blob: b1693092d0187b35fc733d37c5f9d84c74c7d488 [file] [log] [blame]
Ed Tanous7045c8d2017-04-03 10:04:37 -07001#pragma once
Ed Tanous75312982021-02-11 14:26:02 -08002#include "bmcweb_config.h"
Adriana Kobylak0e1cf262019-12-05 13:57:57 -06003
James Feist3909dc82020-04-03 10:58:55 -07004#include "authorization.hpp"
Ed Tanous04e438c2020-10-03 08:06:26 -07005#include "http_response.hpp"
Ed Tanous1abe55e2018-09-05 08:30:59 -07006#include "http_utility.hpp"
Ed Tanous04e438c2020-10-03 08:06:26 -07007#include "logging.hpp"
8#include "timer_queue.hpp"
9#include "utility.hpp"
Ed Tanous1abe55e2018-09-05 08:30:59 -070010
Ed Tanouse0d918b2018-03-27 17:41:04 -070011#include <boost/algorithm/string.hpp>
Ed Tanous257f5792018-03-17 14:40:09 -070012#include <boost/algorithm/string/predicate.hpp>
Ed Tanous8f626352018-12-19 14:51:54 -080013#include <boost/asio/io_context.hpp>
Ed Tanous3112a142018-11-29 15:45:10 -080014#include <boost/asio/ip/tcp.hpp>
Ed Tanousd43cd0c2020-09-30 20:46:53 -070015#include <boost/asio/ssl/stream.hpp>
Ed Tanous3112a142018-11-29 15:45:10 -080016#include <boost/beast/core/flat_static_buffer.hpp>
Manojkiran Eda44250442020-06-16 12:51:38 +053017#include <boost/beast/ssl/ssl_stream.hpp>
Gunnar Mills1214b7e2020-06-04 10:11:30 -050018#include <boost/beast/websocket.hpp>
Ed Tanousd32c4fa2021-09-14 13:16:51 -070019#include <boost/url/url_view.hpp>
Ed Tanous57fce802019-05-21 13:00:34 -070020#include <json_html_serializer.hpp>
Ed Tanous52cc1122020-07-18 13:51:21 -070021#include <security_headers.hpp>
Gunnar Mills1214b7e2020-06-04 10:11:30 -050022#include <ssl_key_handler.hpp>
23
Manojkiran Eda44250442020-06-16 12:51:38 +053024#include <atomic>
Gunnar Mills1214b7e2020-06-04 10:11:30 -050025#include <chrono>
26#include <vector>
27
Ed Tanous1abe55e2018-09-05 08:30:59 -070028namespace crow
29{
Ed Tanous257f5792018-03-17 14:40:09 -070030
Ed Tanous1abe55e2018-09-05 08:30:59 -070031inline void prettyPrintJson(crow::Response& res)
32{
Ed Tanous57fce802019-05-21 13:00:34 -070033 json_html_util::dumpHtml(res.body(), res.jsonValue);
34
Ed Tanous93ef5802019-01-03 10:15:41 -080035 res.addHeader("Content-Type", "text/html;charset=UTF-8");
Ed Tanous257f5792018-03-17 14:40:09 -070036}
37
Ed Tanous55c7b7a2018-05-22 15:27:24 -070038#ifdef BMCWEB_ENABLE_DEBUG
Ed Tanouse0d918b2018-03-27 17:41:04 -070039static std::atomic<int> connectionCount;
Ed Tanous7045c8d2017-04-03 10:04:37 -070040#endif
Jennifer Leeacb7cfb2018-06-07 16:08:15 -070041
Ed Tanous0260d9d2021-02-07 19:31:07 +000042// request body limit size set by the bmcwebHttpReqBodyLimitMb option
Adriana Kobylak0e1cf262019-12-05 13:57:57 -060043constexpr unsigned int httpReqBodyLimit =
Ed Tanous0260d9d2021-02-07 19:31:07 +000044 1024 * 1024 * bmcwebHttpReqBodyLimitMb;
Jennifer Leeacb7cfb2018-06-07 16:08:15 -070045
James Feist3909dc82020-04-03 10:58:55 -070046constexpr uint64_t loggedOutPostBodyLimit = 4096;
47
48constexpr uint32_t httpHeaderLimit = 8192;
49
50// drop all connections after 1 minute, this time limit was chosen
51// arbitrarily and can be adjusted later if needed
52static constexpr const size_t loggedInAttempts =
53 (60 / timerQueueTimeoutSeconds);
54
55static constexpr const size_t loggedOutAttempts =
56 (15 / timerQueueTimeoutSeconds);
57
Ed Tanous52cc1122020-07-18 13:51:21 -070058template <typename Adaptor, typename Handler>
Gunnar Mills1214b7e2020-06-04 10:11:30 -050059class Connection :
Ed Tanous52cc1122020-07-18 13:51:21 -070060 public std::enable_shared_from_this<Connection<Adaptor, Handler>>
Ed Tanous1abe55e2018-09-05 08:30:59 -070061{
62 public:
Ed Tanouse7d1a1c2020-09-28 09:36:35 -070063 Connection(Handler* handlerIn,
Ed Tanous81ce6092020-12-17 16:54:55 +000064 std::function<std::string()>& getCachedDateStrF,
Ed Tanous271584a2019-07-09 16:24:22 -070065 detail::TimerQueue& timerQueueIn, Adaptor adaptorIn) :
Ed Tanousceac6f72018-12-02 11:58:47 -080066 adaptor(std::move(adaptorIn)),
Ed Tanous81ce6092020-12-17 16:54:55 +000067 handler(handlerIn), getCachedDateStr(getCachedDateStrF),
Ed Tanouse7d1a1c2020-09-28 09:36:35 -070068 timerQueue(timerQueueIn)
Ed Tanous1abe55e2018-09-05 08:30:59 -070069 {
70 parser.emplace(std::piecewise_construct, std::make_tuple());
Ed Tanous1abe55e2018-09-05 08:30:59 -070071 parser->body_limit(httpReqBodyLimit);
James Feist3909dc82020-04-03 10:58:55 -070072 parser->header_limit(httpHeaderLimit);
Kowalski, Kamil55e43f62019-07-10 13:12:57 +020073
74#ifdef BMCWEB_ENABLE_MUTUAL_TLS_AUTHENTICATION
Ed Tanous40aa0582021-07-14 13:24:40 -070075 prepareMutualTls();
76#endif // BMCWEB_ENABLE_MUTUAL_TLS_AUTHENTICATION
77
78#ifdef BMCWEB_ENABLE_DEBUG
79 connectionCount++;
80 BMCWEB_LOG_DEBUG << this << " Connection open, total "
81 << connectionCount;
82#endif
83 }
84
85 ~Connection()
86 {
John Edward Broadbent4147b8a2021-07-19 16:52:24 -070087 res.setCompleteRequestHandler(nullptr);
Ed Tanous40aa0582021-07-14 13:24:40 -070088 cancelDeadlineTimer();
89#ifdef BMCWEB_ENABLE_DEBUG
90 connectionCount--;
91 BMCWEB_LOG_DEBUG << this << " Connection closed, total "
92 << connectionCount;
93#endif
94 }
95
96 void prepareMutualTls()
97 {
Jonathan Doman83deb7d2020-11-16 17:00:22 -080098 std::error_code error;
99 std::filesystem::path caPath(ensuressl::trustStorePath);
100 auto caAvailable = !std::filesystem::is_empty(caPath, error);
101 caAvailable = caAvailable && !error;
Ed Tanous2c70f802020-09-28 14:29:23 -0700102 if (caAvailable && persistent_data::SessionStore::getInstance()
103 .getAuthMethodsConfig()
104 .tls)
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100105 {
106 adaptor.set_verify_mode(boost::asio::ssl::verify_peer);
Ed Tanouse7d1a1c2020-09-28 09:36:35 -0700107 std::string id = "bmcweb";
108 int ret = SSL_set_session_id_context(
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100109 adaptor.native_handle(),
Ed Tanouse7d1a1c2020-09-28 09:36:35 -0700110 reinterpret_cast<const unsigned char*>(id.c_str()),
111 static_cast<unsigned int>(id.length()));
112 if (ret == 0)
113 {
114 BMCWEB_LOG_ERROR << this << " failed to set SSL id";
115 }
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100116 }
117
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100118 adaptor.set_verify_callback([this](
119 bool preverified,
120 boost::asio::ssl::verify_context& ctx) {
121 // do nothing if TLS is disabled
Ed Tanous52cc1122020-07-18 13:51:21 -0700122 if (!persistent_data::SessionStore::getInstance()
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100123 .getAuthMethodsConfig()
124 .tls)
125 {
126 BMCWEB_LOG_DEBUG << this << " TLS auth_config is disabled";
Kowalski, Kamil55e43f62019-07-10 13:12:57 +0200127 return true;
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100128 }
129
130 // We always return true to allow full auth flow
131 if (!preverified)
132 {
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100133 BMCWEB_LOG_DEBUG << this << " TLS preverification failed.";
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100134 return true;
135 }
136
137 X509_STORE_CTX* cts = ctx.native_handle();
138 if (cts == nullptr)
139 {
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100140 BMCWEB_LOG_DEBUG << this << " Cannot get native TLS handle.";
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100141 return true;
142 }
143
144 // Get certificate
145 X509* peerCert =
146 X509_STORE_CTX_get_current_cert(ctx.native_handle());
147 if (peerCert == nullptr)
148 {
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100149 BMCWEB_LOG_DEBUG << this
150 << " Cannot get current TLS certificate.";
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100151 return true;
152 }
153
154 // Check if certificate is OK
155 int error = X509_STORE_CTX_get_error(cts);
156 if (error != X509_V_OK)
157 {
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100158 BMCWEB_LOG_INFO << this << " Last TLS error is: " << error;
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100159 return true;
160 }
161 // Check that we have reached final certificate in chain
162 int32_t depth = X509_STORE_CTX_get_error_depth(cts);
163 if (depth != 0)
164
165 {
166 BMCWEB_LOG_DEBUG
167 << this << " Certificate verification in progress (depth "
168 << depth << "), waiting to reach final depth";
169 return true;
170 }
171
172 BMCWEB_LOG_DEBUG << this
173 << " Certificate verification of final depth";
174
175 // Verify KeyUsage
176 bool isKeyUsageDigitalSignature = false;
177 bool isKeyUsageKeyAgreement = false;
178
179 ASN1_BIT_STRING* usage = static_cast<ASN1_BIT_STRING*>(
Ed Tanous23a21a12020-07-25 04:45:05 +0000180 X509_get_ext_d2i(peerCert, NID_key_usage, nullptr, nullptr));
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100181
182 if (usage == nullptr)
183 {
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100184 BMCWEB_LOG_DEBUG << this << " TLS usage is null";
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100185 return true;
186 }
187
188 for (int i = 0; i < usage->length; i++)
189 {
190 if (KU_DIGITAL_SIGNATURE & usage->data[i])
191 {
192 isKeyUsageDigitalSignature = true;
193 }
194 if (KU_KEY_AGREEMENT & usage->data[i])
195 {
196 isKeyUsageKeyAgreement = true;
197 }
198 }
Vernon Maueryb9378302021-06-16 14:06:57 -0700199 ASN1_BIT_STRING_free(usage);
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100200
201 if (!isKeyUsageDigitalSignature || !isKeyUsageKeyAgreement)
202 {
203 BMCWEB_LOG_DEBUG << this
204 << " Certificate ExtendedKeyUsage does "
205 "not allow provided certificate to "
206 "be used for user authentication";
207 return true;
208 }
209
210 // Determine that ExtendedKeyUsage includes Client Auth
211
Ed Tanous23a21a12020-07-25 04:45:05 +0000212 stack_st_ASN1_OBJECT* extUsage =
213 static_cast<stack_st_ASN1_OBJECT*>(X509_get_ext_d2i(
214 peerCert, NID_ext_key_usage, nullptr, nullptr));
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100215
216 if (extUsage == nullptr)
217 {
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100218 BMCWEB_LOG_DEBUG << this << " TLS extUsage is null";
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100219 return true;
220 }
221
222 bool isExKeyUsageClientAuth = false;
223 for (int i = 0; i < sk_ASN1_OBJECT_num(extUsage); i++)
224 {
225 if (NID_client_auth ==
226 OBJ_obj2nid(sk_ASN1_OBJECT_value(extUsage, i)))
227 {
228 isExKeyUsageClientAuth = true;
229 break;
230 }
231 }
Zbigniew Kurzynski09d02f82020-03-30 13:41:42 +0200232 sk_ASN1_OBJECT_free(extUsage);
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100233
234 // Certificate has to have proper key usages set
235 if (!isExKeyUsageClientAuth)
236 {
237 BMCWEB_LOG_DEBUG << this
238 << " Certificate ExtendedKeyUsage does "
239 "not allow provided certificate to "
240 "be used for user authentication";
241 return true;
242 }
243 std::string sslUser;
244 // Extract username contained in CommonName
245 sslUser.resize(256, '\0');
246
247 int status = X509_NAME_get_text_by_NID(
248 X509_get_subject_name(peerCert), NID_commonName, sslUser.data(),
249 static_cast<int>(sslUser.size()));
250
251 if (status == -1)
252 {
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100253 BMCWEB_LOG_DEBUG
254 << this << " TLS cannot get username to create session";
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100255 return true;
256 }
257
258 size_t lastChar = sslUser.find('\0');
259 if (lastChar == std::string::npos || lastChar == 0)
260 {
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100261 BMCWEB_LOG_DEBUG << this << " Invalid TLS user name";
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100262 return true;
263 }
264 sslUser.resize(lastChar);
Sunitha Harishd3239222021-02-24 15:33:29 +0530265 std::string unsupportedClientId = "";
Ed Tanous9a69d5a2021-09-13 10:23:51 -0700266 sessionIsFromTransport = true;
John Edward Broadbent59b98b22021-07-13 15:36:32 -0700267 userSession = persistent_data::SessionStore::getInstance()
268 .generateUserSession(
269 sslUser, req->ipAddress.to_string(),
270 unsupportedClientId,
271 persistent_data::PersistenceType::TIMEOUT);
272 if (userSession != nullptr)
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100273 {
John Edward Broadbent59b98b22021-07-13 15:36:32 -0700274 BMCWEB_LOG_DEBUG
275 << this
276 << " Generating TLS session: " << userSession->uniqueId;
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100277 }
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100278 return true;
279 });
Ed Tanous7045c8d2017-04-03 10:04:37 -0700280 }
281
Ed Tanousceac6f72018-12-02 11:58:47 -0800282 Adaptor& socket()
Ed Tanous1abe55e2018-09-05 08:30:59 -0700283 {
Ed Tanousceac6f72018-12-02 11:58:47 -0800284 return adaptor;
Ed Tanous7045c8d2017-04-03 10:04:37 -0700285 }
286
Ed Tanous1abe55e2018-09-05 08:30:59 -0700287 void start()
288 {
Ed Tanous7045c8d2017-04-03 10:04:37 -0700289
James Feist3909dc82020-04-03 10:58:55 -0700290 startDeadline(0);
Sunitha Harishc0ea7ae2020-10-30 02:37:30 -0500291
Ed Tanousceac6f72018-12-02 11:58:47 -0800292 // TODO(ed) Abstract this to a more clever class with the idea of an
293 // asynchronous "start"
294 if constexpr (std::is_same_v<Adaptor,
295 boost::beast::ssl_stream<
296 boost::asio::ip::tcp::socket>>)
297 {
Jan Sowinskiee52ae12020-01-09 16:28:32 +0000298 adaptor.async_handshake(boost::asio::ssl::stream_base::server,
299 [this, self(shared_from_this())](
300 const boost::system::error_code& ec) {
301 if (ec)
302 {
303 return;
304 }
305 doReadHeaders();
306 });
Ed Tanousceac6f72018-12-02 11:58:47 -0800307 }
308 else
309 {
310 doReadHeaders();
311 }
Ed Tanous7045c8d2017-04-03 10:04:37 -0700312 }
Ed Tanous7045c8d2017-04-03 10:04:37 -0700313
Ed Tanous1abe55e2018-09-05 08:30:59 -0700314 void handle()
315 {
316 cancelDeadlineTimer();
Ed Tanousf79b7a52021-09-22 19:04:29 -0700317 std::error_code reqEc;
318 crow::Request& thisReq = req.emplace(parser->release(), reqEc);
319 if (reqEc)
320 {
321 BMCWEB_LOG_DEBUG << "Request failed to construct" << reqEc;
322 return;
323 }
Ed Tanous596b2032021-09-13 10:32:22 -0700324 thisReq.session = userSession;
325
Ivan Mikhaylovf65b0be2021-04-19 10:05:30 +0000326 // Fetch the client IP address
327 readClientIp();
328
Ed Tanous1abe55e2018-09-05 08:30:59 -0700329 // Check for HTTP version 1.1.
Ed Tanous596b2032021-09-13 10:32:22 -0700330 if (thisReq.version() == 11)
Ed Tanous1abe55e2018-09-05 08:30:59 -0700331 {
Ed Tanous596b2032021-09-13 10:32:22 -0700332 if (thisReq.getHeaderValue(boost::beast::http::field::host).empty())
Ed Tanous1abe55e2018-09-05 08:30:59 -0700333 {
Ed Tanousde5c9f32019-03-26 09:17:55 -0700334 res.result(boost::beast::http::status::bad_request);
Ed Tanous6c7f01d2021-08-25 13:42:35 -0700335 completeRequest();
336 return;
Ed Tanous1abe55e2018-09-05 08:30:59 -0700337 }
338 }
Ed Tanous7045c8d2017-04-03 10:04:37 -0700339
Ed Tanouse278c182019-03-13 16:23:37 -0700340 BMCWEB_LOG_INFO << "Request: "
Ed Tanous596b2032021-09-13 10:32:22 -0700341 << " " << this << " HTTP/" << thisReq.version() / 10
342 << "." << thisReq.version() % 10 << ' '
343 << thisReq.methodString() << " " << thisReq.target()
344 << " " << thisReq.ipAddress;
Ed Tanousd32c4fa2021-09-14 13:16:51 -0700345
Ed Tanous6c7f01d2021-08-25 13:42:35 -0700346 res.setCompleteRequestHandler(nullptr);
347 res.isAliveHelper = [this]() -> bool { return isAlive(); };
Ed Tanous7045c8d2017-04-03 10:04:37 -0700348
Ed Tanous596b2032021-09-13 10:32:22 -0700349 thisReq.ioService = static_cast<decltype(thisReq.ioService)>(
Ed Tanous6c7f01d2021-08-25 13:42:35 -0700350 &adaptor.get_executor().context());
Kowalski, Kamil55e43f62019-07-10 13:12:57 +0200351
Ed Tanous6c7f01d2021-08-25 13:42:35 -0700352 if (res.completed)
Ed Tanous1abe55e2018-09-05 08:30:59 -0700353 {
354 completeRequest();
Ed Tanous6c7f01d2021-08-25 13:42:35 -0700355 return;
Ed Tanous1abe55e2018-09-05 08:30:59 -0700356 }
Ed Tanous1d3c14a2021-09-22 18:54:40 -0700357
Ed Tanousefee36b2021-09-22 19:09:11 -0700358 if (!crow::authorization::isOnAllowlist(req->url, req->method()) &&
Ed Tanous1d3c14a2021-09-22 18:54:40 -0700359 thisReq.session == nullptr)
360 {
361 BMCWEB_LOG_WARNING << "[AuthMiddleware] authorization failed";
362 forward_unauthorized::sendUnauthorized(
363 req->url, req->getHeaderValue("User-Agent"),
364 req->getHeaderValue("Accept"), res);
365 completeRequest();
366 return;
367 }
368
Ed Tanous6c7f01d2021-08-25 13:42:35 -0700369 res.setCompleteRequestHandler([self(shared_from_this())] {
370 boost::asio::post(self->adaptor.get_executor(),
371 [self] { self->completeRequest(); });
372 });
373
Ed Tanous596b2032021-09-13 10:32:22 -0700374 if (thisReq.isUpgrade() &&
Ed Tanous6c7f01d2021-08-25 13:42:35 -0700375 boost::iequals(
Ed Tanous596b2032021-09-13 10:32:22 -0700376 thisReq.getHeaderValue(boost::beast::http::field::upgrade),
Ed Tanous6c7f01d2021-08-25 13:42:35 -0700377 "websocket"))
378 {
Ed Tanous596b2032021-09-13 10:32:22 -0700379 handler->handleUpgrade(thisReq, res, std::move(adaptor));
Ed Tanous6c7f01d2021-08-25 13:42:35 -0700380 // delete lambda with self shared_ptr
381 // to enable connection destruction
382 res.setCompleteRequestHandler(nullptr);
383 return;
384 }
385 auto asyncResp = std::make_shared<bmcweb::AsyncResp>(res);
Ed Tanous596b2032021-09-13 10:32:22 -0700386 handler->handle(thisReq, asyncResp);
Ed Tanous1abe55e2018-09-05 08:30:59 -0700387 }
Ed Tanouse0d918b2018-03-27 17:41:04 -0700388
Ed Tanouse278c182019-03-13 16:23:37 -0700389 bool isAlive()
390 {
Ed Tanouse278c182019-03-13 16:23:37 -0700391 if constexpr (std::is_same_v<Adaptor,
392 boost::beast::ssl_stream<
393 boost::asio::ip::tcp::socket>>)
394 {
395 return adaptor.next_layer().is_open();
396 }
397 else
398 {
399 return adaptor.is_open();
400 }
401 }
402 void close()
403 {
Ed Tanouse278c182019-03-13 16:23:37 -0700404 if constexpr (std::is_same_v<Adaptor,
405 boost::beast::ssl_stream<
406 boost::asio::ip::tcp::socket>>)
407 {
408 adaptor.next_layer().close();
Kowalski, Kamil55e43f62019-07-10 13:12:57 +0200409#ifdef BMCWEB_ENABLE_MUTUAL_TLS_AUTHENTICATION
John Edward Broadbent59b98b22021-07-13 15:36:32 -0700410 if (userSession != nullptr)
Kowalski, Kamil55e43f62019-07-10 13:12:57 +0200411 {
John Edward Broadbent59b98b22021-07-13 15:36:32 -0700412 BMCWEB_LOG_DEBUG
413 << this
414 << " Removing TLS session: " << userSession->uniqueId;
415 persistent_data::SessionStore::getInstance().removeSession(
416 userSession);
Kowalski, Kamil55e43f62019-07-10 13:12:57 +0200417 }
418#endif // BMCWEB_ENABLE_MUTUAL_TLS_AUTHENTICATION
Ed Tanouse278c182019-03-13 16:23:37 -0700419 }
420 else
421 {
422 adaptor.close();
423 }
424 }
425
Ed Tanous1abe55e2018-09-05 08:30:59 -0700426 void completeRequest()
427 {
Ed Tanousf79b7a52021-09-22 19:04:29 -0700428 if (!req)
429 {
430 return;
431 }
Ed Tanous1abe55e2018-09-05 08:30:59 -0700432 BMCWEB_LOG_INFO << "Response: " << this << ' ' << req->url << ' '
433 << res.resultInt() << " keepalive=" << req->keepAlive();
Ed Tanous7045c8d2017-04-03 10:04:37 -0700434
Ed Tanous0260d9d2021-02-07 19:31:07 +0000435 addSecurityHeaders(*req, res);
Ed Tanous52cc1122020-07-18 13:51:21 -0700436
Ed Tanouscf099fa2021-08-25 12:37:31 -0700437 crow::authorization::cleanupTempSession(*req);
Ed Tanous7045c8d2017-04-03 10:04:37 -0700438
Ed Tanouse278c182019-03-13 16:23:37 -0700439 if (!isAlive())
Ed Tanous1abe55e2018-09-05 08:30:59 -0700440 {
441 // BMCWEB_LOG_DEBUG << this << " delete (socket is closed) " <<
442 // isReading
443 // << ' ' << isWriting;
444 // delete this;
Jan Sowinskiee52ae12020-01-09 16:28:32 +0000445
446 // delete lambda with self shared_ptr
447 // to enable connection destruction
John Edward Broadbent4147b8a2021-07-19 16:52:24 -0700448 res.setCompleteRequestHandler(nullptr);
Ed Tanous1abe55e2018-09-05 08:30:59 -0700449 return;
450 }
451 if (res.body().empty() && !res.jsonValue.empty())
452 {
John Edward Broadbent59b98b22021-07-13 15:36:32 -0700453 if (http_helpers::requestPrefersHtml(req->getHeaderValue("Accept")))
Ed Tanous1abe55e2018-09-05 08:30:59 -0700454 {
455 prettyPrintJson(res);
456 }
457 else
458 {
459 res.jsonMode();
Ed Tanous71f52d92021-02-19 08:51:17 -0800460 res.body() = res.jsonValue.dump(
461 2, ' ', true, nlohmann::json::error_handler_t::replace);
Ed Tanous1abe55e2018-09-05 08:30:59 -0700462 }
463 }
Ed Tanous7045c8d2017-04-03 10:04:37 -0700464
Ed Tanous1abe55e2018-09-05 08:30:59 -0700465 if (res.resultInt() >= 400 && res.body().empty())
466 {
467 res.body() = std::string(res.reason());
468 }
Ed Tanous6295bec2019-09-03 10:11:01 -0700469
470 if (res.result() == boost::beast::http::status::no_content)
471 {
472 // Boost beast throws if content is provided on a no-content
473 // response. Ideally, this would never happen, but in the case that
474 // it does, we don't want to throw.
475 BMCWEB_LOG_CRITICAL
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100476 << this << " Response content provided but code was no-content";
Ed Tanous6295bec2019-09-03 10:11:01 -0700477 res.body().clear();
478 }
479
Ed Tanous1abe55e2018-09-05 08:30:59 -0700480 res.addHeader(boost::beast::http::field::date, getCachedDateStr());
481
482 res.keepAlive(req->keepAlive());
483
484 doWrite();
Jan Sowinskiee52ae12020-01-09 16:28:32 +0000485
486 // delete lambda with self shared_ptr
487 // to enable connection destruction
John Edward Broadbent4147b8a2021-07-19 16:52:24 -0700488 res.setCompleteRequestHandler(nullptr);
Ed Tanous1abe55e2018-09-05 08:30:59 -0700489 }
490
Sunitha Harishc0ea7ae2020-10-30 02:37:30 -0500491 void readClientIp()
492 {
John Edward Broadbent59b98b22021-07-13 15:36:32 -0700493 boost::asio::ip::address ip;
494 boost::system::error_code ec = getClientIp(ip);
495 if (ec)
496 {
497 return;
498 }
499 req->ipAddress = ip;
500 }
501
502 boost::system::error_code getClientIp(boost::asio::ip::address& ip)
503 {
Sunitha Harishc0ea7ae2020-10-30 02:37:30 -0500504 boost::system::error_code ec;
505 BMCWEB_LOG_DEBUG << "Fetch the client IP address";
506 boost::asio::ip::tcp::endpoint endpoint =
507 boost::beast::get_lowest_layer(adaptor).remote_endpoint(ec);
508
509 if (ec)
510 {
511 // If remote endpoint fails keep going. "ClientOriginIPAddress"
512 // will be empty.
513 BMCWEB_LOG_ERROR << "Failed to get the client's IP Address. ec : "
514 << ec;
John Edward Broadbent59b98b22021-07-13 15:36:32 -0700515 return ec;
Sunitha Harishc0ea7ae2020-10-30 02:37:30 -0500516 }
John Edward Broadbent59b98b22021-07-13 15:36:32 -0700517 ip = endpoint.address();
518 return ec;
Sunitha Harishc0ea7ae2020-10-30 02:37:30 -0500519 }
520
Ed Tanous1abe55e2018-09-05 08:30:59 -0700521 private:
522 void doReadHeaders()
523 {
Ed Tanous1abe55e2018-09-05 08:30:59 -0700524 BMCWEB_LOG_DEBUG << this << " doReadHeaders";
525
526 // Clean up any previous Connection.
527 boost::beast::http::async_read_header(
Ed Tanousceac6f72018-12-02 11:58:47 -0800528 adaptor, buffer, *parser,
Jan Sowinskiee52ae12020-01-09 16:28:32 +0000529 [this,
530 self(shared_from_this())](const boost::system::error_code& ec,
Ed Tanous81ce6092020-12-17 16:54:55 +0000531 std::size_t bytesTransferred) {
Ed Tanous1abe55e2018-09-05 08:30:59 -0700532 BMCWEB_LOG_ERROR << this << " async_read_header "
Ed Tanous81ce6092020-12-17 16:54:55 +0000533 << bytesTransferred << " Bytes";
Ed Tanous1abe55e2018-09-05 08:30:59 -0700534 bool errorWhileReading = false;
535 if (ec)
536 {
537 errorWhileReading = true;
538 BMCWEB_LOG_ERROR
539 << this << " Error while reading: " << ec.message();
540 }
541 else
542 {
543 // if the adaptor isn't open anymore, and wasn't handed to a
544 // websocket, treat as an error
John Edward Broadbent59b98b22021-07-13 15:36:32 -0700545 if (!isAlive() &&
546 !boost::beast::websocket::is_upgrade(parser->get()))
Ed Tanous1abe55e2018-09-05 08:30:59 -0700547 {
548 errorWhileReading = true;
549 }
550 }
551
James Feist3909dc82020-04-03 10:58:55 -0700552 cancelDeadlineTimer();
553
Ed Tanous1abe55e2018-09-05 08:30:59 -0700554 if (errorWhileReading)
555 {
Ed Tanouse278c182019-03-13 16:23:37 -0700556 close();
Ed Tanous1abe55e2018-09-05 08:30:59 -0700557 BMCWEB_LOG_DEBUG << this << " from read(1)";
Ed Tanous1abe55e2018-09-05 08:30:59 -0700558 return;
559 }
560
John Edward Broadbent59b98b22021-07-13 15:36:32 -0700561 boost::beast::http::verb method = parser->get().method();
562 readClientIp();
Ed Tanous92ccb882020-08-18 10:36:33 -0700563
John Edward Broadbent59b98b22021-07-13 15:36:32 -0700564 boost::asio::ip::address ip;
565 if (getClientIp(ip))
566 {
567 BMCWEB_LOG_DEBUG << "Unable to get client IP";
568 }
Ed Tanous9a69d5a2021-09-13 10:23:51 -0700569 sessionIsFromTransport = false;
John Edward Broadbent59b98b22021-07-13 15:36:32 -0700570 userSession = crow::authorization::authenticate(
Ed Tanous1d3c14a2021-09-22 18:54:40 -0700571 ip, res, method, parser->get().base(), userSession);
John Edward Broadbent59b98b22021-07-13 15:36:32 -0700572 bool loggedIn = userSession != nullptr;
James Feist3909dc82020-04-03 10:58:55 -0700573 if (loggedIn)
574 {
575 startDeadline(loggedInAttempts);
576 BMCWEB_LOG_DEBUG << "Starting slow deadline";
577
Ed Tanousd32c4fa2021-09-14 13:16:51 -0700578 req->urlParams = req->urlView.query_params();
James Feist5a7e8772020-07-22 09:08:38 -0700579
580#ifdef BMCWEB_ENABLE_DEBUG
581 std::string paramList = "";
582 for (const auto param : req->urlParams)
583 {
584 paramList += param->key() + " " + param->value() + " ";
585 }
586 BMCWEB_LOG_DEBUG << "QueryParams: " << paramList;
587#endif
James Feist3909dc82020-04-03 10:58:55 -0700588 }
589 else
590 {
591 const boost::optional<uint64_t> contentLength =
592 parser->content_length();
593 if (contentLength &&
594 *contentLength > loggedOutPostBodyLimit)
595 {
596 BMCWEB_LOG_DEBUG << "Content length greater than limit "
597 << *contentLength;
598 close();
599 return;
600 }
601
602 startDeadline(loggedOutAttempts);
603 BMCWEB_LOG_DEBUG << "Starting quick deadline";
604 }
Ed Tanous1abe55e2018-09-05 08:30:59 -0700605 doRead();
606 });
607 }
608
609 void doRead()
610 {
Ed Tanous1abe55e2018-09-05 08:30:59 -0700611 BMCWEB_LOG_DEBUG << this << " doRead";
612
613 boost::beast::http::async_read(
Ed Tanousceac6f72018-12-02 11:58:47 -0800614 adaptor, buffer, *parser,
Jan Sowinskiee52ae12020-01-09 16:28:32 +0000615 [this,
616 self(shared_from_this())](const boost::system::error_code& ec,
Ed Tanous81ce6092020-12-17 16:54:55 +0000617 std::size_t bytesTransferred) {
618 BMCWEB_LOG_DEBUG << this << " async_read " << bytesTransferred
Ed Tanous1abe55e2018-09-05 08:30:59 -0700619 << " Bytes";
Ed Tanous1abe55e2018-09-05 08:30:59 -0700620
621 bool errorWhileReading = false;
622 if (ec)
623 {
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100624 BMCWEB_LOG_ERROR
625 << this << " Error while reading: " << ec.message();
Ed Tanous1abe55e2018-09-05 08:30:59 -0700626 errorWhileReading = true;
627 }
628 else
629 {
James Feist3909dc82020-04-03 10:58:55 -0700630 if (isAlive())
631 {
632 cancelDeadlineTimer();
John Edward Broadbent59b98b22021-07-13 15:36:32 -0700633 if (userSession != nullptr)
James Feist3909dc82020-04-03 10:58:55 -0700634 {
635 startDeadline(loggedInAttempts);
636 }
637 else
638 {
639 startDeadline(loggedOutAttempts);
640 }
641 }
642 else
Ed Tanous1abe55e2018-09-05 08:30:59 -0700643 {
644 errorWhileReading = true;
645 }
646 }
647 if (errorWhileReading)
648 {
649 cancelDeadlineTimer();
Ed Tanouse278c182019-03-13 16:23:37 -0700650 close();
Ed Tanous1abe55e2018-09-05 08:30:59 -0700651 BMCWEB_LOG_DEBUG << this << " from read(1)";
Ed Tanous1abe55e2018-09-05 08:30:59 -0700652 return;
653 }
654 handle();
655 });
656 }
657
658 void doWrite()
659 {
James Feist3909dc82020-04-03 10:58:55 -0700660 bool loggedIn = req && req->session;
661 if (loggedIn)
662 {
663 startDeadline(loggedInAttempts);
664 }
665 else
666 {
667 startDeadline(loggedOutAttempts);
668 }
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100669 BMCWEB_LOG_DEBUG << this << " doWrite";
Ed Tanous1abe55e2018-09-05 08:30:59 -0700670 res.preparePayload();
671 serializer.emplace(*res.stringResponse);
672 boost::beast::http::async_write(
Ed Tanousceac6f72018-12-02 11:58:47 -0800673 adaptor, *serializer,
Jan Sowinskiee52ae12020-01-09 16:28:32 +0000674 [this,
675 self(shared_from_this())](const boost::system::error_code& ec,
Ed Tanous81ce6092020-12-17 16:54:55 +0000676 std::size_t bytesTransferred) {
677 BMCWEB_LOG_DEBUG << this << " async_write " << bytesTransferred
Ed Tanous1abe55e2018-09-05 08:30:59 -0700678 << " bytes";
679
James Feist54d8bb12020-07-20 13:28:59 -0700680 cancelDeadlineTimer();
681
Ed Tanous1abe55e2018-09-05 08:30:59 -0700682 if (ec)
683 {
684 BMCWEB_LOG_DEBUG << this << " from write(2)";
Ed Tanous1abe55e2018-09-05 08:30:59 -0700685 return;
686 }
Ed Tanousceac6f72018-12-02 11:58:47 -0800687 if (!res.keepAlive())
Ed Tanous1abe55e2018-09-05 08:30:59 -0700688 {
Ed Tanouse278c182019-03-13 16:23:37 -0700689 close();
Ed Tanous1abe55e2018-09-05 08:30:59 -0700690 BMCWEB_LOG_DEBUG << this << " from write(1)";
Ed Tanous1abe55e2018-09-05 08:30:59 -0700691 return;
692 }
693
694 serializer.reset();
695 BMCWEB_LOG_DEBUG << this << " Clearing response";
696 res.clear();
697 parser.emplace(std::piecewise_construct, std::make_tuple());
Gunnar Millsded2a1e2020-07-24 09:46:33 -0500698 parser->body_limit(httpReqBodyLimit); // reset body limit for
699 // newly created parser
Ed Tanous1abe55e2018-09-05 08:30:59 -0700700 buffer.consume(buffer.size());
701
Ed Tanous9a69d5a2021-09-13 10:23:51 -0700702 // If the session was built from the transport, we don't need to
703 // clear it. All other sessions are generated per request.
704 if (!sessionIsFromTransport)
705 {
706 userSession = nullptr;
707 }
708
Ed Tanous1d3c14a2021-09-22 18:54:40 -0700709 // Destroy the Request via the std::optional
710 req.reset();
Ed Tanous1abe55e2018-09-05 08:30:59 -0700711 doReadHeaders();
712 });
713 }
714
Ed Tanous1abe55e2018-09-05 08:30:59 -0700715 void cancelDeadlineTimer()
716 {
Jan Sowinskiee52ae12020-01-09 16:28:32 +0000717 if (timerCancelKey)
718 {
719 BMCWEB_LOG_DEBUG << this << " timer cancelled: " << &timerQueue
720 << ' ' << *timerCancelKey;
721 timerQueue.cancel(*timerCancelKey);
722 timerCancelKey.reset();
723 }
Ed Tanous1abe55e2018-09-05 08:30:59 -0700724 }
725
James Feist3909dc82020-04-03 10:58:55 -0700726 void startDeadline(size_t timerIterations)
Ed Tanous1abe55e2018-09-05 08:30:59 -0700727 {
728 cancelDeadlineTimer();
729
James Feist3909dc82020-04-03 10:58:55 -0700730 if (timerIterations)
731 {
732 timerIterations--;
733 }
Jan Sowinski2b5e08e2020-01-09 17:16:02 +0100734
James Feist3909dc82020-04-03 10:58:55 -0700735 timerCancelKey =
James Feistbe5dfca2020-07-22 08:54:59 -0700736 timerQueue.add([self(shared_from_this()), timerIterations,
737 readCount{parser->get().body().size()}] {
James Feist3909dc82020-04-03 10:58:55 -0700738 // Mark timer as not active to avoid canceling it during
739 // Connection destructor which leads to double free issue
740 self->timerCancelKey.reset();
741 if (!self->isAlive())
742 {
743 return;
744 }
Jan Sowinski2b5e08e2020-01-09 17:16:02 +0100745
James Feistbe5dfca2020-07-22 08:54:59 -0700746 bool loggedIn = self->req && self->req->session;
747 // allow slow uploads for logged in users
748 if (loggedIn && self->parser->get().body().size() > readCount)
749 {
750 BMCWEB_LOG_DEBUG << self.get()
751 << " restart timer - read in progress";
752 self->startDeadline(timerIterations);
753 return;
754 }
755
James Feist3909dc82020-04-03 10:58:55 -0700756 // Threshold can be used to drop slow connections
757 // to protect against slow-rate DoS attack
758 if (timerIterations)
759 {
James Feistbe5dfca2020-07-22 08:54:59 -0700760 BMCWEB_LOG_DEBUG << self.get() << " restart timer";
James Feist3909dc82020-04-03 10:58:55 -0700761 self->startDeadline(timerIterations);
762 return;
763 }
764
765 self->close();
766 });
James Feistcb6cb492020-04-03 13:36:17 -0700767
768 if (!timerCancelKey)
769 {
770 close();
771 return;
772 }
Ed Tanous1abe55e2018-09-05 08:30:59 -0700773 BMCWEB_LOG_DEBUG << this << " timer added: " << &timerQueue << ' '
Jan Sowinskiee52ae12020-01-09 16:28:32 +0000774 << *timerCancelKey;
Ed Tanous1abe55e2018-09-05 08:30:59 -0700775 }
776
777 private:
778 Adaptor adaptor;
779 Handler* handler;
Ed Tanousa24526d2018-12-10 15:17:59 -0800780 // Making this a std::optional allows it to be efficiently destroyed and
Ed Tanous1abe55e2018-09-05 08:30:59 -0700781 // re-created on Connection reset
Ed Tanousa24526d2018-12-10 15:17:59 -0800782 std::optional<
Ed Tanous1abe55e2018-09-05 08:30:59 -0700783 boost::beast::http::request_parser<boost::beast::http::string_body>>
784 parser;
785
Ed Tanous3112a142018-11-29 15:45:10 -0800786 boost::beast::flat_static_buffer<8192> buffer;
Ed Tanous1abe55e2018-09-05 08:30:59 -0700787
Ed Tanousa24526d2018-12-10 15:17:59 -0800788 std::optional<boost::beast::http::response_serializer<
Ed Tanous1abe55e2018-09-05 08:30:59 -0700789 boost::beast::http::string_body>>
790 serializer;
791
Ed Tanousa24526d2018-12-10 15:17:59 -0800792 std::optional<crow::Request> req;
Ed Tanous1abe55e2018-09-05 08:30:59 -0700793 crow::Response res;
Ed Tanous52cc1122020-07-18 13:51:21 -0700794
Ed Tanous9a69d5a2021-09-13 10:23:51 -0700795 bool sessionIsFromTransport = false;
John Edward Broadbent59b98b22021-07-13 15:36:32 -0700796 std::shared_ptr<persistent_data::UserSession> userSession;
Ed Tanous1abe55e2018-09-05 08:30:59 -0700797
Jan Sowinskiee52ae12020-01-09 16:28:32 +0000798 std::optional<size_t> timerCancelKey;
Ed Tanous1abe55e2018-09-05 08:30:59 -0700799
Ed Tanous1abe55e2018-09-05 08:30:59 -0700800 std::function<std::string()>& getCachedDateStr;
801 detail::TimerQueue& timerQueue;
Jan Sowinskiee52ae12020-01-09 16:28:32 +0000802
803 using std::enable_shared_from_this<
Ed Tanous52cc1122020-07-18 13:51:21 -0700804 Connection<Adaptor, Handler>>::shared_from_this;
Ed Tanous3112a142018-11-29 15:45:10 -0800805};
Ed Tanous1abe55e2018-09-05 08:30:59 -0700806} // namespace crow