uhttpd/file: fix string out of buffer range on uh_defer_script

[project/uhttpd.git] / client.c

diff --git a/client.c b/client.c
index 9b8fb07025037a30c52548f1e006bb4042a01c81..c037cc79874855999fb849c03e064a7f6a99072b 100644 (file)
--- a/client.c
+++ b/client.c
@@ -40,13 +40,20 @@ const char * const http_methods[] = {
        [UH_HTTP_MSG_POST] = "POST",
        [UH_HTTP_MSG_HEAD] = "HEAD",
        [UH_HTTP_MSG_OPTIONS] = "OPTIONS",
+       [UH_HTTP_MSG_PUT] = "PUT",
+       [UH_HTTP_MSG_PATCH] = "PATCH",
+       [UH_HTTP_MSG_DELETE] = "DELETE",
 };
 
 void uh_http_header(struct client *cl, int code, const char *summary)
 {
        struct http_request *r = &cl->request;
+       struct blob_attr *cur;
        const char *enc = "Transfer-Encoding: chunked\r\n";
        const char *conn;
+       int rem;
+
+       cl->http_code = code;
 
        if (!uh_use_chunked(cl))
                enc = "";
@@ -62,6 +69,10 @@ void uh_http_header(struct client *cl, int code, const char *summary)
 
        if (!r->connection_close)
                ustream_printf(cl->us, "Keep-Alive: timeout=%d\r\n", conf.http_keepalive);
+
+       blobmsg_for_each_attr(cur, cl->hdr_response.head, rem)
+               ustream_printf(cl->us, "%s: %s\r\n", blobmsg_name(cur),
+                              blobmsg_get_string(cur));
 }
 
 static void uh_connection_close(struct client *cl)
@@ -84,7 +95,8 @@ static void client_timeout(struct uloop_timeout *timeout)
        struct client *cl = container_of(timeout, struct client, timeout);
 
        cl->state = CLIENT_STATE_CLOSE;
-       uh_connection_close(cl);
+       cl->request.connection_close = true;
+       uh_request_done(cl);
 }
 
 static void uh_set_client_timeout(struct client *cl, int timeout)
@@ -112,6 +124,7 @@ void uh_request_done(struct client *cl)
 {
        uh_chunk_eof(cl);
        uh_dispatch_done(cl);
+       blob_buf_init(&cl->hdr_response, 0);
        memset(&cl->dispatch, 0, sizeof(cl->dispatch));
 
        if (!conf.http_keepalive || cl->request.connection_close)
@@ -125,6 +138,7 @@ void uh_request_done(struct client *cl)
 void __printf(4, 5)
 uh_client_error(struct client *cl, int code, const char *summary, const char *fmt, ...)
 {
+       struct http_request *r = &cl->request;
        va_list arg;
 
        uh_http_header(cl, code, summary);
@@ -138,6 +152,17 @@ uh_client_error(struct client *cl, int code, const char *summary, const char *fm
                va_end(arg);
        }
 
+       /* Close the connection even when keep alive is set, when it
+        * contains a request body, as it was not read and we are
+        * currently out of sync. Without handling this the body will be
+        * interpreted as part of the next request. The alternative
+        * would be to read and discard the request body here.
+        */
+       if (r->transfer_chunked || r->content_length > 0) {
+               cl->state = CLIENT_STATE_CLOSE;
+               cl->request.connection_close = true;
+       }
+
        uh_request_done(cl);
 }
 
@@ -182,8 +207,7 @@ static int client_parse_request(struct client *cl, char *data)
 
        req->method = h_method;
        req->version = h_version;
-       if (req->version < UH_HTTP_VER_1_1 || req->method == UH_HTTP_MSG_POST ||
-           !conf.http_keepalive)
+       if (req->version < UH_HTTP_VER_1_1 || !conf.http_keepalive)
                req->connection_close = true;
 
        return CLIENT_STATE_HEADER;
@@ -226,6 +250,52 @@ static bool rfc1918_filter_check(struct client *cl)
        return false;
 }
 
+static bool tls_redirect_check(struct client *cl)
+{
+       int rem, port;
+       struct blob_attr *cur;
+       char *ptr, *url = NULL, *host = NULL;
+
+       if (cl->tls || !conf.tls_redirect)
+               return true;
+
+       if ((port = uh_first_tls_port(cl->srv_addr.family)) == -1)
+               return true;
+
+       blob_for_each_attr(cur, cl->hdr.head, rem) {
+               if (!strncmp(blobmsg_name(cur), "host", 4))
+                       host = blobmsg_get_string(cur);
+
+               if (!strncmp(blobmsg_name(cur), "URL", 3))
+                       url = blobmsg_get_string(cur);
+
+               if (url && host)
+                       break;
+       }
+
+       if (!url || !host)
+               return true;
+
+       if ((ptr = strchr(host, ']')) != NULL)
+               *(ptr+1) = 0;
+       else if ((ptr = strchr(host, ':')) != NULL)
+               *ptr = 0;
+
+       cl->request.disable_chunked = true;
+       cl->request.connection_close = true;
+
+       uh_http_header(cl, 307, "Temporary Redirect");
+
+       if (port != 443)
+               ustream_printf(cl->us, "Location: https://%s:%d%s\r\n\r\n", host, port, url);
+       else
+               ustream_printf(cl->us, "Location: https://%s%s\r\n\r\n", host, url);
+
+       uh_request_done(cl);
+
+       return false;
+}
+
 static void client_header_complete(struct client *cl)
 {
        struct http_request *r = &cl->request;
@@ -233,6 +303,9 @@ static void client_header_complete(struct client *cl)
        if (!rfc1918_filter_check(cl))
                return;
 
+       if (!tls_redirect_check(cl))
+               return;
+
        if (r->expect_cont)
                ustream_printf(cl->us, "HTTP/1.1 100 Continue\r\n\r\n");
 
@@ -285,7 +358,7 @@ static void client_parse_header(struct client *cl, char *data)
                }
        } else if (!strcmp(data, "content-length")) {
                r->content_length = strtoul(val, &err, 0);
-               if (err && *err) {
+               if ((err && *err) || r->content_length < 0) {
                        uh_header_error(cl, 400, "Bad Request");
                        return;
                }
@@ -335,6 +408,7 @@ void client_poll_post_data(struct client *cl)
 {
        struct dispatch *d = &cl->dispatch;
        struct http_request *r = &cl->request;
+       enum client_state st;
        char *buf;
        int len;
 
@@ -383,7 +457,7 @@ void client_poll_post_data(struct client *cl)
                ustream_consume(cl->us, sep + 2 - buf);
 
                /* invalid chunk length */
-               if (sep && *sep) {
+               if ((sep && *sep) || r->content_length < 0) {
                        r->content_length = 0;
                        r->transfer_chunked = 0;
                        break;
@@ -399,10 +473,13 @@ void client_poll_post_data(struct client *cl)
        buf = ustream_get_read_buf(cl->us, &len);
        if (!r->content_length && !r->transfer_chunked &&
                cl->state != CLIENT_STATE_DONE) {
+               st = cl->state;
+
                if (cl->dispatch.data_done)
                        cl->dispatch.data_done(cl);
 
-               cl->state = CLIENT_STATE_DONE;
+               if (cl->state == st)
+                       cl->state = CLIENT_STATE_DONE;
        }
 }
 
@@ -455,7 +532,8 @@ void uh_client_read_cb(struct client *cl)
 
                if (!read_cbs[cl->state](cl, str, len)) {
                        if (len == us->r.buffer_len &&
-                           cl->state != CLIENT_STATE_DATA)
+                           cl->state != CLIENT_STATE_DATA &&
+                           cl->state != CLIENT_STATE_DONE)
                                uh_header_error(cl, 413, "Request Entity Too Large");
                        break;
                }
@@ -479,6 +557,7 @@ static void client_close(struct client *cl)
        close(cl->sfd.fd.fd);
        list_del(&cl->list);
        blob_buf_free(&cl->hdr);
+       blob_buf_free(&cl->hdr_response);
        free(cl);
 
        uh_unblock_listeners();
@@ -494,6 +573,14 @@ void uh_client_notify_state(struct client *cl)
 
                if (!s->eof || s->w.data_bytes)
                        return;
+
+#ifdef HAVE_TLS
+               if (cl->tls && cl->ssl.conn && cl->ssl.conn->w.data_bytes) {
+                       cl->ssl.conn->eof = s->eof;
+                       if (!ustream_write_pending(cl->ssl.conn))
+                               return;
+               }
+#endif
        }
 
        return client_close(cl);