Gitiles
Code Review Sign In
gerrit.openbmc.org / openbmc / bmcweb / 23a21a1cbed23ace4174664950e595df961e9e69 / . / http / http_connection.h
blob: 855cc11bcc1b579aac56235a8ae0537dff15f6b6 [file] [log] [blame]
Ed Tanous7045c8d2017-04-03 10:04:37 -0700[diff] [blame]1#pragma once
Adriana Kobylak0e1cf262019-12-05 13:57:57 -0600[diff] [blame]2#include "config.h"
3
Manojkiran Eda44250442020-06-16 12:51:38 +0530[diff] [blame]4#include "http_response.h"
5#include "logging.h"
Manojkiran Eda44250442020-06-16 12:51:38 +0530[diff] [blame]6#include "timer_queue.h"
7#include "utility.h"
8
James Feist3909dc82020-04-03 10:58:55 -0700[diff] [blame]9#include "authorization.hpp"
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]10#include "http_utility.hpp"
11
Ed Tanouse0d918b2018-03-27 17:41:04 -0700[diff] [blame]12#include <boost/algorithm/string.hpp>
Ed Tanous257f5792018-03-17 14:40:09 -0700[diff] [blame]13#include <boost/algorithm/string/predicate.hpp>
Ed Tanous8f626352018-12-19 14:51:54 -0800[diff] [blame]14#include <boost/asio/io_context.hpp>
Ed Tanous3112a142018-11-29 15:45:10 -0800[diff] [blame]15#include <boost/asio/ip/tcp.hpp>
Ed Tanous2f1ebcd2019-02-13 19:39:07 -0800[diff] [blame]16#include <boost/asio/ssl.hpp>
Ed Tanous3112a142018-11-29 15:45:10 -0800[diff] [blame]17#include <boost/beast/core/flat_static_buffer.hpp>
Gunnar Mills1214b7e2020-06-04 10:11:30 -0500[diff] [blame]18#include <boost/beast/http.hpp>
Manojkiran Eda44250442020-06-16 12:51:38 +0530[diff] [blame]19#include <boost/beast/ssl/ssl_stream.hpp>
Gunnar Mills1214b7e2020-06-04 10:11:30 -0500[diff] [blame]20#include <boost/beast/websocket.hpp>
Ed Tanous52cc1122020-07-18 13:51:21 -0700[diff] [blame]21#include <security_headers.hpp>
Gunnar Mills1214b7e2020-06-04 10:11:30 -0500[diff] [blame]22#include <ssl_key_handler.hpp>
23
Manojkiran Eda44250442020-06-16 12:51:38 +0530[diff] [blame]24#include <atomic>
Gunnar Mills1214b7e2020-06-04 10:11:30 -0500[diff] [blame]25#include <chrono>
26#include <vector>
27
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]28namespace crow
29{
Ed Tanous257f5792018-03-17 14:40:09 -0700[diff] [blame]30
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]31inline void prettyPrintJson(crow::Response& res)
32{
Jason M. Bills193ad2f2018-09-26 15:08:52 -0700[diff] [blame]33 std::string value = res.jsonValue.dump(4, ' ', true);
Ed Tanousa29c9972018-11-29 15:54:32 -0800[diff] [blame]34 utility::escapeHtml(value);
35 utility::convertToLinks(value);
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]36 res.body() = "<html>\n"
37 "<head>\n"
38 "<title>Redfish API</title>\n"
39 "<link rel=\"stylesheet\" type=\"text/css\" "
40 "href=\"/styles/default.css\">\n"
41 "<script src=\"/highlight.pack.js\"></script>"
42 "<script>hljs.initHighlightingOnLoad();</script>"
43 "</head>\n"
44 "<body>\n"
45 "<div style=\"max-width: 576px;margin:0 auto;\">\n"
46 "<img src=\"/DMTF_Redfish_logo_2017.svg\" alt=\"redfish\" "
47 "height=\"406px\" "
48 "width=\"576px\">\n"
49 "<br>\n"
50 "<pre>\n"
51 "<code class=\"json\">" +
52 value +
53 "</code>\n"
54 "</pre>\n"
55 "</div>\n"
56 "</body>\n"
57 "</html>\n";
Ed Tanous93ef5802019-01-03 10:15:41 -0800[diff] [blame]58 res.addHeader("Content-Type", "text/html;charset=UTF-8");
Ed Tanous257f5792018-03-17 14:40:09 -0700[diff] [blame]59}
60
Ed Tanous7045c8d2017-04-03 10:04:37 -0700[diff] [blame]61using namespace boost;
62using tcp = asio::ip::tcp;
63
Ed Tanous55c7b7a2018-05-22 15:27:24 -0700[diff] [blame]64#ifdef BMCWEB_ENABLE_DEBUG
Ed Tanouse0d918b2018-03-27 17:41:04 -0700[diff] [blame]65static std::atomic<int> connectionCount;
Ed Tanous7045c8d2017-04-03 10:04:37 -0700[diff] [blame]66#endif
Jennifer Leeacb7cfb2018-06-07 16:08:15 -0700[diff] [blame]67
Adriana Kobylak0e1cf262019-12-05 13:57:57 -0600[diff] [blame]68// request body limit size set by the BMCWEB_HTTP_REQ_BODY_LIMIT_MB option
69constexpr unsigned int httpReqBodyLimit =
70 1024 * 1024 * BMCWEB_HTTP_REQ_BODY_LIMIT_MB;
Jennifer Leeacb7cfb2018-06-07 16:08:15 -0700[diff] [blame]71
James Feist3909dc82020-04-03 10:58:55 -0700[diff] [blame]72constexpr uint64_t loggedOutPostBodyLimit = 4096;
73
74constexpr uint32_t httpHeaderLimit = 8192;
75
76// drop all connections after 1 minute, this time limit was chosen
77// arbitrarily and can be adjusted later if needed
78static constexpr const size_t loggedInAttempts =
79 (60 / timerQueueTimeoutSeconds);
80
81static constexpr const size_t loggedOutAttempts =
82 (15 / timerQueueTimeoutSeconds);
83
Ed Tanous52cc1122020-07-18 13:51:21 -0700[diff] [blame]84template <typename Adaptor, typename Handler>
Gunnar Mills1214b7e2020-06-04 10:11:30 -0500[diff] [blame]85class Connection :
Ed Tanous52cc1122020-07-18 13:51:21 -0700[diff] [blame]86 public std::enable_shared_from_this<Connection<Adaptor, Handler>>
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]87{
88 public:
Ed Tanous271584a2019-07-09 16:24:22 -0700[diff] [blame]89 Connection(boost::asio::io_context& ioService, Handler* handlerIn,
90 const std::string& ServerNameIn,
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]91 std::function<std::string()>& get_cached_date_str_f,
Ed Tanous271584a2019-07-09 16:24:22 -0700[diff] [blame]92 detail::TimerQueue& timerQueueIn, Adaptor adaptorIn) :
Ed Tanousceac6f72018-12-02 11:58:47 -0800[diff] [blame]93 adaptor(std::move(adaptorIn)),
Ed Tanous271584a2019-07-09 16:24:22 -0700[diff] [blame]94 handler(handlerIn), serverName(ServerNameIn),
Ed Tanous52cc1122020-07-18 13:51:21 -0700[diff] [blame]95 getCachedDateStr(get_cached_date_str_f), timerQueue(timerQueueIn)
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]96 {
97 parser.emplace(std::piecewise_construct, std::make_tuple());
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]98 parser->body_limit(httpReqBodyLimit);
James Feist3909dc82020-04-03 10:58:55 -0700[diff] [blame]99 parser->header_limit(httpHeaderLimit);
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]100 req.emplace(parser->get());
Kowalski, Kamil55e43f62019-07-10 13:12:57 +0200[diff] [blame]101
102#ifdef BMCWEB_ENABLE_MUTUAL_TLS_AUTHENTICATION
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100[diff] [blame]103 auto ca_available = !std::filesystem::is_empty(
104 std::filesystem::path(ensuressl::trustStorePath));
Ed Tanous52cc1122020-07-18 13:51:21 -0700[diff] [blame]105 if (ca_available && persistent_data::SessionStore::getInstance()
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100[diff] [blame]106 .getAuthMethodsConfig()
107 .tls)
108 {
109 adaptor.set_verify_mode(boost::asio::ssl::verify_peer);
110 SSL_set_session_id_context(
111 adaptor.native_handle(),
112 reinterpret_cast<const unsigned char*>(serverName.c_str()),
Zbigniew Kurzynskicac94c52019-11-07 12:55:04 +0100[diff] [blame]113 static_cast<unsigned int>(serverName.length()));
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100[diff] [blame]114 BMCWEB_LOG_DEBUG << this << " TLS is enabled on this connection.";
115 }
116
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]117 adaptor.set_verify_callback([this](
118 bool preverified,
119 boost::asio::ssl::verify_context& ctx) {
120 // do nothing if TLS is disabled
Ed Tanous52cc1122020-07-18 13:51:21 -0700[diff] [blame]121 if (!persistent_data::SessionStore::getInstance()
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]122 .getAuthMethodsConfig()
123 .tls)
124 {
125 BMCWEB_LOG_DEBUG << this << " TLS auth_config is disabled";
Kowalski, Kamil55e43f62019-07-10 13:12:57 +0200[diff] [blame]126 return true;
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]127 }
128
129 // We always return true to allow full auth flow
130 if (!preverified)
131 {
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100[diff] [blame]132 BMCWEB_LOG_DEBUG << this << " TLS preverification failed.";
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]133 return true;
134 }
135
136 X509_STORE_CTX* cts = ctx.native_handle();
137 if (cts == nullptr)
138 {
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100[diff] [blame]139 BMCWEB_LOG_DEBUG << this << " Cannot get native TLS handle.";
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]140 return true;
141 }
142
143 // Get certificate
144 X509* peerCert =
145 X509_STORE_CTX_get_current_cert(ctx.native_handle());
146 if (peerCert == nullptr)
147 {
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100[diff] [blame]148 BMCWEB_LOG_DEBUG << this
149 << " Cannot get current TLS certificate.";
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]150 return true;
151 }
152
153 // Check if certificate is OK
154 int error = X509_STORE_CTX_get_error(cts);
155 if (error != X509_V_OK)
156 {
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100[diff] [blame]157 BMCWEB_LOG_INFO << this << " Last TLS error is: " << error;
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]158 return true;
159 }
160 // Check that we have reached final certificate in chain
161 int32_t depth = X509_STORE_CTX_get_error_depth(cts);
162 if (depth != 0)
163
164 {
165 BMCWEB_LOG_DEBUG
166 << this << " Certificate verification in progress (depth "
167 << depth << "), waiting to reach final depth";
168 return true;
169 }
170
171 BMCWEB_LOG_DEBUG << this
172 << " Certificate verification of final depth";
173
174 // Verify KeyUsage
175 bool isKeyUsageDigitalSignature = false;
176 bool isKeyUsageKeyAgreement = false;
177
178 ASN1_BIT_STRING* usage = static_cast<ASN1_BIT_STRING*>(
Ed Tanous23a21a12020-07-25 04:45:05 +0000[diff] [blame^]179 X509_get_ext_d2i(peerCert, NID_key_usage, nullptr, nullptr));
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]180
181 if (usage == nullptr)
182 {
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100[diff] [blame]183 BMCWEB_LOG_DEBUG << this << " TLS usage is null";
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]184 return true;
185 }
186
187 for (int i = 0; i < usage->length; i++)
188 {
189 if (KU_DIGITAL_SIGNATURE & usage->data[i])
190 {
191 isKeyUsageDigitalSignature = true;
192 }
193 if (KU_KEY_AGREEMENT & usage->data[i])
194 {
195 isKeyUsageKeyAgreement = true;
196 }
197 }
198
199 if (!isKeyUsageDigitalSignature || !isKeyUsageKeyAgreement)
200 {
201 BMCWEB_LOG_DEBUG << this
202 << " Certificate ExtendedKeyUsage does "
203 "not allow provided certificate to "
204 "be used for user authentication";
205 return true;
206 }
Zbigniew Kurzynski09d02f82020-03-30 13:41:42 +0200[diff] [blame]207 ASN1_BIT_STRING_free(usage);
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]208
209 // Determine that ExtendedKeyUsage includes Client Auth
210
Ed Tanous23a21a12020-07-25 04:45:05 +0000[diff] [blame^]211 stack_st_ASN1_OBJECT* extUsage =
212 static_cast<stack_st_ASN1_OBJECT*>(X509_get_ext_d2i(
213 peerCert, NID_ext_key_usage, nullptr, nullptr));
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]214
215 if (extUsage == nullptr)
216 {
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100[diff] [blame]217 BMCWEB_LOG_DEBUG << this << " TLS extUsage is null";
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]218 return true;
219 }
220
221 bool isExKeyUsageClientAuth = false;
222 for (int i = 0; i < sk_ASN1_OBJECT_num(extUsage); i++)
223 {
224 if (NID_client_auth ==
225 OBJ_obj2nid(sk_ASN1_OBJECT_value(extUsage, i)))
226 {
227 isExKeyUsageClientAuth = true;
228 break;
229 }
230 }
Zbigniew Kurzynski09d02f82020-03-30 13:41:42 +0200[diff] [blame]231 sk_ASN1_OBJECT_free(extUsage);
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]232
233 // Certificate has to have proper key usages set
234 if (!isExKeyUsageClientAuth)
235 {
236 BMCWEB_LOG_DEBUG << this
237 << " Certificate ExtendedKeyUsage does "
238 "not allow provided certificate to "
239 "be used for user authentication";
240 return true;
241 }
242 std::string sslUser;
243 // Extract username contained in CommonName
244 sslUser.resize(256, '\0');
245
246 int status = X509_NAME_get_text_by_NID(
247 X509_get_subject_name(peerCert), NID_commonName, sslUser.data(),
248 static_cast<int>(sslUser.size()));
249
250 if (status == -1)
251 {
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100[diff] [blame]252 BMCWEB_LOG_DEBUG
253 << this << " TLS cannot get username to create session";
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]254 return true;
255 }
256
257 size_t lastChar = sslUser.find('\0');
258 if (lastChar == std::string::npos || lastChar == 0)
259 {
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100[diff] [blame]260 BMCWEB_LOG_DEBUG << this << " Invalid TLS user name";
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]261 return true;
262 }
263 sslUser.resize(lastChar);
264
Ed Tanous52cc1122020-07-18 13:51:21 -0700[diff] [blame]265 session =
266 persistent_data::SessionStore::getInstance()
267 .generateUserSession(
268 sslUser, persistent_data::PersistenceType::TIMEOUT);
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100[diff] [blame]269 if (auto sp = session.lock())
270 {
271 BMCWEB_LOG_DEBUG << this
272 << " Generating TLS session: " << sp->uniqueId;
273 }
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]274 return true;
275 });
Kowalski, Kamil55e43f62019-07-10 13:12:57 +0200[diff] [blame]276#endif // BMCWEB_ENABLE_MUTUAL_TLS_AUTHENTICATION
277
Ed Tanous55c7b7a2018-05-22 15:27:24 -0700[diff] [blame]278#ifdef BMCWEB_ENABLE_DEBUG
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]279 connectionCount++;
280 BMCWEB_LOG_DEBUG << this << " Connection open, total "
281 << connectionCount;
Ed Tanous7045c8d2017-04-03 10:04:37 -0700[diff] [blame]282#endif
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]283 }
Ed Tanous7045c8d2017-04-03 10:04:37 -0700[diff] [blame]284
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]285 ~Connection()
286 {
287 res.completeRequestHandler = nullptr;
288 cancelDeadlineTimer();
Ed Tanous55c7b7a2018-05-22 15:27:24 -0700[diff] [blame]289#ifdef BMCWEB_ENABLE_DEBUG
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]290 connectionCount--;
291 BMCWEB_LOG_DEBUG << this << " Connection closed, total "
292 << connectionCount;
Ed Tanous7045c8d2017-04-03 10:04:37 -0700[diff] [blame]293#endif
Ed Tanous7045c8d2017-04-03 10:04:37 -0700[diff] [blame]294 }
295
Ed Tanousceac6f72018-12-02 11:58:47 -0800[diff] [blame]296 Adaptor& socket()
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]297 {
Ed Tanousceac6f72018-12-02 11:58:47 -0800[diff] [blame]298 return adaptor;
Ed Tanous7045c8d2017-04-03 10:04:37 -0700[diff] [blame]299 }
300
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]301 void start()
302 {
Ed Tanous7045c8d2017-04-03 10:04:37 -0700[diff] [blame]303
James Feist3909dc82020-04-03 10:58:55 -0700[diff] [blame]304 startDeadline(0);
Ed Tanousceac6f72018-12-02 11:58:47 -0800[diff] [blame]305 // TODO(ed) Abstract this to a more clever class with the idea of an
306 // asynchronous "start"
307 if constexpr (std::is_same_v<Adaptor,
308 boost::beast::ssl_stream<
309 boost::asio::ip::tcp::socket>>)
310 {
Jan Sowinskiee52ae12020-01-09 16:28:32 +0000[diff] [blame]311 adaptor.async_handshake(boost::asio::ssl::stream_base::server,
312 [this, self(shared_from_this())](
313 const boost::system::error_code& ec) {
314 if (ec)
315 {
316 return;
317 }
318 doReadHeaders();
319 });
Ed Tanousceac6f72018-12-02 11:58:47 -0800[diff] [blame]320 }
321 else
322 {
323 doReadHeaders();
324 }
Ed Tanous7045c8d2017-04-03 10:04:37 -0700[diff] [blame]325 }
Ed Tanous7045c8d2017-04-03 10:04:37 -0700[diff] [blame]326
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]327 void handle()
328 {
329 cancelDeadlineTimer();
James Feist3909dc82020-04-03 10:58:55 -0700[diff] [blame]330
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]331 bool isInvalidRequest = false;
Ed Tanous7045c8d2017-04-03 10:04:37 -0700[diff] [blame]332
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]333 // Check for HTTP version 1.1.
334 if (req->version() == 11)
335 {
336 if (req->getHeaderValue(boost::beast::http::field::host).empty())
337 {
338 isInvalidRequest = true;
Ed Tanousde5c9f32019-03-26 09:17:55 -0700[diff] [blame]339 res.result(boost::beast::http::status::bad_request);
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]340 }
341 }
Ed Tanous7045c8d2017-04-03 10:04:37 -0700[diff] [blame]342
Ed Tanouse278c182019-03-13 16:23:37 -0700[diff] [blame]343 BMCWEB_LOG_INFO << "Request: "
344 << " " << this << " HTTP/" << req->version() / 10 << "."
345 << req->version() % 10 << ' ' << req->methodString()
346 << " " << req->target();
Ed Tanous7045c8d2017-04-03 10:04:37 -0700[diff] [blame]347
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]348 needToCallAfterHandlers = false;
Ed Tanous7045c8d2017-04-03 10:04:37 -0700[diff] [blame]349
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]350 if (!isInvalidRequest)
351 {
Ed Tanous23a21a12020-07-25 04:45:05 +0000[diff] [blame^]352 req->socket = [self = shared_from_this()]() -> Adaptor& {
raviteja-b4722efe2020-02-03 12:23:18 -0600[diff] [blame]353 return self->socket();
354 };
355
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]356 res.completeRequestHandler = [] {};
Ed Tanouse278c182019-03-13 16:23:37 -0700[diff] [blame]357 res.isAliveHelper = [this]() -> bool { return isAlive(); };
Ed Tanous7045c8d2017-04-03 10:04:37 -0700[diff] [blame]358
Ed Tanouse278c182019-03-13 16:23:37 -0700[diff] [blame]359 req->ioService = static_cast<decltype(req->ioService)>(
360 &adaptor.get_executor().context());
Kowalski, Kamil55e43f62019-07-10 13:12:57 +0200[diff] [blame]361
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]362 if (!res.completed)
363 {
Jan Sowinskiee52ae12020-01-09 16:28:32 +0000[diff] [blame]364 needToCallAfterHandlers = true;
365 res.completeRequestHandler = [self(shared_from_this())] {
366 self->completeRequest();
367 };
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]368 if (req->isUpgrade() &&
369 boost::iequals(
370 req->getHeaderValue(boost::beast::http::field::upgrade),
371 "websocket"))
372 {
373 handler->handleUpgrade(*req, res, std::move(adaptor));
Jan Sowinskiee52ae12020-01-09 16:28:32 +0000[diff] [blame]374 // delete lambda with self shared_ptr
375 // to enable connection destruction
376 res.completeRequestHandler = nullptr;
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]377 return;
378 }
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]379 handler->handle(*req, res);
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]380 }
381 else
382 {
383 completeRequest();
384 }
385 }
386 else
387 {
388 completeRequest();
389 }
390 }
Ed Tanouse0d918b2018-03-27 17:41:04 -0700[diff] [blame]391
Ed Tanouse278c182019-03-13 16:23:37 -0700[diff] [blame]392 bool isAlive()
393 {
394
395 if constexpr (std::is_same_v<Adaptor,
396 boost::beast::ssl_stream<
397 boost::asio::ip::tcp::socket>>)
398 {
399 return adaptor.next_layer().is_open();
400 }
401 else
402 {
403 return adaptor.is_open();
404 }
405 }
406 void close()
407 {
Ed Tanouse278c182019-03-13 16:23:37 -0700[diff] [blame]408 if constexpr (std::is_same_v<Adaptor,
409 boost::beast::ssl_stream<
410 boost::asio::ip::tcp::socket>>)
411 {
412 adaptor.next_layer().close();
Kowalski, Kamil55e43f62019-07-10 13:12:57 +0200[diff] [blame]413#ifdef BMCWEB_ENABLE_MUTUAL_TLS_AUTHENTICATION
414 if (auto sp = session.lock())
415 {
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100[diff] [blame]416 BMCWEB_LOG_DEBUG << this
417 << " Removing TLS session: " << sp->uniqueId;
Kowalski, Kamil55e43f62019-07-10 13:12:57 +0200[diff] [blame]418 persistent_data::SessionStore::getInstance().removeSession(sp);
419 }
420#endif // BMCWEB_ENABLE_MUTUAL_TLS_AUTHENTICATION
Ed Tanouse278c182019-03-13 16:23:37 -0700[diff] [blame]421 }
422 else
423 {
424 adaptor.close();
425 }
426 }
427
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]428 void completeRequest()
429 {
430 BMCWEB_LOG_INFO << "Response: " << this << ' ' << req->url << ' '
431 << res.resultInt() << " keepalive=" << req->keepAlive();
Ed Tanous7045c8d2017-04-03 10:04:37 -0700[diff] [blame]432
Ed Tanous52cc1122020-07-18 13:51:21 -0700[diff] [blame]433 addSecurityHeaders(res);
434
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]435 if (needToCallAfterHandlers)
436 {
James Feist3909dc82020-04-03 10:58:55 -0700[diff] [blame]437 crow::authorization::cleanupTempSession(*req);
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]438 }
Ed Tanous7045c8d2017-04-03 10:04:37 -0700[diff] [blame]439
Ed Tanouse278c182019-03-13 16:23:37 -0700[diff] [blame]440 if (!isAlive())
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]441 {
442 // BMCWEB_LOG_DEBUG << this << " delete (socket is closed) " <<
443 // isReading
444 // << ' ' << isWriting;
445 // delete this;
Jan Sowinskiee52ae12020-01-09 16:28:32 +0000[diff] [blame]446
447 // delete lambda with self shared_ptr
448 // to enable connection destruction
449 res.completeRequestHandler = nullptr;
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]450 return;
451 }
452 if (res.body().empty() && !res.jsonValue.empty())
453 {
454 if (http_helpers::requestPrefersHtml(*req))
455 {
456 prettyPrintJson(res);
457 }
458 else
459 {
460 res.jsonMode();
Jason M. Bills193ad2f2018-09-26 15:08:52 -0700[diff] [blame]461 res.body() = res.jsonValue.dump(2, ' ', true);
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]462 }
463 }
Ed Tanous7045c8d2017-04-03 10:04:37 -0700[diff] [blame]464
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]465 if (res.resultInt() >= 400 && res.body().empty())
466 {
467 res.body() = std::string(res.reason());
468 }
Ed Tanous6295bec2019-09-03 10:11:01 -0700[diff] [blame]469
470 if (res.result() == boost::beast::http::status::no_content)
471 {
472 // Boost beast throws if content is provided on a no-content
473 // response. Ideally, this would never happen, but in the case that
474 // it does, we don't want to throw.
475 BMCWEB_LOG_CRITICAL
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]476 << this << " Response content provided but code was no-content";
Ed Tanous6295bec2019-09-03 10:11:01 -0700[diff] [blame]477 res.body().clear();
478 }
479
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]480 res.addHeader(boost::beast::http::field::server, serverName);
481 res.addHeader(boost::beast::http::field::date, getCachedDateStr());
482
483 res.keepAlive(req->keepAlive());
484
485 doWrite();
Jan Sowinskiee52ae12020-01-09 16:28:32 +0000[diff] [blame]486
487 // delete lambda with self shared_ptr
488 // to enable connection destruction
489 res.completeRequestHandler = nullptr;
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]490 }
491
492 private:
493 void doReadHeaders()
494 {
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]495 BMCWEB_LOG_DEBUG << this << " doReadHeaders";
496
497 // Clean up any previous Connection.
498 boost::beast::http::async_read_header(
Ed Tanousceac6f72018-12-02 11:58:47 -0800[diff] [blame]499 adaptor, buffer, *parser,
Jan Sowinskiee52ae12020-01-09 16:28:32 +0000[diff] [blame]500 [this,
501 self(shared_from_this())](const boost::system::error_code& ec,
502 std::size_t bytes_transferred) {
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]503 BMCWEB_LOG_ERROR << this << " async_read_header "
504 << bytes_transferred << " Bytes";
505 bool errorWhileReading = false;
506 if (ec)
507 {
508 errorWhileReading = true;
509 BMCWEB_LOG_ERROR
510 << this << " Error while reading: " << ec.message();
511 }
512 else
513 {
514 // if the adaptor isn't open anymore, and wasn't handed to a
515 // websocket, treat as an error
Ed Tanouse278c182019-03-13 16:23:37 -0700[diff] [blame]516 if (!isAlive() && !req->isUpgrade())
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]517 {
518 errorWhileReading = true;
519 }
520 }
521
James Feist3909dc82020-04-03 10:58:55 -0700[diff] [blame]522 cancelDeadlineTimer();
523
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]524 if (errorWhileReading)
525 {
Ed Tanouse278c182019-03-13 16:23:37 -0700[diff] [blame]526 close();
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]527 BMCWEB_LOG_DEBUG << this << " from read(1)";
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]528 return;
529 }
530
James Feist3909dc82020-04-03 10:58:55 -0700[diff] [blame]531 if (!req)
532 {
533 close();
534 return;
535 }
536
James Feist5a7e8772020-07-22 09:08:38 -0700[diff] [blame]537 req->urlView = boost::urls::url_view(req->target());
538 req->url = req->urlView.encoded_path();
539
James Feist6964c982020-07-28 16:10:23 -0700[diff] [blame]540 crow::authorization::authenticate(*req, res, session);
James Feist3909dc82020-04-03 10:58:55 -0700[diff] [blame]541
542 bool loggedIn = req && req->session;
543 if (loggedIn)
544 {
545 startDeadline(loggedInAttempts);
546 BMCWEB_LOG_DEBUG << "Starting slow deadline";
547
James Feist5a7e8772020-07-22 09:08:38 -0700[diff] [blame]548 req->urlParams = req->urlView.params();
549
550#ifdef BMCWEB_ENABLE_DEBUG
551 std::string paramList = "";
552 for (const auto param : req->urlParams)
553 {
554 paramList += param->key() + " " + param->value() + " ";
555 }
556 BMCWEB_LOG_DEBUG << "QueryParams: " << paramList;
557#endif
James Feist3909dc82020-04-03 10:58:55 -0700[diff] [blame]558 }
559 else
560 {
561 const boost::optional<uint64_t> contentLength =
562 parser->content_length();
563 if (contentLength &&
564 *contentLength > loggedOutPostBodyLimit)
565 {
566 BMCWEB_LOG_DEBUG << "Content length greater than limit "
567 << *contentLength;
568 close();
569 return;
570 }
571
572 startDeadline(loggedOutAttempts);
573 BMCWEB_LOG_DEBUG << "Starting quick deadline";
574 }
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]575 doRead();
576 });
577 }
578
579 void doRead()
580 {
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]581 BMCWEB_LOG_DEBUG << this << " doRead";
582
583 boost::beast::http::async_read(
Ed Tanousceac6f72018-12-02 11:58:47 -0800[diff] [blame]584 adaptor, buffer, *parser,
Jan Sowinskiee52ae12020-01-09 16:28:32 +0000[diff] [blame]585 [this,
586 self(shared_from_this())](const boost::system::error_code& ec,
587 std::size_t bytes_transferred) {
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]588 BMCWEB_LOG_DEBUG << this << " async_read " << bytes_transferred
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]589 << " Bytes";
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]590
591 bool errorWhileReading = false;
592 if (ec)
593 {
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]594 BMCWEB_LOG_ERROR
595 << this << " Error while reading: " << ec.message();
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]596 errorWhileReading = true;
597 }
598 else
599 {
James Feist3909dc82020-04-03 10:58:55 -0700[diff] [blame]600 if (isAlive())
601 {
602 cancelDeadlineTimer();
603 bool loggedIn = req && req->session;
604 if (loggedIn)
605 {
606 startDeadline(loggedInAttempts);
607 }
608 else
609 {
610 startDeadline(loggedOutAttempts);
611 }
612 }
613 else
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]614 {
615 errorWhileReading = true;
616 }
617 }
618 if (errorWhileReading)
619 {
620 cancelDeadlineTimer();
Ed Tanouse278c182019-03-13 16:23:37 -0700[diff] [blame]621 close();
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]622 BMCWEB_LOG_DEBUG << this << " from read(1)";
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]623 return;
624 }
625 handle();
626 });
627 }
628
629 void doWrite()
630 {
James Feist3909dc82020-04-03 10:58:55 -0700[diff] [blame]631 bool loggedIn = req && req->session;
632 if (loggedIn)
633 {
634 startDeadline(loggedInAttempts);
635 }
636 else
637 {
638 startDeadline(loggedOutAttempts);
639 }
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]640 BMCWEB_LOG_DEBUG << this << " doWrite";
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]641 res.preparePayload();
642 serializer.emplace(*res.stringResponse);
643 boost::beast::http::async_write(
Ed Tanousceac6f72018-12-02 11:58:47 -0800[diff] [blame]644 adaptor, *serializer,
Jan Sowinskiee52ae12020-01-09 16:28:32 +0000[diff] [blame]645 [this,
646 self(shared_from_this())](const boost::system::error_code& ec,
647 std::size_t bytes_transferred) {
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]648 BMCWEB_LOG_DEBUG << this << " async_write " << bytes_transferred
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]649 << " bytes";
650
James Feist54d8bb12020-07-20 13:28:59 -0700[diff] [blame]651 cancelDeadlineTimer();
652
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]653 if (ec)
654 {
655 BMCWEB_LOG_DEBUG << this << " from write(2)";
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]656 return;
657 }
Ed Tanousceac6f72018-12-02 11:58:47 -0800[diff] [blame]658 if (!res.keepAlive())
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]659 {
Ed Tanouse278c182019-03-13 16:23:37 -0700[diff] [blame]660 close();
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]661 BMCWEB_LOG_DEBUG << this << " from write(1)";
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]662 return;
663 }
664
665 serializer.reset();
666 BMCWEB_LOG_DEBUG << this << " Clearing response";
667 res.clear();
668 parser.emplace(std::piecewise_construct, std::make_tuple());
Gunnar Millsded2a1e2020-07-24 09:46:33 -0500[diff] [blame]669 parser->body_limit(httpReqBodyLimit); // reset body limit for
670 // newly created parser
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]671 buffer.consume(buffer.size());
672
673 req.emplace(parser->get());
674 doReadHeaders();
675 });
676 }
677
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]678 void cancelDeadlineTimer()
679 {
Jan Sowinskiee52ae12020-01-09 16:28:32 +0000[diff] [blame]680 if (timerCancelKey)
681 {
682 BMCWEB_LOG_DEBUG << this << " timer cancelled: " << &timerQueue
683 << ' ' << *timerCancelKey;
684 timerQueue.cancel(*timerCancelKey);
685 timerCancelKey.reset();
686 }
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]687 }
688
James Feist3909dc82020-04-03 10:58:55 -0700[diff] [blame]689 void startDeadline(size_t timerIterations)
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]690 {
691 cancelDeadlineTimer();
692
James Feist3909dc82020-04-03 10:58:55 -0700[diff] [blame]693 if (timerIterations)
694 {
695 timerIterations--;
696 }
Jan Sowinski2b5e08e2020-01-09 17:16:02 +0100[diff] [blame]697
James Feist3909dc82020-04-03 10:58:55 -0700[diff] [blame]698 timerCancelKey =
James Feistbe5dfca2020-07-22 08:54:59 -0700[diff] [blame]699 timerQueue.add([self(shared_from_this()), timerIterations,
700 readCount{parser->get().body().size()}] {
James Feist3909dc82020-04-03 10:58:55 -0700[diff] [blame]701 // Mark timer as not active to avoid canceling it during
702 // Connection destructor which leads to double free issue
703 self->timerCancelKey.reset();
704 if (!self->isAlive())
705 {
706 return;
707 }
Jan Sowinski2b5e08e2020-01-09 17:16:02 +0100[diff] [blame]708
James Feistbe5dfca2020-07-22 08:54:59 -0700[diff] [blame]709 bool loggedIn = self->req && self->req->session;
710 // allow slow uploads for logged in users
711 if (loggedIn && self->parser->get().body().size() > readCount)
712 {
713 BMCWEB_LOG_DEBUG << self.get()
714 << " restart timer - read in progress";
715 self->startDeadline(timerIterations);
716 return;
717 }
718
James Feist3909dc82020-04-03 10:58:55 -0700[diff] [blame]719 // Threshold can be used to drop slow connections
720 // to protect against slow-rate DoS attack
721 if (timerIterations)
722 {
James Feistbe5dfca2020-07-22 08:54:59 -0700[diff] [blame]723 BMCWEB_LOG_DEBUG << self.get() << " restart timer";
James Feist3909dc82020-04-03 10:58:55 -0700[diff] [blame]724 self->startDeadline(timerIterations);
725 return;
726 }
727
728 self->close();
729 });
James Feistcb6cb492020-04-03 13:36:17 -0700[diff] [blame]730
731 if (!timerCancelKey)
732 {
733 close();
734 return;
735 }
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]736 BMCWEB_LOG_DEBUG << this << " timer added: " << &timerQueue << ' '
Jan Sowinskiee52ae12020-01-09 16:28:32 +0000[diff] [blame]737 << *timerCancelKey;
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]738 }
739
740 private:
741 Adaptor adaptor;
742 Handler* handler;
743
Ed Tanousa24526d2018-12-10 15:17:59 -0800[diff] [blame]744 // Making this a std::optional allows it to be efficiently destroyed and
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]745 // re-created on Connection reset
Ed Tanousa24526d2018-12-10 15:17:59 -0800[diff] [blame]746 std::optional<
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]747 boost::beast::http::request_parser<boost::beast::http::string_body>>
748 parser;
749
Ed Tanous3112a142018-11-29 15:45:10 -0800[diff] [blame]750 boost::beast::flat_static_buffer<8192> buffer;
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]751
Ed Tanousa24526d2018-12-10 15:17:59 -0800[diff] [blame]752 std::optional<boost::beast::http::response_serializer<
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]753 boost::beast::http::string_body>>
754 serializer;
755
Ed Tanousa24526d2018-12-10 15:17:59 -0800[diff] [blame]756 std::optional<crow::Request> req;
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]757 crow::Response res;
Ed Tanous52cc1122020-07-18 13:51:21 -0700[diff] [blame]758
759 std::weak_ptr<persistent_data::UserSession> session;
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]760
761 const std::string& serverName;
762
Jan Sowinskiee52ae12020-01-09 16:28:32 +0000[diff] [blame]763 std::optional<size_t> timerCancelKey;
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]764
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]765 bool needToCallAfterHandlers{};
766 bool needToStartReadAfterComplete{};
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]767
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]768 std::function<std::string()>& getCachedDateStr;
769 detail::TimerQueue& timerQueue;
Jan Sowinskiee52ae12020-01-09 16:28:32 +0000[diff] [blame]770
771 using std::enable_shared_from_this<
Ed Tanous52cc1122020-07-18 13:51:21 -0700[diff] [blame]772 Connection<Adaptor, Handler>>::shared_from_this;
Ed Tanous3112a142018-11-29 15:45:10 -0800[diff] [blame]773};
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]774} // namespace crow