for cache key);
155      * last_mod < 0 handled in http_date_time_to_str() call to gmtime64_r())*/
156 
157     static int mtime_cache_idx;
158 
159     for (int j = 0; j < MTIME_CACHE_MAX; ++j) {
160         if (mtime_cache[j].mtime == last_mod)
161             return &mtime_cache[j].str; /* found cache-entry */
162     }
163 
164     if (++mtime_cache_idx == MTIME_CACHE_MAX) mtime_cache_idx = 0;
165 
166     const int i = mtime_cache_idx;
167     http_date_time_to_str(mtime_cache[i].str.ptr, sizeof(mtime_cache_str[0]),
168                           (mtime_cache[i].mtime = last_mod));
169 
170     return &mtime_cache[i].str;
171 }
172 
173 
http_response_set_last_modified(request_st * const r,const unix_time64_t lmtime)174 const buffer * http_response_set_last_modified(request_st * const r, const unix_time64_t lmtime) {
175     buffer * const vb =
176       http_header_response_set_ptr(r, HTTP_HEADER_LAST_MODIFIED,
177                                    CONST_STR_LEN("Last-Modified"));
178     buffer_copy_buffer(vb, strftime_cache_get(lmtime));
179     return vb;
180 }
181 
182 
http_response_handle_cachable(request_st * const r,const buffer * const lmod,const unix_time64_t lmtime)183 int http_response_handle_cachable(request_st * const r, const buffer * const lmod, const unix_time64_t lmtime) {
184 	if (!(r->rqst_htags
185 	      & (light_bshift(HTTP_HEADER_IF_NONE_MATCH)
186 	        |light_bshift(HTTP_HEADER_IF_MODIFIED_SINCE)))) {
187 		return HANDLER_GO_ON;
188 	}
189 
190 	const buffer *vb;
191 
192 	/*
193 	 * 14.26 If-None-Match
194 	 *    [...]
195 	 *    If none of the entity tags match, then the server MAY perform the
196 	 *    requested method as if the If-None-Match header field did not exist,
197 	 *    but MUST also ignore any If-Modified-Since header field(s) in the
198 	 *    request. That is, if no entity tags match, then the server MUST NOT
199 	 *    return a 304 (Not Modified) response.
200 	 */
201 
202 	if ((vb = http_header_request_get(r, HTTP_HEADER_IF_NONE_MATCH,
203 	                                  CONST_STR_LEN("If-None-Match")))) {
204 		/*(weak etag comparison must not be used for ranged requests)*/
205 		int range_request = (0 != light_btst(r->rqst_htags, HTTP_HEADER_RANGE));
206 		if (http_etag_matches(&r->physical.etag, vb->ptr, !range_request)) {
207 			if (http_method_get_or_head(r->http_method)) {
208 				r->http_status = 304;
209 				return HANDLER_FINISHED;
210 			} else {
211 				r->http_status = 412;
212 				r->handler_module = NULL;
213 				return HANDLER_FINISHED;
214 			}
215 		}
216 	} else if (http_method_get_or_head(r->http_method)
217 		   && (vb = http_header_request_get(r, HTTP_HEADER_IF_MODIFIED_SINCE,
218 		                                    CONST_STR_LEN("If-Modified-Since")))) {
219 		/* last-modified handling */
220 		if (buffer_is_equal(lmod, vb)
221 		    || !http_date_if_modified_since(BUF_PTR_LEN(vb), lmtime)) {
222 			r->http_status = 304;
223 			return HANDLER_FINISHED;
224 		}
225 	}
226 
227 	return HANDLER_GO_ON;
228 }
229 
230 
http_response_body_clear(request_st * const r,int preserve_length)231 void http_response_body_clear (request_st * const r, int preserve_length) {
232     r->resp_send_chunked = 0;
233     r->resp_body_scratchpad = -1;
234     if (light_btst(r->resp_htags, HTTP_HEADER_TRANSFER_ENCODING)) {
235         http_header_response_unset(r, HTTP_HEADER_TRANSFER_ENCODING,
236                                    CONST_STR_LEN("Transfer-Encoding"));
237     }
238     if (!preserve_length) { /* preserve for HEAD responses and no-content responses (204, 205, 304) */
239         if (light_btst(r->resp_htags, HTTP_HEADER_CONTENT_LENGTH)) {
240             http_header_response_unset(r, HTTP_HEADER_CONTENT_LENGTH,
241                                        CONST_STR_LEN("Content-Length"));
242         }
243         /*(if not preserving Content-Length, do not preserve trailers, if any)*/
244         r->resp_decode_chunked = 0;
245         if (r->gw_dechunk) {
246             free(r->gw_dechunk->b.ptr);
247             free(r->gw_dechunk);
248             r->gw_dechunk = NULL;
249         }
250     }
251     chunkqueue_reset(&r->write_queue);
252 }
253 
254 
http_response_header_clear(request_st * const r)255 static void http_response_header_clear (request_st * const r) {
256     r->http_status = 0;
257     r->resp_htags = 0;
258     r->resp_header_len = 0;
259     r->resp_header_repeated = 0;
260     array_reset_data_strings(&r->resp_headers);
261 
262     /* Note: http_response_body_clear(r, 0) is not called here
263      * r->write_queue should be preserved for additional data after 1xx response
264      * However, if http_response_process_headers() was called and response had
265      * Transfer-Encoding: chunked set, then other items need to be reset */
266     r->resp_send_chunked = 0;
267     r->resp_decode_chunked = 0;
268     r->resp_body_scratchpad = -1;
269     if (r->gw_dechunk) {
270         free(r->gw_dechunk->b.ptr);
271         free(r->gw_dechunk);
272         r->gw_dechunk = NULL;
273     }
274 }
275 
276 
http_response_reset(request_st * const r)277 void http_response_reset (request_st * const r) {
278     r->http_status = 0;
279     r->con->is_writable = 1;
280     r->resp_body_finished = 0;
281     r->resp_body_started = 0;
282     r->handler_module = NULL;
283     if (r->physical.path.ptr) { /*(skip for mod_fastcgi authorizer)*/
284         buffer_clear(&r->physical.doc_root);
285         buffer_clear(&r->physical.basedir);
286         buffer_clear(&r->physical.etag);
287         buffer_reset(&r->physical.path);
288         buffer_reset(&r->physical.rel_path);
289     }
290     r->resp_htags = 0;
291     r->resp_header_len = 0;
292     r->resp_header_repeated = 0;
293     array_reset_data_strings(&r->resp_headers);
294     http_response_body_clear(r, 0);
295 }
296 
297 
http_response_reqbody_read_error(request_st * const r,int http_status)298 handler_t http_response_reqbody_read_error (request_st * const r, int http_status) {
299     r->keep_alive = 0;
300 
301     /*(do not change status if response headers already set and possibly sent)*/
302     if (0 != r->resp_header_len) return HANDLER_ERROR;
303 
304     http_response_body_clear(r, 0);
305     r->http_status = http_status;
306     r->handler_module = NULL;
307     return HANDLER_FINISHED;
308 }
309 
310 
http_response_send_file(request_st * const r,buffer * const path,stat_cache_entry * sce)311 void http_response_send_file (request_st * const r, buffer * const path, stat_cache_entry *sce) {
312 	if (NULL == sce
313 	    || (sce->fd < 0 && __builtin_expect( (0 != sce->st.st_size), 0))) {
314 		sce = stat_cache_get_entry_open(path, r->conf.follow_symlink);
315 		if (NULL == sce) {
316 			r->http_status = (errno == ENOENT) ? 404 : 403;
317 			log_error(r->conf.errh, __FILE__, __LINE__,
318 			  "not a regular file: %s -> %s", r->uri.path.ptr, path->ptr);
319 			return;
320 		}
321 		if (sce->fd < 0 && __builtin_expect( (0 != sce->st.st_size), 0)) {
322 			r->http_status = (errno == ENOENT) ? 404 : 403;
323 			if (r->conf.log_request_handling) {
324 				log_perror(r->conf.errh, __FILE__, __LINE__,
325 				  "file open failed: %s", path->ptr);
326 			}
327 			return;
328 		}
329 	}
330 
331 	if (__builtin_expect( (!r->conf.follow_symlink), 0)
332 	    && 0 != stat_cache_path_contains_symlink(path, r->conf.errh)) {
333 		r->http_status = 403;
334 		if (r->conf.log_request_handling) {
335 			log_error(r->conf.errh, __FILE__, __LINE__,
336 			  "-- access denied due symlink restriction");
337 			log_error(r->conf.errh, __FILE__, __LINE__,
338 			  "Path         : %s", path->ptr);
339 		}
340 		return;
341 	}
342 
343 	/* we only handle regular files */
344 	if (__builtin_expect( (!S_ISREG(sce->st.st_mode)), 0)) {
345 		r->http_status = 403;
346 		if (r->conf.log_file_not_found) {
347 			log_error(r->conf.errh, __FILE__, __LINE__,
348 			  "not a regular file: %s -> %s",
349 			  r->uri.path.ptr, path->ptr);
350 		}
351 		return;
352 	}
353 
354 	int allow_caching = (0 == r->http_status || 200 == r->http_status);
355 
356 	/* set response content-type, if not set already */
357 
358 	if (!light_btst(r->resp_htags, HTTP_HEADER_CONTENT_TYPE)) {
359 		const buffer *content_type = stat_cache_content_type_get(sce, r);
360 		if (content_type && !buffer_is_blank(content_type)) {
361 			http_header_response_set(r, HTTP_HEADER_CONTENT_TYPE,
362 			                         CONST_STR_LEN("Content-Type"),
363 			                         BUF_PTR_LEN(content_type));
364 		} else {
365 			/* we are setting application/octet-stream, but also announce that
366 			 * this header field might change in the seconds few requests
367 			 *
368 			 * This should fix the aggressive caching of FF and the script download
369 			 * seen by the first installations
370 			 */
371 			http_header_response_set(r, HTTP_HEADER_CONTENT_TYPE,
372 			                         CONST_STR_LEN("Content-Type"),
373 			                         CONST_STR_LEN("application/octet-stream"));
374 
375 			allow_caching = 0;
376 		}
377 	}
378 
379 	if (allow_caching) {
380 		if (!light_btst(r->resp_htags, HTTP_HEADER_ETAG)
381 		    && 0 != r->conf.etag_flags) {
382 			const buffer *etag =
383 			  stat_cache_etag_get(sce, r->conf.etag_flags);
384 			if (etag && !buffer_is_blank(etag)) {
385 				buffer_copy_buffer(&r->physical.etag, etag);
386 				http_header_response_set(r, HTTP_HEADER_ETAG,
387 				                         CONST_STR_LEN("ETag"),
388 				                         BUF_PTR_LEN(&r->physical.etag));
389 			}
390 		}
391 
392 		/* prepare header */
393 		const buffer *mtime;
394 		mtime = http_header_response_get(r, HTTP_HEADER_LAST_MODIFIED,
395 		                                 CONST_STR_LEN("Last-Modified"));
396 		if (NULL == mtime) {
397 			mtime = http_response_set_last_modified(r, sce->st.st_mtime);
398 		}
399 
400 		if (HANDLER_FINISHED == http_response_handle_cachable(r, mtime, sce->st.st_mtime)) {
401 			return;
402 		}
403 	}
404 
405 	/* if we are still here, prepare body */
406 
407 	/* we add it here for all requests
408 	 * the HEAD request will drop it afterwards again
409 	 */
410 
411 	if (0 == sce->st.st_size || 0 == http_chunk_append_file_ref(r, sce)) {
412 		r->http_status = 200;
413 		r->resp_body_finished = 1;
414 		/*(Transfer-Encoding should not have been set at this point)*/
415 		buffer_append_int(
416 		  http_header_response_set_ptr(r, HTTP_HEADER_CONTENT_LENGTH,
417 		                               CONST_STR_LEN("Content-Length")),
418 		  sce->st.st_size);
419 	}
420 	else {
421 		r->http_status = 500;
422 	}
423 }
424 
425 
http_response_xsendfile(request_st * const r,buffer * const path,const array * const xdocroot)426 static void http_response_xsendfile (request_st * const r, buffer * const path, const array * const xdocroot) {
427 	const int status = r->http_status;
428 	int valid = 1;
429 
430 	/* reset Content-Length, if set by backend
431 	 * Content-Length might later be set to size of X-Sendfile static file,
432 	 * determined by open(), fstat() to reduces race conditions if the file
433 	 * is modified between stat() (stat_cache_get_entry()) and open(). */
434 	if (light_btst(r->resp_htags, HTTP_HEADER_CONTENT_LENGTH)) {
435 		http_header_response_unset(r, HTTP_HEADER_CONTENT_LENGTH,
436 		                           CONST_STR_LEN("Content-Length"));
437 	}
438 
439 	buffer_urldecode_path(path);
440 	if (!buffer_is_valid_UTF8(path)) {
441 		log_error(r->conf.errh, __FILE__, __LINE__,
442 		  "X-Sendfile invalid UTF-8 after url-decode: %s", path->ptr);
443 		if (r->http_status < 400) {
444 			r->http_status = 502;
445 			r->handler_module = NULL;
446 		}
447 		return;
448 	}
449 	buffer_path_simplify(path);
450 	if (r->conf.force_lowercase_filenames) {
451 		buffer_to_lower(path);
452 	}
453 	if (buffer_is_blank(path)) {
454 		r->http_status = 502;
455 		valid = 0;
456 	}
457 
458 	/* check that path is under xdocroot(s)
459 	 * - xdocroot should have trailing slash appended at config time
460 	 * - r->conf.force_lowercase_filenames is not a server-wide setting,
461 	 *   and so can not be definitively applied to xdocroot at config time*/
462 	if (xdocroot && xdocroot->used) {
463 		const buffer * const xval = !r->conf.force_lowercase_filenames
464 		  ? array_match_value_prefix(xdocroot, path)
465 		  : array_match_value_prefix_nc(xdocroot, path);
466 		if (NULL == xval) {
467 			log_error(r->conf.errh, __FILE__, __LINE__,
468 			  "X-Sendfile (%s) not under configured x-sendfile-docroot(s)", path->ptr);
469 			r->http_status = 403;
470 			valid = 0;
471 		}
472 	}
473 
474 	if (valid) http_response_send_file(r, path, NULL);
475 
476 	if (r->http_status >= 400 && status < 300) {
477 		r->handler_module = NULL;
478 	} else if (0 != status && 200 != status) {
479 		r->http_status = status;
480 	}
481 }
482 
483 
http_response_xsendfile2(request_st * const r,const buffer * const value,const array * const xdocroot)484 static void http_response_xsendfile2(request_st * const r, const buffer * const value, const array * const xdocroot) {
485     const char *pos = value->ptr;
486     buffer * const b = r->tmp_buf;
487     const int status = r->http_status;
488 
489     /* reset Content-Length, if set by backend */
490     if (light_btst(r->resp_htags, HTTP_HEADER_CONTENT_LENGTH)) {
491         http_header_response_unset(r, HTTP_HEADER_CONTENT_LENGTH,
492                                    CONST_STR_LEN("Content-Length"));
493     }
494 
495     while (*pos) {
496         const char *filename, *range;
497         stat_cache_entry *sce;
498         off_t begin_range, end_range, range_len;
499 
500         while (' ' == *pos) pos++;
501         if (!*pos) break;
502 
503         filename = pos;
504         if (NULL == (range = strchr(pos, ' '))) {
505             /* missing range */
506             log_error(r->conf.errh, __FILE__, __LINE__,
507               "Couldn't find range after filename: %s", filename);
508             r->http_status = 502;
509             break;
510         }
511         buffer_copy_string_len(b, filename, range - filename);
512 
513         /* find end of range */
514         for (pos = ++range; *pos && *pos != ' ' && *pos != ','; pos++) ;
515 
516         buffer_urldecode_path(b);
517         if (!buffer_is_valid_UTF8(b)) {
518             log_error(r->conf.errh, __FILE__, __LINE__,
519               "X-Sendfile2 invalid UTF-8 after url-decode: %s", b->ptr);
520             r->http_status = 502;
521             break;
522         }
523         buffer_path_simplify(b);
524         if (r->conf.force_lowercase_filenames) {
525             buffer_to_lower(b);
526         }
527         if (buffer_is_blank(b)) {
528             r->http_status = 502;
529             break;
530         }
531         if (xdocroot && xdocroot->used) {
532             const buffer * const xval = !r->conf.force_lowercase_filenames
533               ? array_match_value_prefix(xdocroot, b)
534               : array_match_value_prefix_nc(xdocroot, b);
535             if (NULL == xval) {
536                 log_error(r->conf.errh, __FILE__, __LINE__,
537                   "X-Sendfile2 (%s) not under configured x-sendfile-docroot(s)",
538                   b->ptr);
539                 r->http_status = 403;
540                 break;
541             }
542         }
543 
544         sce = stat_cache_get_entry_open(b, r->conf.follow_symlink);
545         if (NULL == sce) {
546             log_error(r->conf.errh, __FILE__, __LINE__,
547               "send-file error: couldn't get stat_cache entry for "
548               "X-Sendfile2: %s", b->ptr);
549             r->http_status = 404;
550             break;
551         } else if (!S_ISREG(sce->st.st_mode)) {
552             log_error(r->conf.errh, __FILE__, __LINE__,
553               "send-file error: wrong filetype for X-Sendfile2: %s", b->ptr);
554             r->http_status = 502;
555             break;
556         }
557         /* found the file */
558 
559         /* parse range */
560         end_range = sce->st.st_size - 1;
561         {
562             char *rpos = NULL;
563             errno = 0;
564             begin_range = strtoll(range, &rpos, 10);
565             if (errno != 0 || begin_range < 0 || rpos == range)
566                 goto range_failed;
567             if ('-' != *rpos++) goto range_failed;
568             if (rpos != pos) {
569                 range = rpos;
570                 end_range = strtoll(range, &rpos, 10);
571                 if (errno != 0 || end_range < 0 || rpos == range)
572                     goto range_failed;
573             }
574             if (rpos != pos) goto range_failed;
575 
576             goto range_success;
577 
578 range_failed:
579             log_error(r->conf.errh, __FILE__, __LINE__,
580               "Couldn't decode range after filename: %s", filename);
581             r->http_status = 502;
582             break;
583 
584 range_success: ;
585         }
586 
587         /* no parameters accepted */
588 
589         while (*pos == ' ') pos++;
590         if (*pos != '\0' && *pos != ',') {
591             r->http_status = 502;
592             break;
593         }
594 
595         range_len = end_range - begin_range + 1;
596         if (range_len < 0) {
597             r->http_status = 502;
598             break;
599         }
600         if (range_len != 0) {
601             http_chunk_append_file_ref_range(r, sce, begin_range, range_len);
602         }
603 
604         if (*pos == ',') pos++;
605     }
606 
607     if (r->http_status >= 400 && status < 300) {
608 	r->handler_module = NULL;
609     } else if (0 != status && 200 != status) {
610         r->http_status = status;
611     }
612 }
613 
614 
http_response_backend_error(request_st * const r)615 void http_response_backend_error (request_st * const r) {
616 	if (r->resp_body_started) {
617 		/*(response might have been already started, kill the connection)*/
618 		/*(mode == DIRECT to avoid later call to http_response_backend_done())*/
619 		r->handler_module = NULL;  /*(avoid sending final chunked block)*/
620 		r->keep_alive = 0;
621 		r->resp_body_finished = 1;
622 	} /*(else error status set later by http_response_backend_done())*/
623 }
624 
http_response_backend_done(request_st * const r)625 void http_response_backend_done (request_st * const r) {
626 	/* (not CON_STATE_ERROR and not CON_STATE_RESPONSE_END,
627 	 *  i.e. not called from handle_connection_close or handle_request_reset
628 	 *  hooks, except maybe from errdoc handler, which later resets state)*/
629 	switch (r->state) {
630 	case CON_STATE_HANDLE_REQUEST:
631 	case CON_STATE_READ_POST:
632 		if (!r->resp_body_started) {
633 			/* Send an error if we haven't sent any data yet */
634 			if (r->http_status < 500 && r->http_status != 400)
635 				r->http_status = 500;
636 			r->handler_module = NULL;
637 			break;
638 		}
639 		__attribute_fallthrough__
640 	case CON_STATE_WRITE:
641 		if (!r->resp_body_finished) {
642 			if (r->http_version == HTTP_VERSION_1_1)
643 				http_chunk_close(r);
644 		  #if 0
645 			/* This is a lot of work to make it possible for an HTTP/1.0 client
646 			 * to detect that response is truncated (after lighttpd made an
647 			 * HTTP/1.1 request to backend, and backend gave a Transfer-Encoding
648 			 * chunked response instead of sending Content-Length, and lighttpd
649 			 * is streaming response to client).  An HTTP/1.0 client is probably
650 			 * not checking for truncated response, or else client should really
651 			 * prefer HTTP/1.1 or better.  If lighttpd were streaming response,
652 			 * there would be no Content-Length and lighttpd would have sent
653 			 * Connection: close.  Alternatively, since not streaming (if these
654 			 * conditions are true), could send an HTTP status error instead of
655 			 * sending partial content with a bogus Content-Length.  If we do
656 			 * not send an HTTP error status, then response_start hooks may add
657 			 * caching headers (e.g. mod_expire, mod_setenv).  If in future we
658 			 * send HTTP error status, might special-case HEAD requests and
659 			 * clear response body so that response headers (w/o Content-Length)
660 			 * can be sent.  For now, we have chosen to send partial content,
661 			 * including generating an incorrect Content-Length (later), and not
662 			 * to take any of these extra steps. */
663 			else if (__builtin_expect( (r->http_version == HTTP_VERSION_1_0), 0)
664 			         && r->gw_dechunk && !r->gw_dechunk->done
665 			         && !(r->conf.stream_response_body
666 			              & (FDEVENT_STREAM_RESPONSE
667 			                |FDEVENT_STREAM_RESPONSE_BUFMIN))) {
668 				r->keep_alive = 0; /* disable keep-alive, send bogus length */
669 				http_header_response_set(r, HTTP_HEADER_CONTENT_LENGTH,
670 				                         CONST_STR_LEN("Content-Length"),
671 				                         CONST_STR_LEN("9999999999999"));
672 				http_header_response_unset(r, HTTP_HEADER_ETAG,
673 				                           CONST_STR_LEN("ETag"));
674 				http_header_response_unset(r, HTTP_HEADER_LAST_MODIFIED,
675 				                           CONST_STR_LEN("Last-Modified"));
676 				http_header_response_unset(r, HTTP_HEADER_CACHE_CONTROL,
677 				                           CONST_STR_LEN("Cache-Control"));
678 				http_header_response_unset(r, HTTP_HEADER_EXPIRES,
679 				                           CONST_STR_LEN("Expires"));
680 			}
681 		  #endif
682 			r->resp_body_finished = 1;
683 		}
684 	default:
685 		break;
686 	}
687 }
688 
689 
http_response_upgrade_read_body_unknown(request_st * const r)690 void http_response_upgrade_read_body_unknown(request_st * const r) {
691     /* act as transparent proxy */
692     if (!(r->conf.stream_request_body & FDEVENT_STREAM_REQUEST))
693         r->conf.stream_request_body |=
694           (FDEVENT_STREAM_REQUEST_BUFMIN | FDEVENT_STREAM_REQUEST);
695     if (!(r->conf.stream_response_body & FDEVENT_STREAM_RESPONSE))
696         r->conf.stream_response_body |=
697           (FDEVENT_STREAM_RESPONSE_BUFMIN | FDEVENT_STREAM_RESPONSE);
698     r->conf.stream_request_body |= FDEVENT_STREAM_REQUEST_POLLIN;
699     r->reqbody_length = -2;
700     r->resp_body_scratchpad = -1;
701     r->keep_alive = 0;
702 }
703 
704 
705 __attribute_pure__
http_response_append_buffer_simple_accum(const request_st * const r,const off_t len)706 static int http_response_append_buffer_simple_accum(const request_st * const r, const off_t len) {
707     /*(check to accumulate small reads in buffer before flushing to temp file)*/
708     return
709       len < 32768 && r->write_queue.last && r->write_queue.last->file.is_temp;
710 }
711 
712 
http_response_append_buffer(request_st * const r,buffer * const mem,const int simple_accum)713 static int http_response_append_buffer(request_st * const r, buffer * const mem, const int simple_accum) {
714     /* Note: this routine is separate from http_response_append_mem() to
715      * potentially avoid copying buffer by using http_chunk_append_buffer(). */
716 
717     if (r->resp_decode_chunked)
718         return http_chunk_decode_append_buffer(r, mem);
719 
720     if (r->resp_body_scratchpad > 0) {
721         off_t len = (off_t)buffer_clen(mem);
722         r->resp_body_scratchpad -= len;
723         if (r->resp_body_scratchpad > 0) {
724             if (simple_accum
725                 && http_response_append_buffer_simple_accum(r, len)) {
726                 r->resp_body_scratchpad += len;
727                 return 0; /*(accumulate small reads in buffer)*/
728             }
729         }
730         else { /* (r->resp_body_scratchpad <= 0) */
731             r->resp_body_finished = 1;
732             if (__builtin_expect( (r->resp_body_scratchpad < 0), 0)) {
733                 /*(silently truncate if data exceeds Content-Length)*/
734                 len += r->resp_body_scratchpad;
735                 r->resp_body_scratchpad = 0;
736                 buffer_truncate(mem, (uint32_t)len);
737             }
738         }
739     }
740     else if (0 == r->resp_body_scratchpad) {
741         /*(silently truncate if data exceeds Content-Length)*/
742         buffer_clear(mem);
743         return 0;
744     }
745     else if (simple_accum
746              && http_response_append_buffer_simple_accum(r, buffer_clen(mem))) {
747         return 0; /*(accumulate small reads in buffer)*/
748     }
749     return http_chunk_append_buffer(r, mem);
750 }
751 
752 
753 #ifdef HAVE_SPLICE
http_response_append_splice(request_st * const r,http_response_opts * const opts,buffer * const b,const int fd,unsigned int toread)754 static int http_response_append_splice(request_st * const r, http_response_opts * const opts, buffer * const b, const int fd, unsigned int toread) {
755     /* check if worthwhile to splice() to avoid copying through userspace */
756     /*assert(opts->simple_accum);*//*(checked in caller)*/
757     if (r->resp_body_scratchpad >= toread
758         && (toread > 32768
759             || (toread >= 8192 /*(!http_response_append_buffer_simple_accum())*/
760                 && r->write_queue.last && r->write_queue.last->file.is_temp))) {
761 
762         if (!buffer_is_blank(b)) {
763             /*(flush small reads previously accumulated in b)*/
764             int rc = http_response_append_buffer(r, b, 0); /*(0 to flush)*/
765             chunk_buffer_yield(b); /*(improve large buf reuse)*/
766             if (__builtin_expect( (0 != rc), 0)) return -1; /* error */
767         }
768 
769         /*assert(opts->fdfmt == S_IFSOCK || opts->fdfmt == S_IFIFO);*/
770         ssize_t n = (opts->fdfmt == S_IFSOCK)
771           ? chunkqueue_append_splice_sock_tempfile(
772               &r->write_queue, fd, toread, r->conf.errh)
773           : chunkqueue_append_splice_pipe_tempfile(
774               &r->write_queue, fd, toread, r->conf.errh);
775         if (__builtin_expect( (n >= 0), 1)) {
776             if (0 == (r->resp_body_scratchpad -= n))
777                 r->resp_body_finished = 1;
778             return 1; /* success */
779         }
780         else if (n != -EINVAL)
781             return -1; /* error */
782         /*(fall through; target filesystem w/o splice() support)*/
783     }
784     return 0; /* not handled */
785 }
786 #endif
787 
788 
http_response_append_mem(request_st * const r,const char * const mem,size_t len)789 static int http_response_append_mem(request_st * const r, const char * const mem, size_t len) {
790     if (r->resp_decode_chunked)
791         return http_chunk_decode_append_mem(r, mem, len);
792 
793     if (r->resp_body_scratchpad > 0) {
794         r->resp_body_scratchpad -= (off_t)len;
795         if (r->resp_body_scratchpad <= 0) {
796             r->resp_body_finished = 1;
797             if (__builtin_expect( (r->resp_body_scratchpad < 0), 0)) {
798                 /*(silently truncate if data exceeds Content-Length)*/
799                 len = (size_t)(r->resp_body_scratchpad + (off_t)len);
800                 r->resp_body_scratchpad = 0;
801             }
802         }
803     }
804     else if (0 == r->resp_body_scratchpad) {
805         /*(silently truncate if data exceeds Content-Length)*/
806         return 0;
807     }
808     return http_chunk_append_mem(r, mem, len);
809 }
810 
811 
http_response_transfer_cqlen(request_st * const r,chunkqueue * const cq,size_t len)812 int http_response_transfer_cqlen(request_st * const r, chunkqueue * const cq, size_t len) {
813     /*(intended for use as callback from modules setting opts->parse(),
814      * e.g. mod_fastcgi and mod_ajp13)
815      *(do not set r->resp_body_finished here since those protocols handle it)*/
816     if (0 == len) return 0;
817     if (__builtin_expect( (!r->resp_decode_chunked), 1)) {
818         const size_t olen = len;
819         if (r->resp_body_scratchpad >= 0) {
820             r->resp_body_scratchpad -= (off_t)len;
821             if (__builtin_expect( (r->resp_body_scratchpad < 0), 0)) {
822                 /*(silently truncate if data exceeds Content-Length)*/
823                 len = (size_t)(r->resp_body_scratchpad + (off_t)len);
824                 r->resp_body_scratchpad = 0;
825             }
826         }
827         int rc = http_chunk_transfer_cqlen(r, cq, len);
828         if (__builtin_expect( (0 != rc), 0))
829             return -1;
830         if (__builtin_expect( (olen != len), 0)) /*discard excess data, if any*/
831             chunkqueue_mark_written(cq, (off_t)(olen - len));
832     }
833     else {
834         /* specialized use by opts->parse() to decode chunked encoding;
835          * FastCGI, AJP13 packet data is all type MEM_CHUNK
836          * (This extra copy can be avoided if FastCGI backend does not send
837          *  Transfer-Encoding: chunked, which FastCGI is not supposed to do) */
838         uint32_t remain = (uint32_t)len, wr;
839         for (const chunk *c = cq->first; c && remain; c=c->next, remain-=wr) {
840             /*assert(c->type == MEM_CHUNK);*/
841             wr = buffer_clen(c->mem) - c->offset;
842             if (wr > remain) wr = remain;
843             if (0 != http_chunk_decode_append_mem(r, c->mem->ptr+c->offset, wr))
844                 return -1;
845         }
846         chunkqueue_mark_written(cq, len);
847     }
848     return 0;
849 }
850 
851 
http_response_process_headers(request_st * const restrict r,http_response_opts * const restrict opts,char * const restrict s,const unsigned short hoff[8192],const int is_nph)852 static int http_response_process_headers(request_st * const restrict r, http_response_opts * const restrict opts, char * const restrict s, const unsigned short hoff[8192], const int is_nph) {
853     int i = 1;
854 
855     if (is_nph) {
856         /* non-parsed headers ... we parse them anyway */
857         /* (accept HTTP/2.0 and HTTP/3.0 from naive non-proxy backends) */
858         /* (http_header_str_to_code() expects certain chars after code) */
859         if (s[12] == '\r' || s[12] == '\n') s[12] = '\0';/*(caller checked 12)*/
860         if ((s[5] == '1' || opts->backend != BACKEND_PROXY) && s[6] == '.'
861             && (s[7] == '1' || s[7] == '0') && s[8] == ' ') {
862             /* after the space should be a status code for us */
863             int status = http_header_str_to_code(s+9);
864             if (status >= 100 && status < 1000) {
865               #ifdef __COVERITY__ /* Coverity false positive for tainted data */
866                 status = 200;/* http_header_str_to_code() validates, untaints */
867               #endif
868                 r->http_status = status;
869                 opts->local_redir = 0; /*(disable; status was set)*/
870                 i = 2;
871             } /* else we expected 3 digits and didn't get them */
872         }
873 
874         if (0 == r->http_status) {
875             log_error(r->conf.errh, __FILE__, __LINE__,
876               "invalid HTTP status line: %s", s);
877             r->http_status = 502; /* Bad Gateway */
878             r->handler_module = NULL;
879             return 0;
880         }
881     }
882     else if (__builtin_expect( (opts->backend == BACKEND_PROXY), 0)) {
883         /* invalid response Status-Line from HTTP proxy */
884         r->http_status = 502; /* Bad Gateway */
885         r->handler_module = NULL;
886         return 0;
887     }
888 
889     for (; i < hoff[0]; ++i) {
890         const char *k = s+hoff[i], *value;
891         char *end = s+hoff[i+1]-1; /*('\n')*/
892 
893         /* parse the headers */
894         if (NULL == (value = memchr(k, ':', end - k))) {
895             /* we expect: "<key>: <value>\r\n" */
896             continue;
897         }
898 
899         const uint32_t klen = (uint32_t)(value - k);
900         if (0 == klen) continue; /*(already ignored when writing response)*/
901         const enum http_header_e id = http_header_hkey_get(k, klen);
902 
903         do { ++value; } while (*value == ' ' || *value == '\t'); /* skip LWS */
904         /* strip the \r?\n */
905         if (end > value && end[-1] == '\r') --end;
906         /*(XXX: not done; could remove trailing whitespace)*/
907 
908         if (opts->authorizer && (0 == r->http_status || 200 == r->http_status)){
909             if (id == HTTP_HEADER_STATUS) {
910                 end[0] = '\0';
911                 int status = http_header_str_to_code(value);
912                 if (status >= 100 && status < 1000) {
913                   #ifdef __COVERITY__ /* Coverity false positive for tainted */
914                     status = 200;/* http_header_str_to_code() validates */
915                   #endif
916                     r->http_status = status;
917                     opts->local_redir = 0; /*(disable; status was set)*/
918                 }
919                 else {
920                     r->http_status = 502; /* Bad Gateway */
921                     break; /*(do not unset r->handler_module)*/
922                 }
923             }
924             else if (id == HTTP_HEADER_OTHER && klen > 9 && (k[0] & 0xdf) == 'V'
925                      && buffer_eq_icase_ssn(k, CONST_STR_LEN("Variable-"))) {
926                 http_header_env_append(r, k + 9, klen - 9, value, end - value);
927             }
928             continue;
929         }
930 
931         switch (id) {
932           case HTTP_HEADER_STATUS:
933             if (opts->backend != BACKEND_PROXY) {
934                 end[0] = '\0';
935                 int status = http_header_str_to_code(value);
936                 if (status >= 100 && status < 1000) {
937                   #ifdef __COVERITY__ /* Coverity false positive for tainted */
938                     status = 200;/* http_header_str_to_code() validates */
939                   #endif
940                     r->http_status = status;
941                     opts->local_redir = 0; /*(disable; status was set)*/
942                 }
943                 else {
944                     r->http_status = 502;
945                     r->handler_module = NULL;
946                 }
947                 continue; /* do not send Status to client */
948             } /*(else pass w/o parse for BACKEND_PROXY)*/
949             break;
950           case HTTP_HEADER_UPGRADE:
951             /*(technically, should also verify Connection: upgrade)*/
952             /*(flag only for mod_proxy and mod_cgi (for now))*/
953             if (opts->backend != BACKEND_PROXY && opts->backend != BACKEND_CGI)
954                 continue;
955             if (r->http_version >= HTTP_VERSION_2) continue;
956             break;
957           case HTTP_HEADER_CONNECTION:
958             if (opts->backend == BACKEND_PROXY) continue;
959             /*(simplistic attempt to honor backend request to close)*/
960             if (http_header_str_contains_token(value, end - value,
961                                                CONST_STR_LEN("close")))
962                 r->keep_alive = 0;
963             if (r->http_version >= HTTP_VERSION_2) continue;
964             break;
965           case HTTP_HEADER_CONTENT_LENGTH:
966             if (*value == '+') ++value;
967             if (!r->resp_decode_chunked
968                 && !light_btst(r->resp_htags, HTTP_HEADER_CONTENT_LENGTH)) {
969                 const char *err = end;
970                 while (err > value && (err[-1] == ' ' || err[-1] == '\t')) --err;
971                 if (err <= value) continue; /*(might error 502 Bad Gateway)*/
972                 uint32_t vlen = (uint32_t)(err - value);
973                 r->resp_body_scratchpad =
974                   (off_t)li_restricted_strtoint64(value, vlen, &err);
975                 if (err != value + vlen) {
976                     /*(invalid Content-Length value from backend;
977                      * read from backend until backend close, hope for the best)
978                      *(might choose to treat this as 502 Bad Gateway) */
979                     r->resp_body_scratchpad = -1;
980                 }
981             }
982             else {
983                 /* ignore Content-Length if Transfer-Encoding: chunked
984                  * ignore subsequent (multiple) Content-Length
985                  * (might choose to treat this as 502 Bad Gateway) */
986                 continue;
987             }
988             break;
989           case HTTP_HEADER_TRANSFER_ENCODING:
990             if (light_btst(r->resp_htags, HTTP_HEADER_CONTENT_LENGTH)) {
991                 /* ignore Content-Length if Transfer-Encoding: chunked
992                  * (might choose to treat this as 502 Bad Gateway) */
993                 r->resp_body_scratchpad = -1;
994                 http_header_response_unset(r, HTTP_HEADER_CONTENT_LENGTH,
995                                            CONST_STR_LEN("Content-Length"));
996             }
997             /*(assumes "Transfer-Encoding: chunked"; does not verify)*/
998             r->resp_decode_chunked = 1;
999             r->gw_dechunk = calloc(1, sizeof(response_dechunk));
1000             force_assert(r->gw_dechunk);
1001             continue;
1002           case HTTP_HEADER_HTTP2_SETTINGS:
1003             /* RFC7540 3.2.1
1004              *   A server MUST NOT send this header field. */
1005             /* (not bothering to remove HTTP2-Settings from Connection) */
1006             continue;
1007           case HTTP_HEADER_OTHER:
1008             /* ignore invalid headers with whitespace between label and ':'
1009              * (if less strict behavior is desired, check and correct above
1010              *  this switch() statement, but not for BACKEND_PROXY) */
1011             if (k[klen-1] == ' ' || k[klen-1] == '\t')
1012                 continue;
1013             break;
1014           default:
1015             break;
1016         }
1017 
1018         if (end - value)
1019             http_header_response_insert(r, id, k, klen, value, end - value);
1020     }
1021 
1022     /* CGI/1.1 rev 03 - 7.2.1.2 */
1023     /* (proxy requires Status-Line, so never true for proxy)*/
1024     if (0 == r->http_status && light_btst(r->resp_htags, HTTP_HEADER_LOCATION)){
1025         r->http_status = 302;
1026     }
1027 
1028     return 0;
1029 }
1030 
1031 
1032 static http_response_send_1xx_cb http_response_send_1xx_h1;
1033 static http_response_send_1xx_cb http_response_send_1xx_h2;
1034 
1035 void
http_response_send_1xx_cb_set(http_response_send_1xx_cb fn,int vers)1036 http_response_send_1xx_cb_set (http_response_send_1xx_cb fn, int vers)
1037 {
1038     if (vers >= HTTP_VERSION_2)
1039         http_response_send_1xx_h2 = fn;
1040     else if (vers == HTTP_VERSION_1_1)
1041         http_response_send_1xx_h1 = fn;
1042 }
1043 
1044 
1045 int
http_response_send_1xx(request_st * const r)1046 http_response_send_1xx (request_st * const r)
1047 {
1048     http_response_send_1xx_cb http_response_send_1xx_fn = NULL;
1049     if (r->http_version >= HTTP_VERSION_2)
1050         http_response_send_1xx_fn = http_response_send_1xx_h2;
1051     else if (r->http_version == HTTP_VERSION_1_1)
1052         http_response_send_1xx_fn = http_response_send_1xx_h1;
1053 
1054     if (http_response_send_1xx_fn && !http_response_send_1xx_fn(r, r->con))
1055         return 0; /* error occurred */
1056 
1057     http_response_header_clear(r);
1058     return 1; /* 1xx response handled */
1059 }
1060 
1061 
1062 __attribute_cold__
1063 __attribute_noinline__
1064 static int
http_response_check_1xx(request_st * const r,buffer * const restrict b,uint32_t hlen,uint32_t dlen)1065 http_response_check_1xx (request_st * const r, buffer * const restrict b, uint32_t hlen, uint32_t dlen)
1066 {
1067     /* pass through unset r->http_status (not 1xx) or 101 Switching Protocols */
1068     if (0 == r->http_status || 101 == r->http_status)
1069         return 0; /* pass through as-is; do not loop for addtl response hdrs */
1070 
1071     /* discard 1xx response from b; already processed
1072      * (but further response might follow in b, so preserve addtl data) */
1073     if (dlen)
1074         memmove(b->ptr, b->ptr+hlen, dlen);
1075     buffer_truncate(b, dlen);
1076 
1077     /* Note: while GW_AUTHORIZER mode is not expected to return 1xx, as a
1078      * feature, 1xx responses from authorizer are passed back to client */
1079 
1080     return http_response_send_1xx(r);
1081     /* 0: error, 1: 1xx response handled; loop for next response headers */
1082 }
1083 
1084 
1085 __attribute_noinline__
http_response_parse_headers(request_st * const r,http_response_opts * const opts,buffer * const b)1086 handler_t http_response_parse_headers(request_st * const r, http_response_opts * const opts, buffer * const b) {
1087     /**
1088      * possible formats of response headers:
1089      *
1090      * proxy or NPH (non-parsed headers):
1091      *
1092      *   HTTP/1.0 200 Ok\n
1093      *   Header: Value\n
1094      *   \n
1095      *
1096      * CGI:
1097      *
1098      *   Header: Value\n
1099      *   Status: 200\n
1100      *   \n
1101      *
1102      * and different mixes of \n and \r\n combinations
1103      *
1104      * Some users also forget about CGI and just send a response
1105      * and hope we handle it. No headers, no header-content separator
1106      */
1107     const char *bstart;
1108     uint32_t blen;
1109 
1110     do {
1111         uint32_t header_len, is_nph = 0;
1112         unsigned short hoff[8192]; /* max num header lines + 3; 16k on stack */
1113         hoff[0] = 1; /* number of lines */
1114         hoff[1] = 0; /* base offset for all lines */
1115         hoff[2] = 0; /* offset from base for 2nd line; init 0 to detect '\n' */
1116         blen = buffer_clen(b);
1117         header_len = http_header_parse_hoff(b->ptr, blen, hoff);
1118         if ((header_len ? header_len : blen) > MAX_HTTP_RESPONSE_FIELD_SIZE) {
1119             log_error(r->conf.errh, __FILE__, __LINE__,
1120               "response headers too large for %s", r->uri.path.ptr);
1121             r->http_status = 502; /* Bad Gateway */
1122             r->handler_module = NULL;
1123             return HANDLER_FINISHED;
1124         }
1125         if (hoff[2]) { /*(at least one newline found if offset is non-zero)*/
1126             /*("HTTP/1.1 200 " is at least 13 chars + \r\n; 12 w/o final ' ')*/
1127             is_nph = hoff[2] >= 12 && 0 == memcmp(b->ptr, "HTTP/", 5);
1128             if (!is_nph) {
1129                 const char * colon = memchr(b->ptr, ':', hoff[2]-1);
1130                 if (__builtin_expect( (NULL == colon), 0)) {
1131                     if (hoff[2] <= 2 && (1 == hoff[2] || b->ptr[0] == '\r')) {
1132                         /* no HTTP headers */
1133                     }
1134                     else if (opts->backend == BACKEND_CGI) {
1135                         /* no HTTP headers, but body (special-case for CGI)*/
1136                         /* no colon found; does not appear to be HTTP headers */
1137                         if (0 != http_chunk_append_buffer(r, b)) {
1138                             return HANDLER_ERROR;
1139                         }
1140                         r->http_status = 200; /* OK */
1141                         r->resp_body_started = 1;
1142                         return HANDLER_GO_ON;
1143                     }
1144                     else {
1145                         /* invalid response headers */
1146                         r->http_status = 502; /* Bad Gateway */
1147                         r->handler_module = NULL;
1148                         return HANDLER_FINISHED;
1149                     }
1150                 }
1151             }
1152         } /* else no newline yet; partial header line?) */
1153         if (0 == header_len) /* headers incomplete */
1154             return HANDLER_GO_ON;
1155 
1156         /* the body starts after the EOL */
1157         bstart = b->ptr + header_len;
1158         blen -= header_len;
1159 
1160         if (0 != http_response_process_headers(r, opts, b->ptr, hoff, is_nph))
1161             return HANDLER_ERROR;
1162 
1163     } while (r->http_status < 200
1164              && http_response_check_1xx(r, b, bstart - b->ptr, blen));
1165 
1166     r->resp_body_started = 1;
1167 
1168     if (opts->authorizer
1169         && (r->http_status == 0 || r->http_status == 200)) {
1170         return HANDLER_GO_ON;
1171     }
1172 
1173     if (NULL == r->handler_module) {
1174         return HANDLER_FINISHED;
1175     }
1176 
1177     if (opts->local_redir && r->http_status >= 300 && r->http_status < 400
1178         && 0 == blen) {
1179         /* (Might not have begun to receive body yet, but do skip local-redir
1180          *  if we already have started receiving a response body (blen > 0)) */
1181         /*(light_btst(r->resp_htags, HTTP_HEADER_LOCATION))*/
1182         handler_t rc = http_cgi_local_redir(r);
1183         if (rc != HANDLER_GO_ON) return rc;
1184     }
1185 
1186     if (opts->xsendfile_allow) {
1187         buffer *vb;
1188         /* X-Sendfile2 is deprecated; historical for fastcgi */
1189         if (opts->backend == BACKEND_FASTCGI
1190             && NULL != (vb = http_header_response_get(r, HTTP_HEADER_OTHER,
1191                                                       CONST_STR_LEN("X-Sendfile2")))) {
1192             http_response_xsendfile2(r, vb, opts->xsendfile_docroot);
1193             /* http_header_response_unset() shortcut for HTTP_HEADER_OTHER */
1194             buffer_clear(vb); /*(do not send to client)*/
1195             if (NULL == r->handler_module)
1196                 r->resp_body_started = 0;
1197             return HANDLER_FINISHED;
1198         } else if (NULL != (vb = http_header_response_get(r, HTTP_HEADER_OTHER,
1199                                                           CONST_STR_LEN("X-Sendfile")))
1200                    || (opts->backend == BACKEND_FASTCGI /* X-LIGHTTPD-send-file is deprecated; historical for fastcgi */
1201                        && NULL != (vb = http_header_response_get(r, HTTP_HEADER_OTHER,
1202                                                                  CONST_STR_LEN("X-LIGHTTPD-send-file"))))) {
1203             http_response_xsendfile(r, vb, opts->xsendfile_docroot);
1204             /* http_header_response_unset() shortcut for HTTP_HEADER_OTHER */
1205             buffer_clear(vb); /*(do not send to client)*/
1206             if (NULL == r->handler_module)
1207                 r->resp_body_started = 0;
1208             return HANDLER_FINISHED;
1209         }
1210     }
1211 
1212     if (blen > 0) {
1213         /* modules which set opts->parse() (e.g. mod_ajp13, mod_fastcgi) must
1214          * not pass buffer with excess data to this routine (and do not do so
1215          * due to framing of response headers separately from response body) */
1216         int rc = http_response_append_mem(r, bstart, blen);
1217         if (__builtin_expect( (0 != rc), 0))
1218             return HANDLER_ERROR;
1219     }
1220 
1221     /* (callback for response headers complete) */
1222     return (opts->headers) ? opts->headers(r, opts) : HANDLER_GO_ON;
1223 }
1224 
1225 
http_response_read(request_st * const r,http_response_opts * const opts,buffer * const b,fdnode * const fdn)1226 handler_t http_response_read(request_st * const r, http_response_opts * const opts, buffer * const b, fdnode * const fdn) {
1227     const int fd = fdn->fd;
1228     ssize_t n;
1229     size_t avail;
1230     /*size_t total = 0;*/
1231     do {
1232         unsigned int toread = 0;
1233         avail = buffer_string_space(b);
1234 
1235         if (0 == fdevent_ioctl_fionread(fd, opts->fdfmt, (int *)&toread)) {
1236 
1237           #ifdef HAVE_SPLICE
1238             /* check if worthwhile to splice() to avoid copying to userspace */
1239             if (opts->simple_accum) {
1240                 int rc = http_response_append_splice(r, opts, b, fd, toread);
1241                 if (rc) {
1242                     if (__builtin_expect( (rc > 0), 1))
1243                         break;
1244                     return HANDLER_ERROR;
1245                 } /*(fall through to handle traditionally)*/
1246             }
1247           #endif
1248 
1249             if (avail < toread) {
1250                 uint32_t blen = buffer_clen(b);
1251                 if (toread + blen < 4096)
1252                     toread = 4095 - blen;
1253                 else if (toread > opts->max_per_read)
1254                     toread = opts->max_per_read;
1255                 /* reduce amount read for response headers to reduce extra data
1256                  * copying for initial data following response headers
1257                  * (see http_response_parse_headers())
1258                  * (This seems reasonable to do even if opts->parse is set)
1259                  * (default chunk buffer is 8k; typical response headers < 8k)
1260                  * (An alternative might be the opposite: read extra, e.g. 128k,
1261                  *  if data available, in order to write to temp files sooner)*/
1262                 if (toread > 8192 && !r->resp_body_started) toread = 8192;
1263             }
1264             else if (0 == toread) {
1265               #if 0
1266                 return (fdevent_fdnode_interest(fdn) & FDEVENT_IN)
1267                   ? HANDLER_FINISHED  /* read finished */
1268                   : HANDLER_GO_ON;    /* optimistic read; data not ready */
1269               #else
1270                 if (!(fdevent_fdnode_interest(fdn) & FDEVENT_IN)) {
1271                     if (!(r->conf.stream_response_body
1272                           & FDEVENT_STREAM_RESPONSE_POLLRDHUP))
1273                         return HANDLER_GO_ON;/*optimistic read; data not ready*/
1274                 }
1275                 if (0 == avail) /* let read() below indicate if EOF or EAGAIN */
1276                     toread = 1024;
1277               #endif
1278             }
1279         }
1280         else if (avail < 1024) {
1281             toread = 4095 - avail;
1282         }
1283 
1284         if (r->conf.stream_response_body & FDEVENT_STREAM_RESPONSE_BUFMIN) {
1285             off_t cqlen = chunkqueue_length(&r->write_queue);
1286             if (cqlen + (off_t)toread > 65536 - 4096) {
1287                 if (!r->con->is_writable) {
1288                     /*(defer removal of FDEVENT_IN interest since
1289                      * connection_state_machine() might be able to send data
1290                      * immediately, unless !con->is_writable, where
1291                      * connection_state_machine() might not loop back to call
1292                      * mod_proxy_handle_subrequest())*/
1293                     fdevent_fdnode_event_clr(r->con->srv->ev, fdn, FDEVENT_IN);
1294                 }
1295                 if (cqlen >= 65536-1) {
1296                     if (buffer_is_blank(b))
1297                         chunk_buffer_yield(b); /*(improve large buf reuse)*/
1298                     return HANDLER_GO_ON;
1299                 }
1300                 toread = 65536 - 1 - (unsigned int)cqlen;
1301                 /* Note: heuristic is fuzzy in that it limits how much to read
1302                  * from backend based on how much is pending to write to client.
1303                  * Modules where data from backend is framed (e.g. FastCGI) may
1304                  * want to limit how much is buffered from backend while waiting
1305                  * for a complete data frame or data packet from backend. */
1306             }
1307         }
1308 
1309         if (avail < toread) {
1310             /*(add avail+toread to reduce allocations when ioctl EOPNOTSUPP)*/
1311             avail = toread < opts->max_per_read && avail
1312               ? avail-1+toread
1313               : toread;
1314             avail = chunk_buffer_prepare_append(b, avail);
1315         }
1316 
1317         n = read(fd, b->ptr+buffer_clen(b), avail);
1318 
1319         if (n < 0) {
1320             switch (errno) {
1321               case EAGAIN:
1322              #ifdef EWOULDBLOCK
1323              #if EWOULDBLOCK != EAGAIN
1324               case EWOULDBLOCK:
1325              #endif
1326              #endif
1327               case EINTR:
1328                 if (buffer_is_blank(b))
1329                     chunk_buffer_yield(b); /*(improve large buf reuse)*/
1330                 return HANDLER_GO_ON;
1331               default:
1332                 log_perror(r->conf.errh, __FILE__, __LINE__,
1333                   "read() %d %d", r->con->fd, fd);
1334                 return HANDLER_ERROR;
1335             }
1336         }
1337 
1338         buffer_commit(b, (size_t)n);
1339       #ifdef __COVERITY__
1340         /* Coverity Scan overlooks the effect of buffer_commit() */
1341         b->ptr[buffer_clen(b)+n] = '\0';
1342       #endif
1343 
1344         if (NULL != opts->parse) {
1345             handler_t rc = opts->parse(r, opts, b, (size_t)n);
1346             if (rc != HANDLER_GO_ON) return rc;
1347         } else if (0 == n) {
1348             if (buffer_is_blank(b))
1349                 chunk_buffer_yield(b); /*(improve large buf reuse)*/
1350             else if (opts->simple_accum) {
1351                 /*(flush small reads previously accumulated in b)*/
1352                 int rc = http_response_append_buffer(r, b, 0); /*(0 to flush)*/
1353                 chunk_buffer_yield(b); /*(improve large buf reuse)*/
1354                 if (__builtin_expect( (0 != rc), 0)) {
1355                     /* error writing to tempfile;
1356                      * truncate response or send 500 if nothing sent yet */
1357                     return HANDLER_ERROR;
1358                 }
1359             }
1360             /* note: no further data is sent to backend after read EOF on socket
1361              * (not checking for half-closed TCP socket)
1362              * (backend should read all data desired prior to closing socket,
1363              *  though might send app-level close data frame, if applicable) */
1364             return HANDLER_FINISHED; /* read finished */
1365         } else if (0 == r->resp_body_started) {
1366             /* split header from body */
1367             handler_t rc = http_response_parse_headers(r, opts, b);
1368             if (rc != HANDLER_GO_ON) return rc;
1369             /* accumulate response in b until headers completed (or error)*/
1370             if (r->resp_body_started) {
1371                 buffer_clear(b);
1372                 /* check if Content-Length provided and response body received
1373                  * (done here instead of http_response_process_headers() since
1374                  *  backends which set opts->parse() might handle differently)*/
1375                 if (0 == r->resp_body_scratchpad)
1376                     r->resp_body_finished = 1;
1377                 /* enable simple accumulation of small reads in some situations
1378                  * no Content-Length (will read to EOF)
1379                  * Content-Length (will read until r->resp_body_scratchpad == 0)
1380                  * not chunked-encoding
1381                  * not bufmin streaming
1382                  * (no custom parse routine set for opts->parse()) */
1383                 else if (!r->resp_decode_chunked /* && NULL == opts->parse */
1384                          && !(r->conf.stream_response_body
1385                               & FDEVENT_STREAM_RESPONSE_BUFMIN))
1386                     opts->simple_accum = 1;
1387             }
1388         } else {
1389             /* flush b (do not accumulate small reads) if streaming and might
1390              * write to client since there is a chance that r->write_queue is
1391              * fully written to client (no more temp files) and then we do not
1392              * want to hold onto buffered data in b for an indeterminate time
1393              * until next read of data from backend */
1394             int simple_accum = opts->simple_accum
1395                             && (!(r->conf.stream_response_body
1396                                   & FDEVENT_STREAM_RESPONSE)
1397                                 || !r->con->is_writable);
1398             int rc = http_response_append_buffer(r, b, simple_accum);
1399             if (__builtin_expect( (0 != rc), 0)) {
1400                 /* error writing to tempfile;
1401                  * truncate response or send 500 if nothing sent yet */
1402                 return HANDLER_ERROR;
1403             }
1404             /*buffer_clear(b);*//*http_response_append_buffer() clears*/
1405             /* small reads might accumulate in b; not necessarily cleared */
1406         }
1407 
1408         if (r->conf.stream_response_body & FDEVENT_STREAM_RESPONSE_BUFMIN) {
1409             if (chunkqueue_length(&r->write_queue) > 65536 - 4096) {
1410                 /*(defer removal of FDEVENT_IN interest since
1411                  * connection_state_machine() might be able to send
1412                  * data immediately, unless !con->is_writable, where
1413                  * connection_state_machine() might not loop back to
1414                  * call the subrequest handler)*/
1415                 if (!r->con->is_writable)
1416                     fdevent_fdnode_event_clr(r->con->srv->ev, fdn, FDEVENT_IN);
1417                 break;
1418             }
1419         }
1420     } while (!r->resp_body_started); /*(loop to read large response headers)*/
1421     /*while (0);*//*(extra logic might benefit systems without FIONREAD)*/
1422     /*while ((size_t)n == avail && (total += (size_t)n) < opts->max_per_read);*/
1423     /* else emptied kernel read buffer or partial read or reached read limit */
1424 
1425     if (buffer_is_blank(b)) chunk_buffer_yield(b); /*(improve large buf reuse)*/
1426 
1427     return (!r->resp_body_finished ? HANDLER_GO_ON : HANDLER_FINISHED);
1428 }
1429